Three Conflicting Data Requests in One Week

Do not treat this as a binary grant-or-refuse question. The right of access belongs to the child and is exercised on the child's behalf by a holder of parental responsibility, but it is limited by the child's own rights and interests.

Reasoning steps:

• Assess capacity, not just age. A 15-year-old is commonly presumed competent to consent to their own health treatment in many EU regimes. If this patient is assessed as competent for the contraception and mental-health matters, their objection carries real weight.
• Separate the record into segments. The parent is very likely entitled to the general paediatric record: immunisations, allergies, growth, routine appointments. Confidential sexual-health and mental-health entries are a different question and may be withheld where disclosure would breach the child's confidentiality or harm their best interests.
• Consider partial disclosure with redaction rather than refusing the whole request; refusing everything invites a complaint and is likely to fail proportionality.
• Document the test applied, who was consulted (treating clinician, child-protection lead, and legal counsel if available), and the reasons. If the decision must be made before counsel returns, record that as a limitation and set a review date.
• Talk to the family. A clinician-mediated conversation often resolves the request without a formal refusal, which serves the child better than a legal letter.

The patient's objection does not override a valid legal obligation, but it does not make the subpoena self-executing either. The two must be tested separately.

• Validate the instrument. Is it a court order, a subpoena issued by a court, or an informal demand from a law firm? Does it name the correct legal entity, the correct patient identifiers, and a lawful scope? A subpoena with an over-broad scope should be narrowed or challenged, not simply fulfilled.
• Apply minimum necessary. Disclose only the records named, and redact unrelated material, particularly third-party information such as the other parent's or siblings' data.
• Check for a non-disclosure direction. If the order forbids informing the patient, comply; otherwise notify the patient promptly so they can seek to quash it. That is what gives their earlier objection practical effect.
• Escalate rather than improvise. With counsel on leave, contact the court registry or issuing firm to confirm scope and, where permitted, request an extension of the five-day deadline. A wrong disclosure cannot be undone.
• Watch for the child-protection overlay. If the national mandatory-disclosure law independently requires reporting, that obligation runs on its own track and should be recorded separately.
• Log the decision and the reasoning in the disclosure register, including who authorised it.

The clause permitting re-identification for validation defeats the entire legal basis. Data that the recipient may re-identify is not anonymised data, so the extract would be personal data leaving the hospital without a lawful route, controller obligations or a valid transfer mechanism.

Required changes:

• Remove the re-identification right. Replace it with validation inside a controlled secure processing environment operated by the hospital, or by an independent trusted third party, using synthetic or perturbed data where possible.
• Bind the recipient contractually as a processor or independent controller, with purpose limitation, a prohibition on linkage to any other dataset, no onward transfer, breach notification to the hospital, and deletion or return at end of term.
• Strengthen the de-identification method before release. A 120,000-record paediatric extract has rare combinations: dates of birth, postcodes, rare diagnoses and admission dates can single out a child. Apply generalisation, suppression of small cells, age banding and free-text removal, then test for re-identification risk rather than assuming it.
• Complete a DPIA and confirm ethics approval, and record the residual re-identification risk as accepted.
• Do not release until all of the above is signed, even if the five-day clock expires; the deadline is internal and does not authorise an unlawful disclosure.