GENERAL PHARMACEUTICAL COUNCIL

FITNESS TO PRACTISE COMMITTEE

PRINCIPAL HEARING

25 Canada Square, London E14 5LQ

Tuesday 24 May 2016

Chairman: Mr Peter Wrench

Committee Members: Mrs Hilary Anderson

Mrs Elizabeth Burnley

Legal Adviser: Ms Valerie Charbit

Committee Secretary: Mr Mark Mallinson

CASE OF:

DR HARRISON, Julian Earle

GPhC Registration No 2039775

and

LEE, Daniel Mark

GPhC Registration No 2039891

(DAY TWO)

____________________________________

MR JOHN HEPWORTH, Solicitor Advocate, appeared on behalf of the General

Pharmaceutical Council.

MISS SARAH TAYLOR, Solicitor, of Pinsent Mason Solicitors, appeared on behalf of Dr

Harrison and Mr Lee, who were present.

_______________________________

Transcript of the stenograph notes of T.A. Reed & Co Ltd

Tel No: 01793-764614

____________________________

Determination – impairment 2

Determination – sanction 24

Determination – interim measures 29

DETERMINATION ON IMPAIRMENT

THE CHAIRMAN: This is a principal hearing in respect of Daniel Mark Lee and

Julian Earle Harrison. Both were first registered as pharmacists in July 1992. Mr Lee has

registration number 2039891 and Dr Harrison 2039775.

Prior to the hearing, the Committee agreed an application for the joinder of the allegations

against the two registrants. This is a joint hearing but, clearly, the Committee will make

findings in respect of the two registrants individually.

Both registrants are present and are represented by Miss Taylor and the Council is

represented by Mr Hepworth.

At the start of the hearing, the Council applied to correct minor typographical errors in the

allegation against Dr Harrison. There was no objection to those changes and, as amended,

the allegation against Dr Harrison is as follows:

“1. Between 01 November 2014 and 30 December 2014 authorised the sale of patient

personal data to third parties;

2. Failed to ensure that the relevant patients gave informed consent to the use of their

personal data described in paragraph 1 above.”

The allegation against Mr Lee is as follows:

“Failed to ensure that sufficient procedures were in place to ensure that patients

provided informed consent for the use of their personal data by Pharmacy2U.”

Both registrants admitted the facts alleged and so, as the Rules require, the Committee found

them proven.

The Committee has been provided with a statement of facts, agreed between the parties. We

have heard live evidence from Ms Angela Mitchell, a lead case officer at the Information

Commissioner’s Office, and from the two registrants. We have also helpfully been given

written statements of case and skeleton arguments from Mr Hepworth and Miss Taylor to

underpin their oral submissions to us.

We have inevitably heard more detail about the facts behind these allegations in the oral

evidence, and we think it is fair to say that there is no significant difference between the

parties about the factual background, which we will now briefly summarise.

At the relevant time, Mr Lee was Managing Director and Superintendent Pharmacist of

Pharmacy2U. He is now the company’s Chief Operating Officer and remains its

Superintendent Pharmacist. Dr Harrison was, and remains, the Commercial Director.

Pharmacy2U is a pioneering online pharmacy company, a significant proportion of whose

business now involves the dispensing of NHS prescriptions. We heard that the company has

an annual turnover of some £20m and employs about 100 staff. Their customer database at

the relevant time included in excess of 300,000 individuals.

On 13 October 2014, Pharmacy2U entered into what is called a list management agreement

with a company called Alchemy Direct Media (UK) Ltd. Alchemy essentially agreed to act

as Pharmacy2U’s agents in renting out to third parties lists drawn from Pharmacy2U’s

customer database. Alchemy would promote Pharmacy2U’s lists, vet potential clients and

refer them to Pharmacy2U for approval. They would then bill and collect money from clients

and send it on to Pharmacy2U after deducting their share, which was about half of the

income.

The Pharmacy2U database was derived from the registration process which its customers

have to go through online before doing business with them. The online form asks for

an individual’s name, sex, date of birth, postal address, phone number and email address. We

were told that the data passed to Alchemy, from which it would extract lists to be rented out,

did not include phone numbers, but it did also include the date of the customer’s last order

with Pharmacy2U.

