Private by default: reasonable expectations in secondary uses of patient data

The ‘reasonable expectations of privacy’ test has become central to English information law. The fact-specificity of this test has obfuscated the scope of patients’ privacy rights. In both R (W, X, Y & Z) v Secretary of State for Health and Prismall v Google, the claimants were found to lack a circumstantially reasonable expectation of privacy when their identifiable information was disclosed outside the healthcare system, obviating the need for justification under Article 8 European Convention on Human Rights (ECHR). In response to these developments, this article argues for a legal presumption of privacy when patients’ data are used for purposes other than their healthcare. This would be a development of the courts’ existing ‘starting point’ of assuming reasonable expectations of privacy in identifiable medical information. The two cases explored in this article suggest that this ‘starting point’ is not enough, and still affords judges broad discretion to evaluate a (non-exhaustive) list of factors in each individual case. For the sake of the clarity and accessibility of patients’ rights, I argue that privacy should be presumed by default when their data are used for purposes other than their healthcare.