How does section 41 apply to requests for information about deceased people?

Contents

The duty of confidence can apply even if the person you owed it to dies.

The most common requests about the deceased are for their medical or social care records. These requests often come from relatives of the person who has died.

The type of information requested in this context is often classed as personal or private information.

As explained before, you cannot rely on section 40 when the requested information identifies a deceased person. That is because data protection legislation only applies to identifiable living individuals. Section 40 could still be relevant where the information about the deceased is mixed with the information of an identifiable living person, eg a family member.

If section 40 does not apply, you should consider the application of section 41.

You need to be satisfied deceased people can be identified. That is, section 41 is unlikely to apply if the request is for aggregated and anonymised information.

When relying on section 41 to deal with requests for information about deceased people, you should follow the same approach set out in “How do you apply section 41?”.

However, there are some specific issues you should consider in this context:

Who you received the information from. Generally, this will be the deceased person themselves. However, it could also be someone else. For example, health information in a medical or social care record could be information received by:
- the deceased patient in the context of a medical relationship with their doctor or clinician. The doctor’s notes could also be information “obtained by” the doctor for the purpose of section 41(1)(a) if they reveal information received from the patient; or
- another person, public authority or organisation which, in turn, obtained it from the deceased person.

Example

In Redman v Information Commissioner and Norfolk County Council (EA/2012/0182, 13 November 2012), the First-tier Tribunal decided that the requirement set out in section 41(1)(a) was met. This is because the authority – Norfolk County Council – had obtained the information from other relevant authorities such as the NHS and the police.

The applicant’s mother had been placed under the sole care of Norfolk County Council’s Adult Social Services. The applicant had been prevented from staying with their mother at this time. She was admitted to hospital shortly after being placed in the council’s care. She passed away two days after being admitted in the hospital.

The applicant requested information from the council about the events leading to their mother’s admittance into hospital.

The First-tier Tribunal agreed with the Commissioner that:

“the social services records are about the care of Mrs Redman and we accept that such information should be considered to be information obtained from other persons such as NHS staff, the police, Mrs Redman herself and Mr Redman.” [para. 21]

The applicant did not dispute this finding when appealing the case at Upper Tribunal.

The nature of the information. As mentioned, the most common requests about deceased people are for information about the deceased’s health. This is information of a private nature that you should treat as more than trivial. You also don’t need to show detriment. It is enough to show that the person to whom the information relates would have expected you to treat it as private and not share it further. However, if that person had indicated that they were content for the information to be made public, you can take that into account.
The extent to which the information is in the public domain. Section 41 does not apply to the factual information about a person’s death, usually recorded in a death certificate. Death certificates are public documents which include information such as the cause of death and where and when the person died. Information about a deceased person can also enter the public domain as a result of an inquest or a court case.
Alternative routes people have to access the information. For example, in the context of requests for medical information about a deceased person, you could check if the applicant has a right of access under the Access to Health Records Act 1990 (‘AHRA’). If they do, disclosing the information to the world at large is unlikely to be proportionate. If the applicant can access the information via another route, you could also consider the application of section 21.

For more advice on the section 21 exemption, read our guidance on Information accessible to the applicant by other means (section 21).

Example

In Webber v Information Commissioner and Nottingham NHS Trust ([2013] UKUT 0648 (AAC)), the Upper Tribunal upheld the First-tier Tribunal (‘FtT’) decision that section 41 applied to a request for the medical information about the applicant’s son. He had died by suicide whilst in hospital.

In upholding the FtT’s decision, the Upper Tribunal considered relevant the following:

there could already be information in the public domain, for example as a result of a coroner’s inquest. The Tribunal noted this would have been a requirement given the cause of death of the applicant’s son [para. 19]; and
as their son’s personal representative, the applicant was likely to have access via the AHRA 1990.

Who can bring a claim for breach of confidence. When the person you owe a duty of confidence to has died, the right to bring an action for breach of confidence passes to their personal representative. This is the person who is entitled to administer the estate of the deceased person.

If the person has left a will naming someone as executor, the executor will normally be the personal representative. If the deceased did not leave a will, ie they died intestate, the personal representative will be the administrator. Probate rules can help you identify who might have a right to apply to be an administrator. A personal representative would normally have either a grant of probate or a letter of administration showing they’re entitled to deal with the deceased’s person estate. However, these are not always necessary.

Example

In the Bluck example cited above, the First-tier Tribunal decided that the personal representative of the deceased would be able to bring an action for breach of confidence against the Trust.

In this case, the personal representative was the deceased’s husband.

In Lewis v The Secretary of State for Health ([2008] EWHC 2196 QB), the High Court approved the FtT’s reasoning in this case.

You don’t have to be certain that a personal representative exists. If – by the time of your response – you cannot determine if there’s a personal representative, you should assume that there could be one. Assuming otherwise could leave you exposed to the risk of legal action for breach of confidence.