The agreement between Alchemy and Pharmacy2U was made and signed by Dr Harrison.

We heard that Mr Lee was unaware of the agreement at the time or of any plan to rent to third

parties lists derived from Pharmacy2U’s customer data. We have been told that Dr Harrison

did not know (and did not intend) that Alchemy would filter the data by age or gender before

sending lists on to third parties. However, this does not seem to be specifically addressed in

the contract between Alchemy and Pharmacy2U which we have seen. The contract is clear

that Pharmacy2U remain data controllers for the purposes of the data protection legislation.

We have heard that there were three list rentals which arose out of the Alchemy contract. In

each case we have seen copies of email exchanges between Alchemy and Dr Harrison in

which his agreement was obtained to rental to the particular third party concerned and to the

wording of what was called the “creative”, that is the text of the mailshot which the third

party was intending to send to the customers on the list it rented.

We have also seen copies of the order forms and invoices signed by and sent between

Alchemy and the third parties. We have heard that Dr Harrison did not see copies of these

documents at the time of his agreement to the respective rentals.

The three rentals arranged by Alchemy were these:

On 20 November 2014, Dr Harrison approved the rental of 10,000 records to Griffin

Media Solutions on behalf of Woods Supplements, a company which sells health

supplements both online and through mail order catalogues.

On 24 November, Dr Harrison approved the rental of 5,500 records to Black Kite

Media on behalf of Camphill Village Trust Ltd, a charity registered in the UK that

manages communities for people with disabilities.

On 8 December, Dr Harrison approved the rental of 3,000 records to GP Network

Party Ltd, an Australian lottery company. Their mailshot invited recipients to buy

lottery tickets.

In total, some 21,500 patient records were passed to third parties for one use only under the

contract, including a number of spares to allow for potential duplicates.

The email exchanges show Dr Harrison quickly agreeing to the first two proposals. There is

a comment on the third about the Australian lottery as follows:

“OK but let’s use the less spammy creative please, and if we get any complaints

I would like to stop this immediately.”

Dr Harrison confirmed in evidence that he had had some concerns about the initially

proposed creative and he had also checked documentation, including the company’s lottery

licence. We heard that the lottery mailshot which was sent out offered recipients a “unique

opportunity to win millions of dollars”. It was found out later that three of the Pharmacy2U

customers had filled in forms and sent payment to buy tickets, but in no case was any prize

won.

The details from the order forms show that Alchemy filtered the Pharmacy2U database to

provide segmented lists. For Woods Supplements, it was customers who had ordered from

Pharmacy2U within the last twelve months. For the Camphill Village Trust, there was the

same criterion, although Alchemy also purported to be supplying “active donors”, but we

have been told that there is no way that any indication of charitable donations could actually

be drawn from Pharmacy2U’s data. In the case of the lottery, the list was restricted to males

aged 70 or over who had ordered in the last six months.

Those were Pharmacy2U’s transactions which Alchemy brokered with third parties in

November and December 2014.

Then, at the end of March 2015, the press raised questions about Pharmacy2U’s use of

customer data. The Information Commissioner’s Office began an investigation and

Pharmacy2U took rapid action, quickly amending their privacy policy to make clear that data

would not in future be sold to third parties, and alerting the General Pharmaceutical Council.

We were told about the outcome of the Information Commissioner’s Office’s investigation

and the corrective action which Pharmacy2U have taken.

The Information Commissioner’s Office found that Pharmacy2U had processed data unfairly

and they imposed a monetary penalty of £130,000. They summarised the contravention as

follows in the notice of that penalty:

“Pharmacy2U has obtained personal data unfairly because its online registration form

and privacy policy did not inform its customers that it intended to sell their details to

third party organisations, in addition to sending out its own marketing material. It

would not be within a customer’s reasonable expectation that this form of disclosure

would occur, even if they were willing to agree to the receipt of marketing material

from Pharmacy2U itself. If a customer wished to take up Pharmacy2U’s offer to opt

out of ‘Selected company data sharing’, they also had to go to the trouble of logging

into their account and changing the setting.

