Common Services Agency v Scottish Information Commissioner (Scotland)

Factual and Procedural Background

The Agency, a Scottish public authority responsible for collecting and disseminating epidemiological data, received a request from an Applicant (acting on behalf of a Member of the Scottish Parliament) for annual childhood leukaemia statistics, broken down by census ward in The Region, for the years 1990-2003. The Agency refused, citing risks of indirect identification of living individuals and a resulting breach of the Data Protection Act 1998 (DPA 1998). The Applicant complained to the Commissioner under the Freedom of Information (Scotland) Act 2002 (FOISA 2002).

The Commissioner decided that unaltered disclosure would contravene the first data-protection principle but ordered release of the data after “barnardisation” (a statistical perturbation technique) and found the Agency in breach of its duty to provide advice and assistance. The Agency appealed to the Court of Session, which upheld the Commissioner. The Agency then appealed to the House of Lords, where the instant judgment was delivered by Judge Hope (with Judges Rodger, Hale, Mance and an introductory concurrence by Judge Scott). The Law Lords allowed the appeal, set aside the Commissioner’s decision, and remitted the matter for reconsideration.

Legal Issues Presented

1. Whether, for FOISA 2002 purposes, barnardised epidemiological data were “held” by the Agency at the time of the Applicant’s request.
2. Whether barnardised data constitute “personal data” within the meaning of section 1(1) DPA 1998.
3. If the data are personal, whether disclosure would comply with the data-protection principles, in particular the first principle and the conditions in Schedules 2 and 3 of DPA 1998.
4. Whether the data, if personal, also qualify as “sensitive personal data,” thereby engaging the stricter Schedule 3 conditions.
5. Whether the Commissioner had power to require disclosure in barnardised form absent findings that the disclosure would not breach DPA 1998.

Arguments of the Parties

Agency's Arguments

• Barnardisation would require creation of new information; therefore the requested data were not “held” at the time of request under section 1(4) FOISA 2002.
• Even if held, the data—barnardised or not—remained personal (and sensitive) data because the Agency could re-identify individuals, engaging section 38 FOISA 2002.
• Disclosure would breach the first data-protection principle as no Schedule 2 or 3 condition was satisfied.
• The Agency owed a clinician-equivalent duty of confidence to data subjects.

Commissioner's Arguments

• The Agency breached its section 15 FOISA duty by not offering disclosure in less disclosive form.
• Barnardisation substantially removed re-identification risk, so the resulting tables were no longer personal data.
• Even if personal, disclosure could meet Schedule 2 condition 6(1) (legitimate interests) without unfairness.

Secretary of State's (Intervener) Arguments

• Public authorities should not be compelled to create new information; FOI duties should be limited to information truly held.
• If personal data were disclosed, possible reliance might be placed on Schedule 2 condition 5(b) and Schedule 3 condition 7(1)(b) (processing necessary for statutory functions).

Table of Precedents Cited

Court's Reasoning and Analysis

1. “Held” Status: Barnardisation was likened to redaction. Applying section 11 FOISA flexibility, the Law Lords held that disguising existing data does not create new data; thus the data were “held” at the time of the request.

2. Personal Data Inquiry: The Court analysed section 1(1) DPA 1998. Judge Hope reasoned that data cease to be personal only if fully anonymised so that no living individual is identifiable when the data are considered together with any other information held by the controller. Whether barnardisation achieves this is a factual matter the Commissioner had not determined.

3. Sensitive Personal Data: Because the data concern children’s health, they potentially fall within section 2(e) DPA 1998. The definition of “sensitive personal data” incorporates the full definition of “personal data;” therefore anonymity assessment is crucial. If still personal, Schedule 3 conditions must also be satisfied.

4. Data-Protection Principles: Disclosure must comply with the first principle: fairness, lawfulness, and satisfaction of at least one Schedule 2 condition (and Schedule 3 if sensitive). Possible conditions include Schedule 2 para 6(1) (legitimate interests) and Schedule 3 para 7(1)(b) (necessary for statutory functions), but no findings existed. Without such findings, compelled disclosure was premature.

5. Commissioner’s Error: The Commissioner ordered disclosure without deciding (a) whether barnardised data remained personal/sensitive, and (b) if so, whether any Schedule 2 or 3 condition applied. This constituted an error of law.

Holding and Implications

HOLDING: The appeal is ALLOWED. The Court of Session’s interlocutor and the Commissioner’s decision are set aside. The Applicant’s request is remitted to the Commissioner for reconsideration consistent with the judgment.

Implications: The ruling clarifies that statistical perturbation does not automatically remove data from the “personal” category; regulators must make explicit findings on identifiability and compliance with data-protection principles. The decision guides public authorities across the United Kingdom on the interaction between FOI legislation and DPA 1998 when handling micro-data, emphasizing rigorous anonymisation or satisfaction of Schedule 2/3 conditions before disclosure.