Department of Health, R (on the application of) v Information Commissioner

Statistical information is not necessarily personal data merely because the data controller holds information capable of identifying the individuals from whom the statistics were derived. Where published statistics are sufficiently anonymised so that members of the public cannot identify the individuals concerned, disclosure does not involve processing personal data.

In assessing anonymisation, the tribunal must evaluate statistical evidence together with ordinary matters such as the availability of other public information and the likelihood of motivated attempts at identification. A specialist tribunal’s factual assessment will stand unless legally flawed. The risk of identification and the seriousness of its consequences must be balanced against the legitimate interests served by disclosure.

The Department of Health appealed under section 59 of the Freedom of Information Act 2000 against the Information Tribunal’s decision requiring disclosure of detailed statistics concerning late-term abortions. The Department argued that disclosure was exempt because the statistics were personal data and because disclosure would breach the Abortion Regulations 1991.

The Tribunal held that the statistics were personal data in the Department’s hands, but that disclosure would not breach the data protection principles or the Abortion Regulations. The Department appealed the findings concerning personal data and data protection. The Information Commissioner cross-contended that the statistics were not personal data. The central issues were the effect of anonymisation, the tribunal’s assessment of identification risk, and the application of the data protection principles.

1. Outcome. The appeal was dismissed. The Tribunal’s decision requiring disclosure of the statistics was upheld.

2. The Tribunal had erred in holding that the statistics were personal data merely because the Department held HSA4 forms from which the statistics had been compiled. The proper question was whether the disclosed statistics enabled members of the public to identify living individuals. Information sufficiently anonymised so that the public could not identify the individuals concerned was not personal data in the context of the disclosure.

3. The court treated the reasoning and order in Common Services Agency v Scottish Information Commissioner as determinative. Although the speeches differed on the construction of limb A and limb B of the definition of personal data, the order remitting the matter recognised that data could be anonymised despite the data controller holding information capable of identifying the underlying individuals. The approach of Baroness Hale, and the alternative approach of Lord Rodger, could not be adopted by the High Court.

4. The Tribunal was entitled to conclude that the possibility of identification from the statistics was extremely remote. Assessment of that issue involved statistical expertise, but also ordinary factual matters, including the availability of information in the public domain and the likelihood that journalists or campaigners would seek identification. The Tribunal was not bound to accept the expert evidence or the ONS guidance, and its evaluation disclosed no error of law.

5. If the statistics had been personal data, disclosure would nevertheless have been justified under Schedule 2, paragraph 6, and Schedule 3, paragraph 7, of the Data Protection Act 1998. The Tribunal had identified legitimate interests in public scrutiny, accountability, checking compliance with abortion legislation, healthcare planning and informed public debate. It had proportionately balanced those interests against the serious consequences of identification, having found that the risk was extremely remote.

6. The Tribunal also made no error in concluding that Article 8 of the ECHR was not engaged, given the remote risk of identification. Alternatively, any interference would have been prescribed by law and proportionate.

There was no order as to costs. A stay was granted pending any further appeal.

• High Court (Administrative Court): dismissed the Department of Health’s appeal and upheld the Information Tribunal’s decision requiring disclosure.