The common law duty of confidentiality

Long before data protection law existed, the courts recognised a simple idea: when someone gives you information in confidence, you must not pass it on without good reason. This is the common law duty of confidentiality, and it applies automatically to information shared within a care relationship.

The duty is not written in a single act of Parliament. It comes from case law built up over many years, and it sits on top of UK GDPR and the Data Protection Act 2018, not underneath them. In practice that means a use of information can be fine under data protection law and still breach confidentiality, so you have to satisfy both.

When can confidential information be shared

The duty is not absolute. Confidential care information can be shared when at least one of these applies:

• The person has consented, either explicitly or through the implied consent that comes with accepting care from a team.
• The law requires or permits it, for example a court order or a statutory duty to report.
• There is an overriding public interest, such as preventing serious harm to the person or to someone else.

Implied consent for direct care

When someone accepts care, it is reasonable to rely on their implied consent for the care team to share what it needs to look after them. A person we support does not have to sign a form before a support worker can tell the nurse about a new pressure sore. That said, implied consent only stretches as far as direct care. It does not cover sharing with family, researchers, insurers, or anyone outside the team without a separate justification.

The duty survives everything

Confidentiality does not end when a shift ends, when someone leaves your service, when they die, or when you change jobs. What you learned about people in your care stays confidential permanently. Telling a story about a former resident at a dinner party is a breach, even years later and even if you think no one could identify them.