Scottish Court of Session Decisions

You are here: BAILII >> Databases >> Scottish Court of Session Decisions >> Common Services Agency v. Scottish Information Commissioner [2006] ScotCS CSIH_58 (01 December 2006)
URL: http://www.bailii.org/scot/cases/ScotCS/2006/CSIH_58.html
Cite as: [2006] CSIH 58, 2007 SC 231, [2006] ScotCS CSIH_58

[New search] [Help]

FIRST DIVISION, INNER HOUSE, COURT OF SESSION

Lord President

Lord Nimmo Smith

Lord Marnoch

[2006] CSIH 58

XA89/05

OPINION OF THE LORD PRESIDENT

APPEAL

THE COMMON SERVICES AGENCY

Appellant;

against

THE SCOTTISH INFORMATION COMMISSIONER

Respondent:

_______

Act: Stacey, Q.C.; R.F. Macdonald

Alt: Cullen, Q.C.; Brodies

1 December 2006

[1] On 11 January 2005 a Mr. Collie, acting on behalf of a Member of the Scottish Parliament, requested the Common Services Agency ( "CSA") to give to him certain information under the Freedom of Information (Scotland) Act 2002 ("FOISA"). The request read:-

"Recorded incidents of childhood leukaemia. Please supply me with details of all incidents of leukaemia for both sexes in the age range 0-14 by year from 1990-2003 for all the DG [Dumfries and Galloway] postal area by census ward."

Certain correspondence thereafter took place between an official of the CSA and Mr. Collie. The official explained that, while the CSA held relative data for the period 1990 to 2001, it did not hold data for 2002 or 2003 as such data were not yet complete. He further explained that the years for which data were available involved very small numbers and that there were in consequence concerns that their release would give rise to a significant risk of indirect identification of living individuals. This applied whether the numbers considered were for census wards per year or for the whole of the Dumfries and Galloway area per year. He indicated that the CSA would be willing to give to Mr. Collie the data for the whole area of Dumfries and Galloway aggregated for the combined period 1990 to 2001. It regarded the data requested as otherwise being exempt information under the FOISA and for that reason had decided not to accede to Mr. Collie's request.

[2 ] Mr. Collie sought a review by the CSA of that decision. On that review the CSA affirmed its decision and gave notice to that effect under section 21 of the FOISA.

[3 ] Mr. Collie being dissatisfied with that notice then applied under section 47 to the respondent for a decision. His application read:-

"I wish the Commissioner to review the refusal of the NHS statistical service to release details of recorded incidences of Leukaemia in Dumfries and Galloway, as per my e-mail request, appended below."

That e-mail comprised his initial request. The expression "incidence" as distinct from "incidents" had been used in the correspondence between the official and Mr. Collie.

[4 ] The respondent then entered into correspondence with the CSA. He also made his own enquiries. Ultimately he issued on 15 August 2005 his decision on Mr. Collie's application to him.

[5 ] After a narrative and reasoning the decision was expressed in the following terms:-

"I find that the Common Services Agency (the CSA) did not deal with Mr. Collie's request for information fully in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in that it breached section 1(1) of FOISA in not providing certain information by year at census ward level for the Dumfries and Galloway postal area, for the years in which it held such information 1990-2001, as detailed above.

In respect of information for which an exemption applied, I find that the CSA did not provide advice and assistance to Mr. Collie as to what information it was possible for it to supply to him as required under section 15 of

FOISA.

I require that CSA provide Mr. Collie with the census ward data for 1990-2001 for the DG postal area on the basis set out in paragraphs 112 to 114 above, that is, in a perturbed (barnardised) form unless Mr. Collie would prefer to receive alternative information on aggregate annual figures for the whole DG Health Board area as indicated in paragraph 115 above.

... ."

