Ali & Anor R (on the application of) v Minister for the Cabinet Office the Statistics Board

The compatibility of a statutory disclosure power with Article 8 must be assessed by examining the entire legal framework, including related legislation, policy, operational safeguards and judicial remedies. A regime may satisfy the requirement that interference be in accordance with the law even where safeguards are found in several instruments and are not expressed as detailed criteria in the authorising provision. Disclosure of compulsory census data must remain proportionate. The Data Protection Act 1998, the Human Rights Act 1998, the Statistics and Registration Service Act 2007 and the Board’s policy, including refusal of disclosure without a court order, provided sufficient safeguards.

The claimants sought judicial review and a declaration that section 39(4)(f) of the Statistics and Registration Service Act 2007 was incompatible with Article 8 of the European Convention on Human Rights. The provision permitted disclosure of personal and sensitive personal census information for criminal investigations or proceedings. The second claimant also alleged incompatibility with Directive 95/46 and relied on Directive 2005/85/EC.

The central issues were whether the statutory and administrative framework was sufficiently clear and foreseeable, whether it contained adequate safeguards against disproportionate disclosure, and whether the provision complied with the applicable data-protection requirements.

1. The claim was dismissed. Section 39(4)(f) was not incompatible with Article 8. The court was entitled, and required, to consider the combined effect of the Statistics and Registration Service Act 2007, the Data Protection Act 1998, section 6 of the Human Rights Act 1998, and the Board’s policies, practices and operational safeguards.
2. Compulsory completion of a census was a prima facie interference with Article 8, and disclosure of census information required very clear justification. Nevertheless, the DPA 1998 imposed relevant requirements concerning fair and lawful processing, sensitive personal data, fairness information, transfers outside the EEA, enforcement and compensation. Its conditions in Schedules 2 and 3 operated as guidelines structuring the Board’s discretion and incorporated a proportionality-type balancing exercise.
3. The absence of an express requirement to notify a data subject before every disclosure did not itself establish incompatibility. Where practicable, fairness would ordinarily require notice and an opportunity to make representations. Where notification might prejudice a criminal investigation or proceedings, the adequacy of safeguards had to be assessed by examining the decision-making process as a whole, including court control and judicial review.
4. The eighth data-protection principle prevented transfer outside the EEA unless the receiving country provided an adequate level of protection, subject to the statutory framework. The absence of an express reference to the seriousness of the suspected offence did not make the regime insufficiently foreseeable. A disclosure of census data for a minor offence would not automatically be lawful or proportionate.
5. The Board’s policy of refusing disclosure for non-statistical purposes unless compelled by a court order provided an important additional safeguard. A court considering disclosure remained required by section 6 of the HRA 1998 to avoid a disproportionate interference with the data subject’s Article 8 rights.
6. The challenge based on Directive 95/46 failed. Article 3(2) excluded processing operations concerning activities of the State in areas of criminal law. In any event, disclosure had to comply with the DPA 1998, and no specific incompatibility had been identified. The reliance on Directive 2005/85/EC was misconceived: Articles 22 and 41 did not apply to census information or to the Board.

First-instance judicial review proceedings. The judgment does not state any prior substantive appellate decision.