In addition, Pharmacy2U did not provide the further information that was necessary to

enable the processing in respect of its customers to be fair.

In the circumstances, Pharmacy2U’s customers did not give their informed consent to

the sale of their personal data to third party organisations. Therefore Pharmacy2U did

not have a lawful basis for processing the data under Part I of Schedule 2 to the [Data

Protection Act].”

They went on to say:

“In the circumstances, the distress suffered by Pharmacy2U’s customers is considered

to extend beyond mere irritation.”

And:

“The Commissioner also considers that such damage and/or distress was likely to be

substantial having regard to the context in which the personal data was unfairly

obtained, the number of affected individuals and the purpose for which the data was

used.”

The Information Commissioner’s Office considered that Pharmacy2U’s actions which

constituted the contravention were deliberate actions, even though Pharmacy2U did not

actually intend to contravene the Data Protection Act.

The Information Commissioner’s Office assessed the contravention as negligent in that

Pharmacy2U knew, or ought reasonably to have known, that there was a risk that this

contravention would occur. They found that the contravention was serious given the context,

the number of individuals affected (some 21,500 records) and the purposes for which the data

was used.

The ICO noted as mitigating factors the following:

Pharmacy2U has now taken substantial remedial action.

Pharmacy2U has co-operated with the Commissioner’s Office.

There will be a significant impact on Pharmacy2U’s reputation as a result of this

contravention.

The contravention was publicised in the media.

They noted an aggravating feature in the case:

That Pharmacy2U is a limited company so liability to pay a monetary penalty will not

fall on any individual.

In his evidence to us, Dr Harrison accepted full responsibility for making Pharmacy2U’s

arrangements with Alchemy. He said that he had assumed he had the patients’ informed

consent to use their data in this way because he knew that the company had a privacy policy

in place, but he had not specifically had data protection requirements in his mind and he

made no investigation to support his assumption of consent. He accepted that this was a

serious omission and that there was no properly informed consent.

Dr Harrison did not say clearly that he would not have made the arrangement with Alchemy

if he had properly considered the implications or taken legal advice. He was at pains to

emphasise that the data transfer could have been Data Protection Act compliant if the

Pharmacy2U privacy policy had been amended.

In cross-examination, he eventually accepted that the objective of the arrangement with

Alchemy was to earn income, but he was reluctant to accept Mr Hepworth’s contention that

the rental of the data had not benefited patients in any way; Dr Harrison said it was “difficult

to know”. He thought some people liked to be made aware of opportunities and the data

rental had not been to anyone’s detriment. When pressed on the impact of unwanted

correspondence, he said it was, at worst, an irritation.

Dr Harrison agreed that he had seen and approved the so-called data card which Alchemy

used to advertise Pharmacy2U’s lists. Dr Harrison said he had not given the card the

attention it deserved. The card gave an age breakdown and a list of conditions customers

might suffer from, including asthma, high blood pressure, diabetes and heart disease.

The Committee found Dr Harrison a truthful witness, but one who was clearly determined to

explain his position in his own way and who sometimes had to be pressed to give

straightforward answers to straightforward questions. He was very ready to acknowledge the

breaches of data protection law which his actions had entailed, and rather less ready to

consider how his professional obligations as a pharmacist might have been engaged by these

events. He came over to us very much as the Commercial Director of an internet business,

which he of course is.

We noted that in answering questions from the Committee, Dr Harrison said that he had had

no direct contact with patients as a pharmacist since doing locum work whilst studying for his

doctorate in the 1990s. We further noted that he was dismissive of the suggestion that

marketing from a health supplement supplier might lead patients to discontinue prescription

medicines. We would question whether patient experience is at the front of his thinking.

Mr Lee told the Committee that he knew nothing about any rental of data to third parties until

alerted by the press. He had immediately made changes to the company’s privacy policy and

stopped any further sales of data. He went on personally to write a new code of

confidentiality and led a big corporate shift in the approach to information governance.

