skip to main content

Data Protection — DFSRH MCQ

Instant feedback + full explanation. One question, done properly.

EasyData ProtectionDFSRH

A 27-year-old woman reports rape by a former partner. The police send an English integrated sexual health service a senior-officer-authorised third-party material request for her complete sexual health record from the preceding 5 years. The request states that previous sexual activity, sexually transmitted infection testing and contraceptive use may assist assessment of her credibility. The patient has been notified and objects to disclosure. There is no court order. The record contains routine contraception consultations, negative screening tests and one treated chlamydia infection. It contains no reference to the alleged offence or to the former partner. The police identify no specific disputed fact to which these records relate and do not explain why less intrusive evidence would be inadequate. Which is the most appropriate response by the service?

Educational content. Not a substitute for clinical judgement or local policy.

Reveal the answer and explanation

Correct answer: D — Decline disclosure, document the reasons, and invite a targeted request establishing relevance, necessity and proportionality; comply with any subsequent valid court order.

Explanation lettering: C = shown as A · E = shown as B · D = shown as C · A = shown as D · B = shown as E

The request should be declined in its present form. Although rape is a serious crime and the form has senior police authorisation, neither feature automatically compels disclosure. The service remains responsible for identifying and documenting a lawful basis and for deciding whether disclosure of confidential information is relevant, necessary and proportionate. Here, the request seeks five years of highly sensitive sexual health information, identifies no disputed fact to which it is relevant, and is based on a speculative assessment of credibility. Nothing in the record relates to the alleged offence or suspect. The appropriate response is therefore to withhold the information and invite a properly focused justification; a valid court order would ordinarily require compliance, subject to clarification if its scope were ambiguous or excessive. B mistakes permission to request information for a duty to disclose it. C applies data minimisation only after assuming that STI information is relevant; no such link has been established. D is incorrect because consent does not make an unnecessary or disproportionate request appropriate, particularly given the recognised power imbalance in victim-information requests. E is incorrect because attendance and testing metadata can reveal that the patient received sexual healthcare and remains confidential personal information requiring its own lawful justification.

Reference: Sharing information with the police guidance for health and care professionals (Last edited 7 May 2026) — https://digital.nhs.uk/data-and-information/information-governance/guidance/sharing-information-with-the-police/guidance-for-health-and-care-professionals Victim information requests: code of practice (12 January 2026) — https://www.gov.uk/government/publications/victim-information-requests-code-of-practice--2/victim-information-requests-code-of-practice-accessible