The precise nature of a regulator's powers will be determined by the relevant statute establishing that regulator. Most regulators have the power to require a Registrant who is the subject of investigation to provide details of the indemnity cover and their employer or the organisation(s) for whom they provide services. They also have wider powers to require third parties to provide information or documents. This usually requires the service of a notice requiring the supply of the information and the power to enforce such a notice through the courts.
In relatively recent times the GMC obtained a power to require the Registrant who is the subject of an investigation to provide a wide range of information to the Council. The powers to require disclosure do not disapply the data protection legislation. Broadly speaking they allow the Regulator to impose an obligation to disclose material which the third party would have had a discretion to disclose in any event. Where there was no such discretion to disclose in the first instance, the Regulator cannot create an obligation to disclose.
Any party receiving a notice from a regulator requiring them to disclose information as part of a fitness to practise investigation should seek independent advice to avoid the risk of disclosing material which goes beyond the scope of the notice thus breaching data protection requirements.
Originally published 30 April 2021.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.