The House of Lords completed hearing arguments on Wednesday 2 April in a case which will result in a landmark decision likely to have wide ranging implications for all public authorities and businesses and other organisations who hold and process information about living individuals, which is personal data. In practice, this is likely to mean any organisation which is a “data controller” in terms of the data protection legislation – from large commercial businesses through to charities and not for profit organisations. Organisations who issue statistics on health related issues may be especially affected. But individuals whose information may be held and disclosed by any of these authorities, businesses or organisations are also affected.
The ruling will determine whether the Scottish Information Commissioner was entitled to order the Common Services Agency to disclose information about the incidents of childhood leukaemia in Dumfries and Galloway. In doing so, their lordships will give crucial guidance on the interaction between the public’s “right to know” under freedom of information legislation and the legitimate privacy expectations of affected individuals under data protection legislation.
The decision will be essential reading for anyone who has responsibility for freedom of information and/or data protection compliance within their organisation.
Common Services Agency v The Scottish Information Commissioner represented the first opportunity for the House of Lords to consider both the Freedom of Information (Scotland) Act 2002 and the Data Protection Act 1998. Although the 2002 Act is an Act of the Scottish Parliament, the decision is likely to be highly significant in a UK context since the relevant provisions of the 2002 Act under consideration by the Lords are almost identical to the corresponding provisions of the UK Freedom of Information Act 2000. Indeed, the case has been seen as being of such widespread importance that both the UK Ministry of Justice and the UK Information Commissioner’s Office were granted leave to intervene in the proceedings.
The Issues
Amongst the matters under consideration, the Lords have been asked to rule on the following:
The definition of “personal data” – The scope of the 1998 Act is framed by the definition of “personal data” because “personal data” is the information about individuals which is protected under the 1998 Act. A narrow interpretation would cut down the scope of the 1998 Act and the privacy protection it affords. The Lords have been asked to consider whether the definition of “personal data” in s. 1(1) of the 1998 Act is consistent with the requirements of the 1995 European Data Protection Directive it was intended to implement, particularly in light of the English Court of Appeal’s 2003 decision in Durant v The Financial Services Authority, which has been interpreted in some quarters as being inconsistent with the Directive. Particular concern has been expressed about the Durant decision by the European Commission which has maintained a continuing dialogue with the UK Government regarding whether the Directive has been properly implemented in the UK. The UK Government is concerned that, if the Lords interpret the definition of personal data narrowly, this may reinforce the Commission’s criticisms.
Sensitive personal data –Sensitive personal data includes information as to the health of individuals and, therefore, would include information as to the diagnoses of diseases such as leukaemia in individuals. The Lords will have to consider the extent to which anonymised health data in statistical form may constitute personal data which is also “sensitive” personal data with the result that the special restrictions on the collection and disclosure of such sensitive personal data would apply. Potentially, this could impact on the ability of various organisations to collect, use and disclose health data for certain statistical purposes.
Balancing the competing interests – The House of Lords has also been asked to give guidance to public authorities who are considering whether they ought to disclose information in response to a freedom of information request which would result in the disclosure of personal data – in particular, how they should approach the question of whether the disclosure would be fair and lawful and, therefore, justifiable. The House of Lords is expected to give guidance on factors that public authorities should consider when identifying, assessing and balancing any legitimate interest of the public in disclosure as against the rights of the individuals affected against unwarranted privacy intrusion.
Extent of duty to provide information held under freedom of information – There are two issues here on which the House of Lords is expected to rule. Firstly, whether authorities can legitimately refuse to provide information under the 2002 Act on the basis that they have been asked to present it in a particular way which is different to the way it was held at the time of the receipt of the freedom of information request. Secondly, and more generally, whether the general entitlement of the public to information under the 2002 Act creates an obligation on an authority to provide that information in a way that does not engage an exemption even where that exemption might otherwise be available. The answers to these questions are likely to be highly significant for public bodies in determining how far they are expected to go in assisting applicants to obtain the information they seek under the 2002 Act.
Comments from the Judges
Outlaw reports that Lord Hoffman, one of the five Law Lords who heard the case, commented that in the CSA case, the key factor appeared to be whether an individual could be identified from the barnardised data and other information in the possession of the CSA. If that individual could be identified then the barnardised data had to be health personal data. It then followed that any data that revealed the status of an individual’s health must ‘relate to’ that individual in a biographical way. Lord Hoffman thus suggested that it was therefore not relevant to consider whether the barnardised data “related to” an individual, the key element explored by the Durant judgment.
In arguments, their lordships asked whether, in order to assess this balance of interests, it was justifiable to inquire why the FOI requestor would want the personal data. The response from the barrister for the UK Information Commissioner was that, in many cases, a public authority would be able to identify the requestor’s purpose without asking, but conceded that in some cases, this step might be necessary.
The Facts
The facts of the case can be briefly summarised as follows:
In 2005, a researcher for a (then) MSP for the Green Party, Michael Collie, made a request of the CSA under the 2002 Act seeking details of all recorded incidents of leukaemia in children in the age range 0 -14 from 1990 to 2003 for the Dumfries and Galloway postal area, broken down by census ward. It is thought that the researcher was looking for evidence of leukaemia clusters around MoD facilities at Dundrennan.
The CSA is a special health board in Scotland which collects statistical information from other health boards. The CSA refused to provide the information sought on the basis that the disclosure of the information requested would carry a significant risk that the children concerned would be identifiable since the numbers of children involved (when broken down by ward area) were so low that anyone receiving the information might be able to work out that a particular child who they knew to be ill has leukaemia.
The case was remitted to the Scottish Information Commissioner who found that the CSA had not complied with its obligations under the 2002 Act. Whilst accepting that the information requested in its raw form could not be released without infringing the privacy rights of the children concerned, the Commissioner considered that the information could have been safeguarded by a statistical process for randomising small numbers known as “barnardisation” which would mask the raw information in order to prevent identification of the individual children concerned.
The CSA appealed the Commissioner’s decision to the Inner House of the Court of Session in Edinburgh which upheld the Commissioner’s decision. The hearing before the House of Lords was as a result of the CSA’s appeal against the Inner House’s decision. Their lordships reserved their decision and it is expected it will be delivered in the next few months.
SCL is grateful to Brodies LLP, who have acted for the Scottish Information Commissioner throughout and who supplied the release on which this item is based.
