Common Services Agency (Appellants) v Scottish Information Commissioner (Respondent) (Scotland), [2008] UKHL 47

Wed, 09 Jul 2008 08:47:00 GMT

This appeal arises out of a request by Mr Collie to the Common Services Agency under the Freedom of Information (Scotland) Act 2002 to provide the details, by census wards, of all incidents of leukaemia for both sexes, in the age range 0-14, by year, from 1990 to 2003, for all of the Dumfries and Galloway postal area.

The Agency confirmed that it held the data for the period up until 2001. But the Agency declined to supply the information since it took the view that, because of the small number of cases in each ward, there was a significant risk of indirect identification of living individuals. For that reason, the Agency considered that the information which had been requested was likely to constitute “personal data” as defined in s.1(1) of the Data Protection Act 1998. That being so, it considered that the data constituted exempt information which Mr Collie was not entitled to be given in terms of ss.1(1) and (6) and 2 of the 2002 Act.

Mr Collie appealed to the Scottish Information Commissioner. The Commissioner was satisfied that the information sought by Mr Collie was indeed personal data and that disclosing it in its entirety would entail a breach of the first data protection principle in para 1 of Sched.1 to the 1998 Act, because its disclosure would be unfair and unlawful. However, the Commissioner went on to hold that the information should be provided, “suitably amended to protect against potential identification of individuals".

The Agency appealed to the Court of Session. The First Division refused the appeal. The Agency then appealed to the House of Lords.

The House of Lords held (unanimously) that the appeal should be allowed. The House held that the proper course would be for Mr Collie’s application to be remitted to the Commissioner so that he could determine whether the information could be sufficiently anonymised for it not to be “personal data". If the Commissioner decided that it could not be so anonymised, he would then need to consider whether its disclosure to Mr Collie would comply with the data protection principles. In order to satisfy the first of the data protection principles listed in sched.1 he would need to decide whether information in that form would also be “sensitive personal data", so that at least one of the conditions in sched.3 of the 1998 Act (the processing of sensitive personal data) must be met as well as at least one of the conditions in sched. 2 of that Act (the processing of personal data).

Freedom Of Information

Common Services Agency (Appellants) v Scottish Information Commissioner (Respondent) (Scotland), [2008] UKHL 47