[6 ] In the course of his reasoning the respondent had concluded that the true data at census ward level constituted personal data within the meaning of the Data Protection Act 1998, that they were, by virtue of section 38 of the FOISA (as read with the 1998 Act) exempt data and that the CSA was not obliged to give them to Mr. Collie. However, in the course of the correspondence there had been reference to a process of perturbation known, after its author, as "barnardisation". That method, as envisaged generally by the CSA, involved the random modification of small numbers as follows -

"by adding 0, + 1, or - 1 to all values where the true value lies in the range of 2 to 4 inclusive; adding 0 or + 1 to cells where the value is 1; '0's are kept as '0'."

Reference to such a process of perturbation is made in a Guidance on Handling Small Numbers which had been published by the CSA in draft form in July 2005. It is, it appears, a standard statistical method, devised with a view to avoiding or minimising the risk of the identification of individuals in circumstances where the numbers are small but which can nonetheless provide useful information for planning and other purposes. The total number of diagnoses of leukaemia in Dumfries and Galloway of children in the age range 0-14 years in the period from 1990 to 2001 inclusive was 15, over the 47 census wards of that area; in tabulated form these 15 cases would accordingly be spread over 564 cells.

[7 ] The FOISA provides:

"1(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

...

(4) The information to be given by the authority is that held by it at the time the request is received ...

(6) This section is subject to sections 2, ...

2(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption ...

(2) For the purposes of paragraph (a) of subsection (1), the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

...

(e) in subsection (1) of section 38 -

...

(ii) paragraph (b) where the first condition referred to in that

paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section."

Section 3 defines "Scottish public authority". The CSA is such an authority. Section 15 provides:

"(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

(2) A Scottish public authority which, in relation to the provisions of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1)."

Sections 16 to 18 inclusive provide for responses by a Scottish public authority to requests for information. Sections 20 and 21 provide for the review of a refusal to accede to a request. All the above provisions are in Part 1 of the Act.

[8 ] Part 2 of the FOISA provides for exempt information. Section 38, which appears in that Part, provides:-

"(1) Information is exempt information if it constitutes -

...

(b) personal data and either the condition mentioned in subsection (2) (the

'first condition') or that mentioned in subsection (3) (the 'second condition') is satisfied;

...

(2) The first condition is -

(a) in a case where the information falls within any of (a) to (d) of the

definition of 'data' in section 1(1) of the Data Protection Act 1998 (c. 29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene -

(i) any of the data protection principles

...

(5) In this section -

'the data protection principles' means the principles set out in Part 1 of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

'data subject' and 'personal data' have the meanings respectively assigned to those terms by section 1(1) of that Act;

... ".

Part 3 of the FOISA makes provision in respect of the Scottish Information Commissioner. By section 42(1) he (or she) is to be an individual appointed by Her Majesty on the nomination of Parliament. Section 43 provides:-

"(1) The Commissioner, with a view in particular to promoting the observance by Scottish public authorities of the provisions of -

(a) this Act; and

(b) the codes of practice issued under sections 60 and 61

is to promote the following of good practice by those authorities.

(2) The Commissioner -

(a) must determine what information it is expedient to give the public

concerning the following matters -

(i) the operation of this Act;

(ii) good practice;

(iii) other matters within the scope of that officer's functions,

and must secure the dissemination of that information in an appropriate form and manner; and

(b) may give advice to any person as to any of those matters.

(3) The Commissioner may assess whether a Scottish public authority is following good practice."

Section 44(1) provides:-

"(1) If it appears to the Commissioner that the practice of a Scottish public authority in relation to the exercise of its functions under this Act does not conform with the code of practice issued under section 60 or 61, the Commissioner may give the authority a recommendation ... "

As regards enforcement section 47(1) provides that a person who is dissatisfied with a notice under section 21-

"may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 this Act".

Section 49(3) provides, among other things, that the Commissioner must

"if no settlement has in the meantime been effected, reach a decision on the application before the expiry of [a prescribed period]".

Section 49(6) provides:-

"Where the Commissioner decides that that authority has not dealt with the request for information in accordance with Part 1 of this Act, [certain matters must be specified]."

