This site is intended for health professionals only

At the heart of general practice since 1960

Read the latest issue online

The docbot will see you now

GMC denies breaching data legislation to share personal GP information

GPs have questioned the GMC over plans to share their personal data without obtaining consent.

The GMC sent an email to over 40,000 doctors last week telling them that unless they specifically opted out, their personal data would be shared with researchers.

Imperial College London head of primary care and public health Professor Azeem Majeed, who was among GPs who recieved the email, said the method 'goes against good research practice', adding that if a doctor did this they would be 'referred to the GMC'.

Under new data protection rules all consent for sharing personal data should be opt-in. However, the GMC has maintained that it is 'fully compliant' with the rules.

In the email seen by Pulse, the GMC invited doctors working in medicine to complete a survey to support a University of Surrey research review relating to the gender pay gap.

It specifically said that unless the doctors opted out, their contact details would be shared with the researchers.

The GMC email said: ‘We're supporting this research by putting the researchers in touch with a random sample of doctors. If you would like to take part, you don't need to do anything.

‘We'll share your name, salutation and email address with the researchers, who will then send you a link to the survey…Your details will only be used for this purpose and they will be deleted afterwards.’

It added: ‘If you don't want your contact details passed to the University of Surrey please just click the "opt out" button below by the 8 November 2018 and email us your full name, postcode and GMC number.’

However, opt-out consent is not deemed acceptable under the new EU General Data Protection Regulation (GDPR) brought in earlier this year.

According to GDPR guidance published by the Information Commissioner’s Office, 'all consent must be opt-in consent', there is 'no such thing' as “opt-out consent” and 'failure to opt out is not consent'. 

'You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way,' the guidance adds.

Professor Majeed said: ‘This goes against good research practice and information governance whereby study participants are expected to opt in.

'As a researcher, it is not something I could do. It could result in both disciplinary action by the employer and referral to the GMC if a doctor did this.'

He added that 'doctors expect their professional regulator to behave better than this'.

But the GMC argued that the email was compliant with data protection rules, citing a section concerning 'legitimate interests'.

A spokesperson said: 'We take the processing of personal data seriously and our approach is fully compliant with the GDPR. The GDPR provides a number of conditions for the processing of personal data. Consent is often used; however, other conditions may be applicable too.

'In this instance we are processing personal data based on the legitimate interests of the University of Surrey to undertake this research. We have provided doctors with a mechanism to not participate, in the form of an opt out.'

But solicitor Toni Vitale, head of regulation, data and information at Winckworth Sherwood, said he does not agree.

He said: ‘I think that this is a genuine concern. It seems slightly odd that the GMC would choose to do this in this way.’

He continued: ‘A lot of people see legitimate interests as a silver bullet, a get out of jail free card, they can just rely on it and not have to be careful of people’s rights or interests and the data can be misused.

‘I would have thought that if they [the GMC] had properly carried out the balancing test on the researchers/GMC and the doctors, the doctors rights would have outweighed theirs.’

Readers' comments (33)

  • Serious mistake by the GMC

    Unsuitable or offensive? Report this comment

  • thank you Prof Majeed for highlighting this abhorrent practice by our regulator. Just illustrates what I thought all along: GMC do not consider Doctors rights to be as important or equal to Patient's rights.

    Unsuitable or offensive? Report this comment

  • GMC, another self serving organisation. What rights do Doctors have anymore?

    Unsuitable or offensive? Report this comment

  • Still awaiting my email?

    Unsuitable or offensive? Report this comment

  • Still waiting for my email too. Doctors have less human rights than the public is not right. The double standards persisting is shocking. Thank you Prof. Majeed for sharing this.

    Unsuitable or offensive? Report this comment

  • GMC abusing Drs right well I never!

    Unsuitable or offensive? Report this comment

  • This organisation just can't get anything right ever. Not unbelievable.
    You would have thought an awareness that their relationship with the profession wasn't exactly hunky dory would have made their behaviour squeaky clean at the moment.
    Again, extremely poor decision making and not in any way fit for purpose.

    Unsuitable or offensive? Report this comment

  • Also never got an email...?

    Unsuitable or offensive? Report this comment

  • Affected doctors should report the GMC to the Information Commissioner for breach of GDPR and let them decide if the GMC is fully compliant or not.

    Unsuitable or offensive? Report this comment

  • Neil Bhatia

    I do hope that anyone who receives such an email will complain to the ICO

    Unsuitable or offensive? Report this comment

  • Another thank you to Prof Majeed (tho’ you are mistaken - this is exactly the attitude and behaviour we have come to expect from the GMC).

    Unsuitable or offensive? Report this comment

  • Vinci Ho

    Ha ha ha
    One could argue that these kind of GMC moves would have gone unchecked previously.?(And somebody in GMC hierarchy might have even called this ‘a storm in a teacup’).
    The truth is this simply demonstrates how much our profession DO NOT trust GMC which ,as I wrote in the past , has an above-the-law superhero-people’s guardian ego complex.
    We are watching every little move you make .....