Previously, he had known the company had a privacy policy which had been there for some

years and was subject to review, but he did not know where it had come from and had not

personally engaged with the details of it. Like Dr Harrison, Mr Lee was reluctant to say that

the sale of data should not have happened at all. He felt that the former privacy policy had

been adequate, up to the point that third party sales were made. He told us that external

regulatory inspections had raised no issue about the privacy policy. He said adjustments

could have been made to the policy which would have kept Pharmacy2U compliant with the

Data Protection Act. When pressed by the Committee, he said that his instinct would have

been never to make third party sales of data because the risk was not worth the gain. He was

clear that Pharmacy2U would not share customer data with third parties again.

When cross-examined, Mr Lee accepted that part of a Superintendent Pharmacist’s role is to

ensure that there are adequate systems in place to protect patient confidentiality and that he

had failed to do that in this case. When pressed by Mr Hepworth, he accepted that he had

failed properly to protect patients’ interests.

The Committee found Mr Lee a truthful witness. We accept that he knew nothing about the

issue until the press story broke, and that he then moved quickly to take firm corrective

action.

Both Mr Lee and Dr Harrison expressed remorse clearly for their respective failures, and we

considered that their actions subsequently and their evidence to us demonstrate insight into

the failings.

Following the witness evidence, we heard submissions from Mr Hepworth and Miss Taylor

and were given advice by our Legal Adviser. Together, those contributions gave a very full

picture of the case law on misconduct and impairment of fitness to practise.

There is no disagreement on the task which now faces the Committee. We need to assess

each registrant individually, taking full account of Mr Hepworth’s reminder that the company

Pharmacy2U, which was penalised by the Information Commissioner’s Office, is not a party

to these proceedings. For each registrant we need to decide whether the factual allegations

which have been proved amount to misconduct and, if so, and only if so, go on to consider

whether their fitness to practise is currently impaired as a result. The decision on misconduct

looks back to their actions at the time. Any decision on fitness to practise looks at the

situation today.

Mr Hepworth began by saying that any misuse of patient data is serious and goes to the heart

of the necessary trust between a patient and a health professional. He took us through the

relevant provisions of the General Pharmaceutical Council’s Standards of conduct, ethics and

performance, highlighting in particular the following:

“2.1. Consider and act in the best interests of individual patients and the public.

2.2. Make sure that your professional judgement is not affected by personal or

organisational interests, incentives, targets or similar measures.

3.5. Respect and protect people’s dignity and privacy. Take all reasonable steps to

prevent accidental disclosure or unauthorised access to confidential information.

Never disclose confidential information without consent unless required to do so by

the law or in exceptional circumstances.

3.6. Get consent for the professional services you provide and the patient information

you use.

3.7. Use information you obtain in the course of your professional practice only for

the purposes you were given it, or where the law says you can.”

Mr Hepworth made clear that standard 2.2 on professional judgement was relevant only to Dr

Harrison.

Mr Hepworth also put before the Committee the Council’s Guidance on patient

confidentiality, which was published in April 2012. Mr Hepworth made clear that it is not

part of the Council’s case that, even if properly informed consent had been given, the patient

data should never have been sold. The Committee accepts this and must proceed on the basis

that, if there had been proper informed consent, then the sales would not necessarily have

been inconsistent with the Council’s standards and guidance; we must focus on the particular

allegations that have been proved against each registrant.

Mr Hepworth went on to say that Mr Lee’s failure to secure the interests of patients allowed

the sales to take place. In terms of the caselaw on misconduct, this could properly be seen as

morally blameworthy and something which fellow professionals would find deplorable. He

said Dr Harrison’s behaviour was worse: he was directly responsible for the sales, he put

profit before the interests of his patients, there was no benefit to patients – this was clearly

misconduct.

Moving on to impairment, Mr Hepworth said that there was no evidence of data sales on

more than the three occasions we had considered, but the Committee still needed to weigh the

risk of repetition. However, regardless of that risk, fitness to practise could be found to be

impaired in the public interest for the reasons of upholding proper standards and maintaining

public confidence in the profession.

