An MP had asked the Agency under the 2002 Act for details of all incidents of childhood leukaemia for both sexes by year from 1990 to 2003 for all the DG (Dumfries and Galloway) postal area by census ward. The Agency replied by saying that the release of the information would put at risk the privacy of the people involved because they might be indentifiable, and relied on the 1998 Act. The Commissioner had said that the information should be provided only if individuals could not be identified. Otherwise it would breach the 1998 Act and also be a breach of confidence. The Agency said that an obligation to provide only anonymised data would not be a provision of personal data.
Held: The appeal succeeded. The 1998 Act fulfilled an obligation imposed by European law, but the 2002 Act did not. The House asked whether the anonymised data was personal data, and held that: ‘Sensitive personal data’ is a subset, or a species, of ‘personal data’. Unless it was established that an exemption to control applied, it was necessary first to establish whether the changes to the data would be sufficient to make the data anonymous. What would have been an unlawful disclosure before the 2002 Act would remain unlawful afterwards. Data which was originally personal data could cease to be such if successfully anonymised.
Lord Rodger of Earlsferry pointed out that the safeguards against the disclosure of personal data which applied before the enactment of the FOISA continue to apply: ‘Where the legislature has thus worked out the way that the requirements of data protection and freedom of information are to be reconciled, the role of the court is just to apply the compromise to be found in the legislation . . There is, however, no reason why courts should favour the right to freedom of information over the rights of data subjects. ‘
Lord Hoffmann, Lord Hope of Craighead, Lord Rodger of Earlsferry, Baroness Hale of Richmond, Lord Mance
[2008] UKHL 47, Times 14-Jul-2008, (2008) 103 BMLR 170, 2008 SC (HL) 184, [2008] 4 All ER 851, [2008] 1 WLR 1550, 2008 SCLR 672, 2008 SLT 901, 2008 GWD 30-465
Bailii, HL
Data Protection Act 1998, Freedom of Information Act 2000, Freedom of Information (Scotland) Act 2002, Council Directive 95/46/EC of 25 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Data Protection (Processing of Sensitive Personal Data) Order 2000 (SI 2000/417), National Health Service (Functions of the Common Services Agency) (Scotland) Order 1974
Scotland
Citing:
Appeal from – Common Services Agency v Scottish Information Commissioner IHCS 1-Dec-2006
The Agency rejected a request to provide statistics on certain children, saying that the numbers were so small that individuals might be identified.
Held: Since the whole purpose of 2002 Act is the release of information, it should be . .
Cited – Durant v Financial Services Authority CA 8-Dec-2003
The appellant had been unsuccessful in litigation against his former bank. The Financial Services Authority had subsequently investigated his complaint against the bank. Using section 7 of the Data Protection Act 1998, he requested disclosure of his . .
Cited by:
Cited – Kennedy v Information Commissioner Admn 19-Jan-2010
The claimant journalist had made a freedom of information request to the Charity Commission as to its investigations of a charity under section 8 of the 1993 Act. The Commission claimed absolute exemption under section 32(2). He now appealed against . .
Cited – Kennedy v The Information Commissioner and Another CA 12-May-2011
The claimant, a journalist, sought further information from the Charity Commission after the release of three investigations into the ‘Mariam Appeal’ and questions about the source and use of its funds. The Commission replied that it was exempt . .
Cited – Department of Health, Regina (on The Application of) v Information Commissioner Admn 20-Apr-2011
The department appealed against an order requiring it to disclose statistical information about late abortions. The department argued that the numbers involved were such that the individual patients involved mighty be identified, and that therefore . .
Cited – South Lanarkshire Council v The Scottish Information Commissioner SC 29-Jul-2013
Commissioner’s Approach not in Breach
In May 2010, a Mr Irvine made requests under the 2002 Act for information from South Lanarkshire Council. He wanted to know how many of their employees in a particular post were placed at 10 particular points on the Council’s pay scales. His . .
Cited – The Independent Parliamentary Standards Authority v The Information Commissioner and Another CA 28-Apr-2015
A journalist had requested the appellant who published the claims made by Members of Parliament for expenses to its website had requested in addition copies of the receipts produced by the MPs to justify three claims. The Authority provided a . .
Lists of cited by and citing cases may be incomplete.
Information, European
Leading Case
Updated: 02 November 2021; Ref: scu.270655