Centre for Freedom of Information The childhood leukaemia case – learning points in dealing with the balance between access to information and privacy rights Christine ONeill 23 September 2009 © Brodies 2009

Overview Re-cap: some basics The approach of the Court of Session The judgment of the House of Lords Learning Points

Re-cap – What is personal data? Section 1(1) DPA personal data means data which relate to a living individual who can be identified – from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller

The EU perspective - What is personal data? DPA implements Directive 95/46/EC Article 1 personal data shall mean any information relating to an identified or identifiable natural person (data subject); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity

The EU perspective - identification Recital 26 of Directive says Whereas the principles of protection must apply to any information concerning an identified or identifiable person: whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable

Re-cap – the Durant decision Durant -v- Financial Services Authority [2003] EWCA Civ 1746 English Court of Appeal Subject access request seeking access to documents generated by the FSA in response to a complaint. FSA had disclosed much of the information sought but refused to disclose some as it did not relate to Durant Durant argued that, as he was the source of the material, all of the information generated by the FSA in response to his complaint was his personal data

UK perspective – the Durant decision FSA argued that the phrase relate to had to be construed more narrowly, so that the information had to refer to, or concern, Durant Court of Appeal rejected Durants argument The Court recognised that information about an individual would be his personal data if it was about him/her because it would relate to that individual

UK perspective – the Durant decision However, mere mention of an individual in a document would not necessarily amount to that individuals personal data unless it fell within a continuum of relevance or proximity to the individual Guidance Biographical in a significant sense - beyond involvement in matter that has no personal connotations Focused on the individual – not something else e.g. another person or event In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity

Re-cap – Mr Collies request Request for information on incidents/incidences of childhood leukaemia in Dumfries & Galloway, broken down by census ward. CSA offered to provide aggregated data but refused to provide numbers for each census ward as the small numbers involved could give rise to a risk of indirect identification of living individuals. SIC ordered that the CSA disclose the information in perturbed or barnardised form unless Mr Collie would prefer aggregated annual data.

The Approach of the Court of Session CSA appealed SICs decision on a number of grounds including on the basis that barnardised data constituted personal data Court of Session rejected the CSAs appeal on the basis that the barnardised data no longer had the individuals as its focus and was not biographical in any meaningful sense the focus of the data was on the incidence of the leukaemia – not the children Relied on Durant analysis of relates to

The Approach of the House of Lords Common Services Agency –v- Scottish Information Commissioner [2008] 1 W. L. R High level principles Anonymisation and the definition of personal data How to deal with data protection principles

The Approach of the House of Lords High Level Principles In my opinion there is no presumption in favour of the release of personal data under the general obligation that FOISA lays down (Lord Hope) the system of regulation of data processing under the 1998 Act remains in place, but the Parliament has grafted on to it provisions for third parties to obtain information without the operation of the pre-existing system of protection for data subjects being compromised (Lord Rodger)

The Approach of the House of Lords Anonymisation and the definition of personal data relate to requirement - Lords expressly refused to consider Durant on basis medical information clearly related to the individuals concerned identification requirement If the data could be fully anonymised then it was no longer personal data and it could be disclosed without the need to consider the data protection principles However, there was no real consensus as to what was meant by full anonymisation or to whom the data had to be anonymous

The Approach of the House of Lords Lord Hope – mere access to other information from which individuals could be identified does not prevent CSA from processing data in a way such that they can no longer be identified Lord Rodger where using "reasonable means" the data controller can still identify the individuals to whom it relates =>personal data if it becomes "impossible" for the data controller to make a connection between the data and the individuals to whom it relates => not personal data Baroness Hale – only approach issue of identifiability from perspective of intended recipient

The Approach of the House of Lords The Data Protection Principles Fair and lawful processing Schedules 2 and 3 Condition 6 of Schedule 2

The Approach of the House of Lords The Data Protection Principles the proper course would be for [the application] to be remitted to the Commissioner so that he can examine the facts…and determine whether the information can be sufficiently anonymised for it not to be personal data Striking the right balance …would raise issues of fact as to which no findings have been made and which only the Commissioner is in a position to determine

Summary of Learning Points Giving data protection its place Anonymising personal data is the best and the worst solution Unusually for FOI the factual matrix has a very important role to play For the courts, the process may be more important than the outcome

Centre for Freedom of Information The childhood leukaemia case – learning points in dealing with the balance between access to information and privacy rights Christine ONeill 23 September 2009 © Brodies 2009