In terms of the fitness to practise criteria in Rule 5(2) of the Fitness to Practise Rules,

Mr Hepworth argued that both registrants’ actions have brought the profession into disrepute

and have breached a fundamental principle of the profession, namely acting in the best

interests of patients. Furthermore, Mr Hepworth said that Dr Harrison’s actions in

disregarding patients’ interests showed that his integrity was in question, though

Mr Hepworth conceded that the Committee might find that this issue had now been

remediated. Mr Hepworth said that Mr Lee’s integrity was not in question. He concluded that

the fitness to practise of both registrants is impaired.

Miss Taylor then emphasised to us that under the Pharmacy Order, failure to comply with the

Council’s standards is not of itself misconduct. She said that, in relation to bringing the

profession into disrepute, these were time-limited and non-reckless errors. Dr Harrison

should have realised the need to revisit the privacy policy when he was preparing to sell to

third parties and Mr Lee should have ensured more effective procedures were in place.

However, Mr Lee had no knowledge of the data sales. The errors were regrettable, but fell

short of being deplorable. On the question of integrity, the Committee should bear in mind

the registrants’ long history as pharmacists; they had made mistakes but the mistakes had now

been remedied.

Miss Taylor argued that the necessary hurdle of serious misconduct had not been passed;

neither registrant’s actions could easily be seen as deplorable since they could easily have

been remedied by a change in the policy or by not making sales. The Information

Commissioner’s Office had concluded that the breach of the Data Protection Act was

negligent but not reckless, and the Committee should be cautious about attributing moral

blameworthiness to negligence.

Miss Taylor therefore argued against findings of misconduct, but if the Committee did so

find, she argued in respect of both registrants that fitness to practise is not currently impaired.

Future performance should not be assumed from past errors and, in the language of the case

of Cohen, this was behaviour that is easily remediable, has been remedied and is highly

unlikely to be repeated. She cautioned that public confidence issues should not prevail when

the underlying issues had been effectively addressed, and on public confidence she noted that

matters have been ongoing for some time, that the Information Commissioner’s Office notice

and the monetary penalty (which was promptly paid) were in the public domain and that there

were now these proceedings. In the circumstances, the registrants’ had been properly held to

account.

Those were the submissions. Before proceeding to set out the Committee’s findings in

respect of each registrant and the allegations that have been proved against them, it may be

helpful to say something about the Committee’s assessment of the overall seriousness of

these events because that bears on the public interest concerns, which are necessarily at the

forefront of our minds.

Public confidence may well have been damaged by the terms of the press reporting of these

issues, which the registrants told us was sensational and inaccurate. The Committee has not

seen the articles in question, but understands that readers may have formed the impression

that confidential health details of individual patients had been sold. The Committee accepts

that this was not the case.

At the other end of the scale, the registrants have sought to minimise the impact of their

failings, arguing that there was no real detriment to patients and that there had been very few

complaints or enquiries as a result of the publicity.

The Committee’s conclusions pitch the seriousness of the consequences somewhat higher.

This is because what actually happened to patient data is so far at odds with the reasonable

expectations of users of Pharmacy2U’s services, which were specifically marketed to them as

discreet and confidential. Patients would have expected, as in using any pharmacy, that their

personal data would only be held by the pharmacy for use in the provision of services to them

and would be kept securely. They would not have expected that their names and addresses

would be offered for sale. When they found out that they had been, they might have been

concerned that other confidential medical data might have been sold with them. They would

not expect the sales to have been achieved by means of the data card which Dr Harrison

approved and which listed medical conditions to which they and fellow patients might be

particularly prone.

Through Alchemy, Pharmacy2U were trading on the fact that they could offer lists of names

of people who were more likely than the general population to be suffering from health

problems. There are clearly more or less benign reasons why a commercial company might

want to market specifically to such an audience, but it would not be a reasonable expectation

of Pharmacy2U’s patients that by taking their prescription to that organisation they were

signing up for inclusion in such an exercise.

We note that what actually happened included the marketing of the Australian lottery to

a segmented list of men aged 70 or over. The Committee feels that, overall, this was

a serious reversal of normal customer expectations and we approach our analysis of the

individual registrants’ cases in that light.

We note that the General Pharmaceutical Council’s policy does not put any bar on the onward

sale of data so long as informed consent is properly obtained. Our decisions will bear that

firmly in mind, but we make two points. First, that the general public might well expect there

to be such a bar. Second, that if in this case patients and other customers had been properly

informed about what might be done with their data, we think it highly unlikely that very

many of them would have consented to it.

