Q. I have received an email from a woman requesting that I forward the medical records of herself, her husband and her children to another GP in her new location. How should I proceed?

A. The fundamental rule is that an individual can only make an Access Request for their own personal data. Legal guardians can make an access request on behalf of a child or person incapable of making a request themselves. However, once a child is capable of understanding their rights to privacy and data protection, the child should normally decide for themselves whether to request access to data and make the request in their own name (this is not age dependent). It would also be important in such a case that the GP be satisfied that the person was genuinely acting on behalf of, and in the best interests of, the child whose data was being requested.

Revealing of medical information to a spouse, former spouse, or child who is capable of making decisions themselves will in most situations constitute a breach of the Data Protection Acts if undertaken without the consent of the other spouse, former spouse, or child capable of making their own decisions.