[9 ] Part 6 of the FOISA makes provision for the issuing of codes of practice. Section 60 (which is within that Part) provides:-

"(1) The Scottish Ministers are to issue, and may from time to time revise, a code of practice providing guidance to Scottish public authorities as to the practice which it would, in the opinion of the Ministers, be desirable for the authorities to follow in connection with the discharge of the authorities' functions under this Act.

(2) The code must, in particular, include provision relating to -

(a) the provision of advice and assistance by the authorities to persons

who propose to make, or have made, requests for information ...

...

(4) Before issuing or revising the code, the Scottish Ministers are to consult the Commissioner.

(5) The Scottish Ministers must lay the code, and any revised code made under this section, before the Parliament."

[10 ] The Scottish Ministers have issued and there has been laid before Parliament a code of practice under section 60. Paragraph 20 of that code (which appears in a Part headed "Provision of advice to persons making requests for information") provides:-

"20. Where the applicant has provided insufficient information to enable the authority to identify and locate the information sought, or where the request is unclear, the authorities should help the applicant to describe more clearly and particularly what information they require. Authorities should be aware that the aim of providing assistance is to clarify the nature of the information being sought not to determine the applicant's aims or motivation. Where more information is needed to clarify the request, it is important that the applicant is contacted as soon as possible, preferably by telephone, fax or e-mail. The 20 day period will run from the date of clarification but authorities should note that the Commissioner will take a hard stance against any authority that uses clarification as a means of delaying dealing with an application. Appropriate help could include:

· providing an outline of different kinds of information which might meet the terms of the request

...

· an indication of what information could be provided within the cost ceiling in instances where a request would be refused on cost grounds.

This list is not exhaustive and authorities should always be flexible in offering advice and assistance taking into account the circumstances of each individual case".

Paragraph 75 of the Code provides:-

"75. In deciding whether a disclosure is in the public interest, authorities should not take into account:

...

· the risk of the applicant misinterpreting the information ... ".

[11 ] The Data Protection Act 1998 provides by section 1 definitions of certain expressions used in that Act. These include:-

"'data' means information which -

(a) is being processed by means of equipment operating automatically in

response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of

such equipment, ...

'data controller' means ... a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed.

'personal data' means data which relate to a living individual who can be identified -

(a) from those data or

(b) from those data and other information which is in the possession of, or

likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

'processing', in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including -

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

otherwise making available, or

(d) alignment, combination, blocking, erasure or destruction of the

information or data."

[12 ] The discussion before us ranged widely but in the event the first issue for decision can be stated shortly. Section 1(1) of the FOISA provides that the entitlement of the person who requests information is that he or she be given information from a Scottish public authority "which holds it". Section 1(4) defines the information to be given as that "held by [the authority] at the time the request is received".

[13 ] At the time when the CSA received the request from Mr. Collie, the information which it held included the raw data (whether in computerised or other form) of the diagnoses of childhood leukaemia in the relevant years in the Dumfries and Galloway area. The CSA provided that information to the respondent in the course of his enquiries (para. 11). It offered to provide to the Commissioner (but not to Mr. Collie) these cases broken down by census ward. What the CSA did not hold at the time of Mr. Collie's request, nor so far as appears has ever held, is these data at census level "barnardised" by the method generally used by the CSA (or by any other method). It seems that barnardised data could be provided without undue difficulty. The issue is whether barnardised data are, as Mr. Cullen for the respondent contended, simply the raw data presented in a particular form (for the legitimate purpose of reducing the risk of personal identification) or are, as Mrs. Stacey for the CSA contended, different or other data which the CSA are not obliged to give to Mr. Collie.

[14 ] Mrs. Stacey submitted that the exercise of barnardisation involved the creation of something new. Where positive numbers appeared in a true table derived from the underlying data about individual patients these numbers were subject to alteration by different numbers being substituted. Each positive number was open to such alteration.

