The Christian Institute and others v The Lord Advocate

A devolved provision relates to a reserved matter only where its purpose, assessed with regard to its effect, has more than a loose or consequential connection with that matter. Information-sharing provisions directed to promoting children’s wellbeing did not become reserved data-protection legislation merely because they required or authorised processing of personal data.

State sharing of personal information engages article 8. The governing rules must be accessible and foreseeable, constrain official discretion and contain safeguards enabling the proportionality of interference to be examined. Legislation whose apparent disclosure duties are substantially altered by overlapping data-protection rules, and which lacks adequate safeguards concerning consent and notification, is not in accordance with law. Such incompatibility places devolved legislation outside legislative competence, even where the scheme could be operated proportionately in individual cases.

Part 4 of the Children and Young People (Scotland) Act 2014 established a named-person service for children and young people. Its central features included duties and powers for public bodies to share information relevant to wellbeing.

Four charities and three parents challenged Part 4. They argued that its information-sharing provisions concerned the reserved subject of data protection and infringed the article 8 rights of parents, children and young people. An intervener also challenged the threshold for disclosure of confidential information. Following the Inner House’s decision at [2015] CSIH 64, the appellants appealed to the Supreme Court.

The principal questions were whether Part 4 related to reserved matters, whether its operation was in accordance with law and proportionate under article 8, and whether it was incompatible with EU law.

1. Appeal allowed unanimously. Lady Hale, Lord Reed and Lord Hodge delivered a joint judgment with which Lord Wilson and Lord Hughes agreed.

2. Part 4 of the Children and Young People (Scotland) Act 2014 did not relate to the reserved subject matter of the Data Protection Act 1998 or Council Directive 95/46/EC. The purpose-and-effect inquiry under section 29 of the Scotland Act 1998 requires more than a loose or consequential connection with a reserved matter. Part 4’s specific objective was collaborative early intervention, coordinated through a named person, for the ultimate purpose of promoting children’s wellbeing. Information sharing was consequential upon that devolved purpose. The 1998 Act itself also contemplated Scottish legislation requiring disclosure, while sections 23(7) and 26(11) preserved the overriding data-protection regime.

3. The named-person scheme engaged article 8 because the sharing of personal and confidential information interfered with private and family life. Advice, support and assistance in obtaining services would not normally interfere with those rights. The broad contention that appointment of a named person required parental consent or a risk of significant harm was therefore rejected.

4. The information-sharing provisions were not in accordance with the law. Their apparent scope was substantially curtailed by the Data Protection Act 1998 and the Directive, leaving serious difficulty in identifying the applicable rules. The legislation and draft guidance also lacked safeguards enabling proportionality to be examined. In particular, they imposed no adequate requirements concerning consultation, consent, advance warning or subsequent notification, and the guidance was not binding.

5. The proportionality challenge to the legislation as such did not cross the high threshold for an abstract challenge. Part 4 pursued legitimate aims, was rationally connected to them and could be operated compatibly in individual cases. Nevertheless, its low disclosure thresholds and lack of safeguards created a substantial risk of disproportionate interferences. Guidance was required on consent, dispensing with consent, notification and protection against misuse.

6. There was no additional incompatibility with EU law. The data-retention complaint also failed because the fifth data-protection principle and the Information Commissioner’s enforcement powers continued to apply.

7. The article 8 defect could not be cured by interpretation under section 101 of the Scotland Act 1998. The information-sharing provisions were therefore outside legislative competence and could not be commenced. The parties were invited to submit proposed terms for a suspended-effect order under section 102 within 42 days.

• United Kingdom Supreme Court: In The Christian Institute and others v The Lord Advocate [2016] UKSC 51, the court unanimously allowed the appeal. It held the information-sharing provisions outside legislative competence because they were incompatible with article 8 and invited submissions on an order under section 102 of the Scotland Act 1998.
• Inner House of the Court of Session: The appealed judgment was [2015] CSIH 64. The Supreme Court reversed its conclusion so far as necessary to uphold the article 8 challenge.
• Lord Ordinary: An earlier first-instance decision is discussed, but its citation is not stated in the judgment.