We turn first to Dr Harrison. We note that he accepts that it was his decision to do the deal

with Alchemy, that he approved their marketing approach and he signed off the three sales.

He has accepted that he failed to ensure proper informed consent. In the context we have set

out, we have no hesitation in saying that this was misconduct sufficiently serious to engage

Dr Harrison’s fitness to practise. As Mr Hepworth argued, the failure breached the Standards

of conduct, ethics and performance by putting organisational interests above the best interests

of patients and the public and above the interests of patient confidentiality.

In his role as Pharmacy2U’s Commercial Director, Dr Harrison’s actions were not

sufficiently informed by his professional obligations as a pharmacist. In our view, fellow

professionals would regard Dr Harrison’s failings as deplorable. Members of the public who

were aware of all the circumstances would find it morally blameworthy, and so does this

Committee.

So, there was serious misconduct in Dr Harrison’s case. Does that mean that his fitness to

practise is currently impaired? We find that it is, and base that decision on the public interest

and the need to uphold proper standards in the profession and to maintain public confidence.

We would not put weight on Mr Hepworth’s suggestion that Dr Harrison lacks integrity. We

accept that Dr Harrison has played a full part in putting right what went wrong and that he

has genuine remorse about his failings. We have some concerns about the completeness of

his insight given his emphasis of the issue of technical breaches of the Data Protection Act

rather than anything more concerning in terms of his responsibilities as a pharmacist, but

putting the personal element to one side, the public interest alone is sufficient in his case to

require a finding that his fitness to practise is currently impaired. He brought the profession

into disrepute by selling the data without informed consent and he breached fundamental

principles of the profession, in particular by putting commercial concerns above his

professional judgement and the best interests of individual patients. This is a case where

public confidence in the profession would be damaged if a finding of impairment was not

made.

Mr Lee’s case is somewhat different. We have heard that he knew nothing about the data

sales until after they had happened. It may well have been that his instincts as a pharmacist

and his responsibilities as a Superintendent Pharmacist would have led him to intervene had

he known earlier. The only allegation against him is that he failed to ensure that sufficient

procedures were in place to ensure that patients provided informed consent for the use of

their personal data by Pharmacy2U.

It could be argued, from the evidence and submissions we have heard, that sufficient

procedures were in place for the use Mr Lee expected Pharmacy2U to make of patients’

personal data. He told us that the former privacy policy was sufficient, until the point

at which Dr Harrison decided to sell data to third parties.

Mr Lee has accepted that he was at fault, but does his failure cross the threshold of serious

misconduct? In the Committee’s view it does. The difficulty in arguing that the former

policy had been sufficient until being exposed by Dr Harrison’s unexpected actions is that the

policy did make explicit provision for the possibility of data being shared with third parties.

This was not wholly a bolt from the blue. We bear in mind also that this was a pioneering

internet-based pharmacy operation. It should have been obvious to its founders that one of

the primary concerns of potential customers considering internet provision in a new area

would have been the security of their personal data. Potential exposure to spam

communications and the fear of more serious breaches of confidentiality are a real issue for

any internet customers.

We find that Mr Lee’s acceptance of the reassurances he received about the adequacy of the

privacy policy without any real investigation was, in the particular circumstances of

Pharmacy2U, a serious failure to meet his responsibilities as a Superintendent Pharmacist. In

that role, he is ultimately responsible for ensuring that systems were in place to secure

properly informed consent for whatever Pharmacy2U did with patients’ data.

The fact that there was no policy or procedural bar within the organisation on Dr Harrison

doing what he did without the implications being properly considered is a further indication

of an inadequacy of the system for which the Superintendent Pharmacist must take

responsibility. We have heard from Mr Lee that the systems he has now put in place would

have brought Dr Harrison’s plans to his attention had they been there before.

In all the circumstances, we are satisfied that fellow professionals would find the failure

deplorable and members of the public would consider it morally blameworthy. We share

those views and so we find that the allegations proved against Mr Lee constitute misconduct.