    Unsuitable or offensive? Report this comment

  • Dear All,
    The GMC is wrong. It is clear cut. Both the GMC and Surrey University are "Public Authorities" under the terms of the F.O.I Act. Public authorities are not allowed by GDPR to rely upon legitimate interests. Ergo the lawful processing of thsi dat could only be under GDPR compliant consent, which is where Pulse came in.
    Regards
    Paul C

    Unsuitable or offensive? Report this comment

  • Dear All,
    Correction, the GMC has not yet breached GDPR, at the moment it has misinterpreted GDPR and is intending to breach it. If on the 8th November as planned it hands over the data to Surrey University it will then have breached GDPR. That breach will, when set against the publicity of this debate, be rightly considered to be an aggravated breach, in that they had plenty of warning and time to reverse the impending breach. At that point there could possibly be 40,000 complaints being made to the ICO.
    Regards
    Paul C
    GP Wimbledon

    Unsuitable or offensive? Report this comment

  • Vinci Ho

    You see on another angle , if even GMC would want to behave this way ( yes , give the benefit of doubt that they have not actually breached yet) , how can we trust these private companies running smartphone-GP-apps are not going to exploit any loopholes in the GDPR to trade patients’ big data forward and backwards?

    Unsuitable or offensive? Report this comment

  • Jones the Tie

    reporting GMC to the information comissioner is the correct way to go as GDPR covers this sort of major breach. The damages are unlimited I believe if any detriment befalls the individual whose data is released ? ooh dear GMC...

    Unsuitable or offensive? Report this comment

  • How can Gps be classed as data controllers when we have absolutley no control over the data we access and input which exists in the cloud and probably sit on some server in Leeds.The GDPR is a complete cluster**ck and is going to cause a lot of grief.Even our'betters' dont understand it and potentially breach it.

    Unsuitable or offensive? Report this comment

  • If the GMC has breached GDPR rules shouldn't they be fined €20milliom or 4% of turnover? I would like to see them reflect on that. And are they selling our contact details to these research companies??

    Unsuitable or offensive? Report this comment

  • Im sure Charlie the Lush has the legal advice to support him

    Unsuitable or offensive? Report this comment

  • Vitriol rightly directed, but if they do get fined, guess who ends up paying, not the florid Charlie for sure

    Unsuitable or offensive? Report this comment

  • Please Poll: Should the GMC have an annual appraisal for their FITNESS TO PRACTICE, PROBITY ISSUES,PROFESSIONALISM, HONESTY(DUTY OF CANDOUR), TEAMWORKING, COMMUNICATION......enough said THE PREACHER DOES'NT PRACTICE WHAT HE/SHE PREACHES.

    Unsuitable or offensive? Report this comment

  • Um,
    The GMC are going to give contact details to a researcher who can ask you if you want to take part in some research about the gender pay gap. You can opt out at once in advance. You can opt out later when the researcher asks consent.
    I mean it’s not exactly the Spanish Inquisition.
    Sounds like the research might be a good thing.
    Also lots of good research gets totally mashed because we now have to ask people if they will opt in to being contacted by researchers who will ask them if they want to be part of some research. GDPR is doing more harm than good in health care.

    Unsuitable or offensive? Report this comment

  • Of course this is a good idea.
    As chief exec of GMC and a good friend to many politicians I can make my own rules.
    I own your data. Mine, mine all mine!!
    So what if I am fined by ICO, you lot will have to pay the bill, and I will still be in charge.
    Now how do I appeal the BG appeal??

    Unsuitable or offensive? Report this comment

  • I noted somebody working in GMC has been accessing my profile on LinkedIn. Is that normal????

    Unsuitable or offensive? Report this comment

  • Interesting this morning seem to have a few extra spam emails asking me to partake in junk medical research on my email account from organisations I've never seen before,coincidence?

    Unsuitable or offensive? Report this comment

  • Dear GMC just delete this rubbish straight away!

    Unsuitable or offensive? Report this comment

  • |Francesca Denman | Hospital Doctor|17 Oct 2018 10:50pm

    How do you define good research? Gender pay gap? It is illegal for 30 yrs to pay a woman differently for the 'same amount of work' as a man ( not including maternity pay differences or higher levels of sick/compassionate leave taken of course). Also University of Surrey, i.e. TAXPAYER-FUNDED research... 1. pointless, as far as I can see, 2. WE are paying for it. 3. The GMC might be profiteering from sharing this data. 4. We have a right to choose to share our data, whether the research is deemed useful or not, or whether there are multiple get-out clauses along the way. Are you really on the other side of the fence on this one?

    Unsuitable or offensive? Report this comment

  • *maternity leave differences oops lol

    Unsuitable or offensive? Report this comment

  • There is no need to reflect is one denies any error. Double standards again.

    Unsuitable or offensive? Report this comment

  • doctors have always had less rights than other people.
    nothing new here.

    Unsuitable or offensive? Report this comment

  • Problem is that if the GMC get fined we blinking we’ll pay for it

    Unsuitable or offensive? Report this comment

  • An organisation that considers itself to be an authority in CONFIDENTIALITY and publishes guidelines on it, has the cheek to blatantly abuse it.

    Unsuitable or offensive? Report this comment

  • Took Early Retirement

    Well done Prof!

    Unsuitable or offensive? Report this comment

Have your say