[15 ] Mr. Cullen acknowledged that to some degree the barnardised data might be viewed as different from the raw data. The process of barnardisation involved, in the case of positive numbers, their modification so that, except where the modification was by adding 0, an addition or subtraction was made from the number indicated by the raw data. Barnardisation was a recognised statistical tool whose purpose was not the creation of new data (far less the falsification of existing data) but which allowed the underlying original data to be presented in a form which protected confidentiality. The barnardised numbers were based on (or derived from) the original numbers. The scope of "information" within the purview of section 1 was to be seen in the context of the whole Act, and in particular of section 15 and the code of practice issued under section 60. The CSA was obliged, in so far as it was reasonable to expect it to do so, to provide assistance and advice to Mr. Collie with respect to his request. That duty encompassed providing an outline of different kinds of information which might meet the terms of his request. The respondent, as Commissioner, had the statutory responsibility of seeing that the CSA performed its duty in that regard. That duty might be discharged by the provision by it of barnardised data. The communications between the CSA and the respondent had included a response to a draft decision in which the CSA's official had specifically referred to the barnardisation of data at ward level and to the draft Guidance which had discussed that method of treatment. The respondent had been entitled from that communication to conclude that the CSA did not object to the release of information in barnardised form at census ward level. The policy of the statute was to promote the giving of information by public authorities. It would defeat the statutory purpose if a narrow view were to be taken of what information fell to be given. The effect of barnardising the data was not fundamentally to change but rather to alter the focus of the data.

[16 ] The purpose of the FOISA is to secure, subject to the statutory exemptions, the giving to a person who requests it the information which he or she seeks. The duty of each public authority to give advice and assistance under section 15, as read with the code of practice, involves the need for that authority to be diligent in seeking ways which, consistently with its obligations to others, it may satisfy the requirements of such a person. "Information" is not defined in the statute (other than that it means "information recorded in any form" - section 73) and must accordingly, in the present context, include relevant data within the meaning of the Data Protection Act 1998; it would also in some circumstances include documents such as patients' files and other medical records. Those data comprise numbers of persons of a particular age group living in a particular area who have been diagnosed with a particular disease, those numbers being capable of collation or ordering in various ways. These ways include their being expressed in tabulated form with the year of diagnosis on one axis and the relative census ward of Dumfries and Galloway on the other. If the cellular information so depicted is not further treated, a person perusing the table would be able to identify in which ward in any year a child was diagnosed as having leukaemia. The cellular information could, however, be treated in a number of ways, if it were sought to conceal the actual number of diagnoses in any particular ward in any particular year (incidents) but to disclose whether there had been or had not been one or more incidents in any ward in any year (incidence): it would be possible to insert Y or N (Yes or No) in the appropriate cells. The table would no doubt have an annotation indicating what had been done. The giving of a table as so described would not, in my view, involve the giving of information different from the raw data. It would be to give the same information, subject to a modification, designed to restrict the scope of disclosure. I have come, with hesitation, to the view that the same is true when a barnardisation exercise is carried out. At first sight, of course, there appears to be a material change. Subject to the possibility (which seems sufficiently remote to be disregarded) that all the positive numbers on the original table are modified by adding 0, the original numbers are subject to upward, or in some cases upward or downward, change. Such alteration - by adding incidents which do not exist or by subtracting incidents which do - appears to provide new data and different information. But it must be borne in mind that the intelligent reader will also be informed by a relative footnote that the numbers which he or she sees have been barnardised and so cannot be regarded as true numbers. He or she will accordingly be left in essentially the same position as a person provided with a table in which incidence is depicted by the insertion of Y or N in a table. That, as I have said, would not result in the giving of different information.

[17 ] There may be a question as to whether or not information as to incidence is what Mr. Collie requested. His request refers to "recorded incidents of childhood leukaemia". But in subsequent correspondence with the CSA both parties refer to "incidence" and I conclude that information about incidence is within the scope of the request as later modified.

