An update: requests for medical records, GDPR, personal data, data controllers and processors

A recent case clarifies the grounds for disclosure of a patient's medical records against a non-party and in this case, a GP practice.

While the decision is fact specific it serves as a reminder of the rules around disclosure of special category personal data, including the extent of disclosure in light of GDPR. You can read our earlier blog post here.

Mills & Reeve acted for the Respondents in this matter and have prepared a case commentary on the County Court's decision. Questions regarding the case should be directed to Claire Williams.

Our content explained

Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.

Posted by


Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R


Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.


Mills & Reeve system for employees.