| DATA PROTECTION — Personal data — Access request — Request to health board for information on incidences of childhood leukaemia — Health board refusing on ground of risk of identification of living individuals— Commissioner ordering release of information in perturbed form — Whether Commissioner entitled to make order — Freedom of Information (Scotland) Act 2002 (asp 13), ss 1, 2, 38— Data Protection Act 1998 (c 29), ss 1(1), 2, 4
Common Services Agency v Scottish Information Commissioner [2008] UKHL 47; [2008] WLR (D) 231
HL(Sc): Lord Hoffmann, Lord Hope of Craighead, Lord Rodger of Earlsferry, Baroness Hale of Richmond and Lord Mance: 9 July 2008
Information which in its basic form would constitute "personal data" for the purposes of s 1(1) of the Data Protection Act 1998 could be released under the Freedom of Information (Scotland) Act 2002 provided it had been modified in such a way that it was rendered anonymous, so that no individual from whom it was derived was identifiable, as it would then no longer be "personal data" within the meaning of s 1(1).
The House of Lords so held in allowing an appeal by the Common Services Agency from a decision of the First Division of the Inner House of the Court of Session (the Lord President (Hamilton), Lord Nimmo Smith and Lord Marnoch) 2007 SC 231 upholding a decision of the Scottish Information Commissioner, pursuant to s 47 of the Freedom of Information (Scotland) Act 2002, that the agency had not dealt with an application for information in accordance with the Act, in that the data requested could have been provided to the applicant in a perturbed or "barnardised" form.
LORD HOPE said that the agency collected and disseminated epidemiological information. A researcher asked it to supply him with details of all incidents of childhood leukaemia for both sexes by year from 1990 to 2003 for all the Dumfries and Galloway postal area by census ward. The agency refused the request on the ground that there was a significant risk of the indirect identification of living individuals due to the low numbers resulting from the combination of the rare diagnosis, the specified age group and the small geographic area. As a result it was personal data within the meaning of s 1(1) of the 1998 Act and was exempt information for the purposes of the 2002 Act. The researcher appealed to the commissioner who decided that the data could be disclosed after it had undergone a process known as "barnardisation". That involved a modification rule which added 0, +1, or -1 to all values where the true value lay in the range from 2 to 4 and adding 0 or +1 to cells where the value was 1. 0s were always kept at 0. It did not guarantee against disclosure but aimed to disguise those cells that had been identified as unsafe. Rendering information anonymous so that the individuals from whom it was derived were no longer identifiable would enable the information to be released without having to apply the principles of data protection. Read in the light of recital 26 of Council Directive 95/46/EC, the definition in s 1(1) of the 1998 Act had to be taken to permit the release of information which met that test without having to subject the process to the rigour of the data protection principles. If barnardisation could achieve that, the way would be then open for the information to be released in that form because it would no longer be personal data. Whether it could do that was a question of fact for the commissioner. However his decision contained no finding on that point. The proper course would be for the application to be remitted to him so that he could examine the facts and make a determination.
LORD HOFFMANN agreed. LORD RODGER, BARONESS HALE and LORD MANCE delivered opinions concurring in the result. |
Appearances: Valerie Stacey QC and Ruth Crawford (Reynolds Porter Chamberlain LLP for Ronald F Mcdonald, Edinburgh) for the Common Services Agency; Lord Davidson of Glen Clova QC, Jason Coppel (of the English bar) and John McGregor (Treasury Solicitor for Office of the Solicitor to the Advocate General) for the Secretary of State for Justice, intervening; Paul Cullen QC and Morag Ross (Brodies LLP, Edinburgh) for the Scottish Information Commissioner; Timothy Pitt Payne (of the English bar) (Information Commissioner's Office, Wilmslow) for the Information Commissioner, intervening.
|