[18 ] Section 1(1) of the FOISA refers to information "that is held by [the authority] at the time when the request is received". The information held at that time was the raw data but, if I am correct in my view that the barnardised data are different from the raw data not in kind but only in presentation, then the CSA at the relevant time held the relevant data and their disclosure in barnardised form could be required of the CSA in furtherance of its obligation to advise and assist - subject always to any objection on ground of cost or to any fees chargeable. The terms of the respondent's narrative suggest that the necessary exercise could be done without undue trouble or expense.

[19 ] Mrs. Stacey also submitted that the barnardised data were exempt on the ground that they fell within section 38(1)(b) and (2)(a)(i) of the FOISA (as read with the Data Protection Act 1998). Her opening submission concentrated upon the "first condition" - the respondent having accepted in his reasoning that the unbarnardised information was personal data within the meaning of the Data Protection Act. In the event the discussion subsequently concentrated on a different aspect. Mr. Cullen, in response, submitted that the barnardised data were not "personal data"; he did not seek to maintain that, if they were, their disclosure would not be a contravention of the 1998 Act.

[20 ] In support of his submission Mr. Cullen cited Durant v Financial Services Authority [2003] EWCA Civ 1746; [2004] FSR 28 in which the Court of Appeal, addressing an issue of interpretation of the 1998 Act, preferred a narrower to a broader view of the definition of personal data. The interpretation was directed to the phrase "which relate to" in the opening words of that definition. The barnardised data, Mr. Cullen submitted, did not have any individual as their focus or main focus; they were not biographical in any significant sense; they did not in any realistic sense affect the privacy of any individual; rather they served to draw the focus of the information away from the individual and direct it to other more general aspects. On this matter Mrs. Stacey submitted that a barnardised table, just as any unbarnardised table, did focus on individuals; it was about the biographical history of individuals (in particular their contraction of disease); the focus was on the data subject. It could be distinguished from tables with another focus - such as for planning for medical facilities or staff.

[21] In Durant v Financial Services Authority the Court of Appeal required to decide, among other things, whether information held by the Authority on certain manual files, including a file relating to complaints by Mr. Durant about Barclays Bank, was personal data to which Mr. Durant as the data subject was under section 7 of the Act entitled to have access. As I have said, that issue turned upon a construction of the phrase "which relate to" in the opening part of the definition of "personal data" in section 1(1) of the 1998 Act. Auld L.J. (at paragraph 27) observed:-

"In conformity with the 1981 Convention and the Directive, the purpose of section 7, in entitling an individual to have access to information in the form of his 'personal data' is to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in sections 10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved."

At paragraph 28 he added:

"Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity."

Mummery L.J. agreed. Buxton L.J., also agreeing, added certain observations on the concept of "personal data". In paragraph 79 he said:

"The guiding principle is that the Act, following Directive 95/46 gives rights to data subjects in order to protect their privacy. That is made plain in recitals (2), (7) and (11) to the Directive, and in particular by recital (10), which tells us that:

'The object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principle of Community law'.

The notion suggested by my Lord in his para 28 will, with respect, provide a clear guide in borderline cases."

[22 ] Mrs. Stacey did not suggest that the guidelines laid down by Auld L.J. in paragraph 28 were wrong. She maintained that, applying these guidelines, the barnardised data were personal data.

[23 ] I have come to the view that a table setting out the census ward data for 1990-2001 for the Dumfries and Galloway postal area, barnardised in the manner described, would not constitute personal data of any of the children resident in Dumfries and Galloway who had in a relevant year been diagnosed with leukaemia. Although the underlying information concerns important biographical events of the children involved, by the stage of the compilation of the barnardised table that information has become not only statistical but perturbed to minimise the risk of identification of any individual child. It is no longer, in respect of any child, "biographical in a significant sense". The focus has, in my view, also moved away from the individual children to the incidence of disease in particular wards in particular years. The rights to privacy of the individual children are not infringed by the disclosure of the barnardised data.