House of Lords

Published July 14, 2008

Common Services Agency v Scottish Information Commissioner

Before Lord Hoffmann, Lord Hope of Craighead, Lord Rodger of Earlsferry, Baroness Hale of Richmond and Lord Mance

Speeches July 9, 2008

Information concerning the incidence of childhood leukaemia in a particular postal area should not be disclosed unless either it could be anonymised so that it was not personal data or could be released in a form which did not contravene one of the data protection principles under the Data Protection Act 1998.

The House of Lords so held in allowing an appeal by the Common Services Agency from a decision of the First Division of the Inner House of the Court of Session (Lord President Lord Hamilton, Lord Nimmo Smith and Lord Marnoch) (2007 SC 231) upholding a decision of the Scottish Information Commissioner, under section 47 of the Freedom of Information (Scotland) Act 2002, that the agency had not dealt with an application for information in accordance with that Act, in that the data requested could have been provided to the applicant in an anonymised form.

Ms Valerie Stacey, QC and Ms Ruth Crawford for the agency; Lord Davidson of Glen Clova, QC, Mr Jason Coppel, of the English Bar, and Mr John McGregor for the Secretary of State for Justice, intervening; Mr Paul Cullen, QC and Ms Morag Ross for the Scottish Information Commissioner; Mr Timothy Pitt Payne, of the English Bar, for the Information Commissioner, intervening.

LORD HOPE said that the Common Services Agency collected and disseminated epidemiological information.

A researcher acting on behalf of a Member of the Scottish Parliament, asked the agency to supply him with details of all incidents of childhood leukaemia for both sexes by year from 1990 to 2003 for all the Dumfries and Galloway postal area by census ward.

There was no doubt that there was a genuine public interest in the disclosure of that information. For many years concern had been expressed about risks to public health in the area arising from operations at the Ministry of Defence’s Dundrennan firing range, the now decommissioned nuclear reactor at Chapelcross and the nuclear processing facilities at Sellafield. But the agency refused the researcher’s request.

He was told that there was a significant risk of the indirect identification of living individuals due to the low numbers resulting from the combination of the rare diagnosis, the specified age group and the small geographic area.

As a result it was personal data within the meaning of section 1(1) of the 1998 Act and was exempt information for the purposes of the 2002 Act.

The researcher appealed to the Scottish Information Commissioner who decided that the data could be disclosed after it had been undergone a process known to stasticians as “Barnardisation”. That involved a modification rule which added 0, +1, or –1 to all values where the true value lay in the range from 2 to 4 and adding 0 or +1 to cells where the value was 1. 0s were always kept at 0. It did not guarantee against disclosure but aimed to disguise those cells that had been identified as unsafe.

Rendering data anonymous in such a way that the individuals to whom the information from which they were derived was no longer identifiable would enable the information to be released without having to apply the principles of protection.

Read in the light of recital 26 of Council Directive 95/46/EC (OJ November 23, 1995 No L281/31), the definition in section 1(1) of the 1998 Act had to be taken to permit the release of information which met that test without having to subject the process to the rigour of the data protection principles.

If Barnardisation could achieve that, the way would be then open for the information to be released in that form because it would no longer be personal data. Whether it could do that was a question of fact for the commissioner.

If the commissioner was unable to say that it would in that form be fully anonymised he would then need to consider whether disclosure of that information by the agency would be in accordance with the data protection principles laid down in Schedules 1, 2 and 3 to the 1998 Act.

The proper course would be for the researcher’s application to be remitted to the commissioner so that he could examine the facts and make determinations on those points.

Lord Hoffmann agreed. Lord Rodger, Lady Hale and Lord Mance delivered opinions concurring in the result.

Solicitors: Reynolds Porter Chamberlain LLP for Mr Ronald F. McDonald, Edinburgh; Treasury Solicitor for Solicitor to Advocate-General; Brodies LLP, Edinburgh; Mr Mark Thorogood, Wilmslow.

Times Recommends

• Hundreds sued for sharing games
• So you want to study law?
• How the courts are coping with the mortgage crisis