South Lanarkshire Council v The Scottish Information Commissioner

Under condition 6 of Schedule 2 to the Data Protection Act 1998, lawful processing requires a legitimate interest, processing necessary for that interest, and an absence of unwarranted prejudice to the data subject’s rights, freedoms or legitimate interests. “Necessary” means reasonably necessary and incorporates proportionality. Processing is unnecessary if the legitimate aim can be achieved by less restrictive means.

Where processing interferes with private life, the requirements of article 8(2) must also be met. A public authority participating in a freedom of information investigation must receive notice of new material elicited by the Commissioner which is adverse to its interests. Fairness does not require disclosure of every communication where it adds nothing material already unknown to the authority.

A requester asked South Lanarkshire Council under the Freedom of Information (Scotland) Act 2002 for the numbers of employees in a particular post placed at ten points on its pay scales. He sought to investigate whether the Council’s grading arrangements favoured work traditionally performed by men. He did not request employees’ names.

The Council refused disclosure because it considered the information personal data whose disclosure would contravene the Data Protection Act 1998. The Scottish Information Commissioner decided that condition 6 of Schedule 2 was satisfied and ordered disclosure. The Inner House dismissed the Council’s appeal: [2012] CSIH 30.

The Council appealed on two issues: the meaning of “necessary” in condition 6, and whether natural justice required the Commissioner to disclose correspondence received from the requester and two Members of the Scottish Parliament during his investigation.

1. The appeal was dismissed unanimously. Condition 6 of Schedule 2 to the Data Protection Act 1998 poses three questions: whether the controller or recipient pursues a legitimate interest; whether the processing is necessary for that interest; and whether the processing is unwarranted because of prejudice to the data subject’s rights, freedoms or legitimate interests. The Commissioner was entitled to find all three requirements satisfied. Lady Hale delivered the judgment, with which Lord Kerr, Lord Wilson, Lord Reed and Lord Carnwath agreed (paras 18, 28, 34).

2. “Necessary” means reasonably necessary, rather than absolutely or strictly necessary. Necessity forms part of the proportionality inquiry. A measure interfering with a right protected by EU law must be the least restrictive means of achieving the legitimate aim. Processing is therefore unnecessary where that aim can be achieved by something less intrusive (para 27).

3. The meaning of necessity must be considered in relation to the particular processing. Where processing interferes with the data subject’s private life, the requirements of article 8(2) of the European Convention on Human Rights must be fulfilled. Under article 7(f) of Council Directive 95/46/EC and condition 6, however, the balance between processing and the data subject’s interests is built into the provision. It may therefore be immaterial at which stage article 8(2) is considered, provided the overall result complies with it (para 25).

   The requested aggregate information would not enable anyone to identify the employees. It was therefore difficult to see any interference with their private lives, and condition 6 could be applied in its own terms (para 26).

4. The Freedom of Information (Scotland) Act 2002 creates a right to information only where disclosure complies with the data-protection regime. It contains no presumption favouring disclosure of personal data, and freedom of information does not trump the safeguards in the Data Protection Act 1998 (paras 5–6).

5. The Commissioner owed an enhanced duty of fairness because he adjudicated competing claims and was the sole finder of fact, subject only to an appeal on a point of law. He could formulate an applicant’s case and conduct his own inquiries, but had to notify the authority of new material elicited by those inquiries which was adverse to its interests (paras 29–31).

   Fairness did not require every communication with the applicant or third parties to be copied. The Council already knew the material facts and arguments, while the MSPs’ letters added nothing. There was consequently no breach of natural justice (paras 32–33).

1. United Kingdom Supreme Court: The Council’s appeal was dismissed unanimously: [2013] UKSC 55.
2. Inner House of the Court of Session: The Council’s appeal from the Commissioner was dismissed. The court held that necessity was established even on the Council’s stricter interpretation and that no breach of natural justice had occurred: [2012] CSIH 30.
3. Scottish Information Commissioner: In Decision 056/2011, the Commissioner held that condition 6 of Schedule 2 to the Data Protection Act 1998 was satisfied and required the Council to disclose the requested information.