Our finding on impairment of fitness to practise is, however, different in his case. Mr Lee’s

personal failings were acts of omission rather than commission. He never subordinated his

patients’ best interests to other concerns. For that reason he brought the profession into

disrepute and damaged public confidence to a lesser extent than Dr Harrison. His breaches of

the standards were less severe, and he did not engage the particular requirements of standard

2.2 in the way that Dr Harrison did.

In our view, Mr Lee’s failure has been remediated to an extent to which the public interest

does not now require a finding of impairment. He has demonstrated fuller insight than

Dr Harrison into what went wrong. He has taken the lead role in transforming Pharmacy2U’s

policies and culture in relation to information governance. In evidence, he showed a fuller

appreciation of the requirements of patient confidentiality than did Dr Harrison. We find

therefore that Mr Lee’s fitness to practise is not now impaired.

To conclude this stage of the hearing, we repeat our findings that Dr Harrison’s fitness to

practise is currently impaired and that, while his failings do amount to misconduct, Mr Lee’s

fitness to practise is not now impaired.

We are conscious that we nevertheless have the power to give a warning to Mr Lee and we

invite submissions from the parties as to whether we should do so, at the same time as we

consider the question of sanction in relation to Dr Harrison.

I am very conscious that was a long determination. Would the parties like some time to think about that before moving into the next stage of proceedings?

DETERMINATION ON SANCTION THE CHAIRMAN: We are dealing with one registrant, Mr Lee, who failed

as Superintendent Pharmacist to ensure sufficient procedures were in place to ensure patients

provided informed consent to the use of their personal data. The second registrant, Dr

Harrison, authorised the sale of patients’ personal data to third parties without obtaining

proper informed consent. We found that the actions of both registrants constituted

misconduct, but that Dr Harrison’s fitness to practise is currently impaired and that Mr Lee’s

is not. However, there are sanctions still available to us in respect of Mr Lee despite that

finding.

We have heard submissions from Mr Hepworth and Miss Taylor and have had advice from

our Legal Adviser. They have helpfully set out relevant caselaw and drawn our attention to

the Council’s Good decision making: fitness to practise hearings and sanctions guidance of

July 2015, all of which we have borne carefully in mind in considering sanctions.

Mr Hepworth argued that it would be appropriate to give a warning to Mr Lee to mark the

seriousness of his conduct; robust action was needed to mark the misconduct which the

Committee has found.

For Dr Harrison, Mr Hepworth repeated that the Committee should take no account of

an earlier finding against him in 2007 for unrelated matters, and the Committee has followed

that advice. We have proceeded on the basis that the current findings against Dr Harrison are

an isolated issue in a long and otherwise unblemished career.

Mr Hepworth argued that a warning was not enough to meet the public interest here. He said

that the Committee had differentiated clearly between the two registrants in its findings on

impairment and the sanctions should also differentiate between them. Mr Hepworth said that

there were no appropriate conditions of practice which could be imposed in these

circumstances and, in any event, Dr Harrison’s behaviour was too serious a matter for

conditions.

Mr Hepworth said removal from the Register would clearly be disproportionate, and that left

suspension as the appropriate sanction. He recommended a period of six months, with no

requirement for a review since there was no risk of repetition and no expectation of any

further action on the part of the registrant.

Miss Taylor said the Committee should not feel compelled to take any further action with Mr

Lee since the Committee’s public finding of misconduct was significant in itself. If some

further response was needed, the Committee should consider advice.

Miss Taylor argued that suspension would go too far in the case of Dr Harrison and

a warning would suffice here. She noted Dr Harrison’s contrition, remorse, apologies and

corrective action. He had given a firm commitment never to supply patient information to a

third party again. Mitigating factors included the absence of a prior regulatory history, that

his failings were limited to a relatively brief and now historical window, that he had made no

personal financial gain and the benefits to the company had been meagre. She described Dr

Harrison’s behaviour after the relevant issues came to light as “beyond criticism”.

Miss Taylor referred us to the excellent testimonials in the bundle in respect of both

registrants, which attest to their good standing in the profession and the respect in which they

are held by colleagues and business contacts.

