Common Services Agency (Appellants) v Scottish Information Commissioner (Respondent) (Scotland)

A freedom of information regime does not create a presumption that personal data should be released. Its personal-data exemption must be applied consistently with the protection required by the Data Protection Act 1998.

An authority may reasonably alter information it holds, including by redaction or statistical masking, without thereby creating new information. If masking renders individuals no longer identifiable, the resulting information is not personal data and may fall outside the exemption. If individuals remain identifiable, disclosure is lawful only if it satisfies the first data-protection principle, including an applicable condition in Schedule 2 and, for health data, Schedule 3.

The Agency held epidemiological data concerning childhood leukaemia in the Dumfries and Galloway postal area. Mr Collie requested annual figures for individual census wards. The Agency refused the request because small cell counts could indirectly identify living children.

The Scottish Information Commissioner accepted that the unaltered figures were personal data, but required the Agency to provide barnardised figures: statistically modified figures intended to reduce identification risk. The First Division of the Court of Session refused the Agency’s appeal: [2006] CSIH 58; 2007 SC 231.

The central issues were whether barnardised information was information held by the Agency, whether it remained personal or sensitive personal data, and whether its disclosure complied with the data-protection principles.

1. Appeal allowed unanimously. Lord Hope delivered the leading speech, with which Lord Hoffmann agreed; Lord Rodger, Baroness Hale and Lord Mance also agreed that the Commissioner’s decision should be set aside and the application remitted.

2. Per Lord Hope, the Freedom of Information (Scotland) Act 2002 contains no presumption favouring release of personal data. Its exemption must preserve the protection afforded by the Data Protection Act 1998. The public interest in disclosure cannot displace the statutory conditions for processing personal data.

3. Lord Hope held that barnardisation could be a reasonable way of supplying information which the Agency already held. Like redaction, it disguises or conceals part of existing information; it does not necessarily create new information or require research. Lord Rodger similarly considered that an authority must consider whether it can provide requested information in another form, subject to the statutory time and cost limits.

4. The Commissioner had erred by ordering disclosure without determining whether the barnardised figures would still be personal data and, if so, whether disclosure complied with the data-protection principles. Fully anonymised data, from which the relevant individuals can no longer be identified, do not attract the personal-data exemption. Whether barnardisation achieved that result was a factual question for the Commissioner. The Lords differed on aspects of the route through section 1(1), but agreed that no choice between those views was necessary to decide the appeal.

5. Per Lord Hope, health information which remains personal data is sensitive personal data. Its disclosure requires fairness and lawfulness, at least one Schedule 2 condition and at least one Schedule 3 condition. The Commissioner had made no findings on the necessary factual issues, including whether disclosure was justified by legitimate interests or by the Agency’s statutory epidemiological functions.

6. The House recalled the Inner House interlocutor, set aside the Commissioner’s decision of 15 August 2005, and remitted Mr Collie’s application for reconsideration in light of the Lords’ opinions.

• House of Lords: Allowed the Agency’s appeal, recalled the Inner House interlocutor, set aside the Commissioner’s decision and remitted the application.

• First Division, Court of Session: Refused the Agency’s appeal from the Commissioner’s decision: [2006] CSIH 58; 2007 SC 231.

• Scottish Information Commissioner: Held that the unaltered ward-level figures should not be disclosed, but ordered provision of barnardised ward-level data under the Freedom of Information (Scotland) Act 2002.