Scottish Information Commissioner may have to reconsider appeal case

Scottish Information Commissioner may have to reconsider appeal case

A landmark case on the compatibility of data protection and freedom of information laws was heard by the House of Lords this week, and the outcome could have profound implications.

The case focuses on an NHS agency's refusal of a Freedom of Information (FOI) request for statistics about childhood leukaemia. The agency feared that the information could identify individual children and breach their privacy, and having lost its case in the Scottish courts, appealed to the House of Lords.

Law Lords heard arguments in the case on Tuesday and Wednesday this week. They have indicated that it if someone makes an FOI request for personal data, it might be justifiable to ask why they want the data before deciding whether to fulfil or reject the request.

The original FOI request was from Michael Collie, a researcher acting on behalf of a Member of the Scottish Parliament. Collie asked for "details of all incidents of leukaemia for both sexes in the age range 0–14 by year from 1990–2003 for all the DG [Dumfries and Galloway] postal area by census ward". The purpose of the request was to establish whether a nearby nuclear power station and military firing range had an effect on incidences of cancer.

The NHS agency the Common Services Agency (CSA) refused, saying that the numbers were so small that releasing the data could identify patients. It said that the vast majority of wards contained no case of leukemia whilst other wards were associated with one case, or very occasionally two cases.

The CSA argued that the publication of such data linked to a precise geographical area would give rise to a significant risk of indirect identification of living individuals.

The Scottish Information Commissioner (SIC) accepted this argument but determined that the information could be released if the data were 'barnardised'. This is a method designed by a statistician, Professor George Barnard, that helps to disguise people's identities when cells of information contain low numbers.

The CSA challenged the SIC's view in the Court of Session in Edinburgh but that court supported the Commissioner's stance. It stated that the barnardised data were not personal data and should be released. So the CSA appealed to the House of Lords.

By contrast, it was determined early in the first day of argument before the House of Lords that the barnardised data were personal data and that the CSA's arguments on this point would prevail. This was because it emerged that the barnardisation technique was far from perfect where most of the cells contain zero and where, in some cases, the barnardised data were exactly the same as the raw data. Barnardisation simply adds in a random way zero, plus one, or minus one to the numbers two, three and four; and adds zero or one to the number one, when they appear in a database. Zeros are left at zero.

At the end of the second day, lawyers for both sides recommended that the House of Lords should remit the FOI request back to the Scottish Information Commissioner, so that he could reconsider the data protection elements of the original request.

In coming to this conclusion, the House of Lords indicated that a key data protection ruling of 2003, the case of Michael Durant against the Financial Services Authority, did not need to be reviewed for the purposes of deciding the current case. That view, if confirmed in the final judgment, could dash the hopes of those in the data protection community who see Durant as a flawed judgment.

The judgement from the House of Lords is expected before August.

Law Lords to rule on clash of data protection and FOI laws (Out-Law, 3 April 2008)