The Committee wants to make clear that it has no doubt about either registrant’s professional

standing. We fully accept the mitigating factors which have been cited. We are also not

seeking to encourage any further changes of behaviour on the part of the registrants; we

accept that they both understand what they have done wrong and they have done their best to

remedy their failings. We accept that there is no real risk of repetition in these cases.

The issue, as we set out in our earlier determination, is that the public interest required that

we found there had been serious misconduct on the part of both registrants and, in the case of

Dr Harrison, that this had been so significant that a finding of current impairment was

necessary to ensure that professional standards were upheld and public confidence

maintained in both the profession and its regulatory process. The same issues are at the

forefront of our minds as we consider sanction.

We should state, as is customary at this point, that the prime purpose of any sanction is not to

punish a registrant, although a sanction may be punitive in its effect. The purpose is to

protect and further the public interest, that is the public interest in protecting the safety of the

public, maintaining the reputation of the profession and in maintaining proper standards of

conduct and behaviour by members of the profession.

Patient confidentiality is fundamental to the healthcare professions and has to be protected.

The public interest is paramount in that we are entitled to give greater weight to it and the

need to maintain confidence than to the consequences to the registrant of the imposition of a

sanction. That said, we do need to take account of the registrant’s interests. Sanctions must

be fair, reasonable and proportionate, which means that the sanction imposes no greater

restriction on a registrant’s right to practise than is absolutely necessary.

In the case of Mr Lee, we have decided that it is appropriate to issue a warning, despite the

fact that we concluded that his fitness to practise is not currently impaired. The overall

regulatory response to his failings would, as Mr Hepworth said, be inadequate if there were

not a public indication that he got things wrong. The giving of advice is a less public

sanction, as it is not recorded in the Register, and there is not obviously anything which,

looking forward, we need to advise Mr Lee to do. The Good decision making guidance

makes clear that a warning is apt when “there needs to be a public acknowledgement that the

conduct was unacceptable”; that is our view in Mr Lee’s case and so we have decided to give

a warning to him.

With Dr Harrison, we do not think that a warning would give a sufficiently strong declaration

to the public and the profession. We also agree with Mr Hepworth that sanctions should

clearly differentiate between the two registrants since we clearly found a difference in the

seriousness of their behaviour and their personal culpability.

No one has suggested that conditions of practice would be an appropriate sanction in

Dr Harrison’s case and the Committee was unable to see how apt conditions might be framed.

We also accepted Mr Hepworth’s contention that removal from the Register would be

disproportionate, and so we are left considering a period of suspension. This case is squarely

within the terms of the Good decision making guidance section on suspension. This is, in the

language of that guidance, the sanction which is:

“... required when necessary to highlight to the profession and the public that the

conduct of the registrant is unacceptable and unbefitting a member of the pharmacy

profession. Also when public confidence ... demands no lesser sanction.”

We thought carefully about the length of the period of suspension and have concluded that it

should be for three months. We think that this is a substantial enough period to convey a firm

message to the public and profession, but it is a period which is proportionate and which

reflects the weight we have given to the testimonials and the other mitigating factors in this

case. We believe it fits the weight of the particular allegations that were proved against Dr

Harrison.

We see no need for a review on the expiry of the period of suspension and Dr Harrison will

be free to return to practise at that point.

That is our determination. Are there any issues arising from that?

DETERMINATION ON INTERIM MEASURES

THE CHAIRMAN: We have considered the question of interim measures. There is no

question of such measures being necessary for the protection of the public and interim

measures would clearly not be in the interests of Dr Harrison. The question then is whether

they would be in the public interest. We made clear in our determination on sanction that we

believe that three months is the right period to send the appropriate message to the profession

and to uphold public confidence in the profession. In our view, three months will be the right

period at whatever point it begins, after 28 days or after any appeal. For that reason we will

not be imposing interim measures.

Are there any further issues arising? MISS TAYLOR: None at all, thank you, sir. MR HEPWORTH: Sir, no, thank you. THE CHAIRMAN: It only remains for me to thank everybody for their help in these proceedings, our shorthand writer, our Secretary and all participants. Thank you very much.

(The hearing concluded at 4.35 pm)