Trinity
Term
[2016] UKSC 51
On appeal from: [2015] CSIH 64
JUDGMENT
The Christian Institute and others (Appellants) v
The Lord Advocate (Respondent) (Scotland)
before
Lady Hale, Deputy
President
Lord Wilson
Lord Reed
Lord Hughes
Lord Hodge
JUDGMENT GIVEN ON
28 July 2016
Heard on 8 and 9 March
2016
|
Appellants
Aidan O’Neill QC
Laura-Anne van der
Westhuizen
(Instructed by
Balfour & Manson)
|
|
Respondent
W James Wolffe QC
Christine O’Neill
(Instructed by
Solicitor to the Scottish Ministers)
|
|
|
|
|
|
|
|
Intervener
(Community Law Advice Network)
Ailsa Carmichael QC
(Instructed by
Community Law Advice Network)
|
LADY HALE, LORD REED AND LORD HODGE: (with whom Lord Wilson and Lord Hughes agree)
The background to Part 4 of the 2014 Act
1.
This appeal concerns the question whether the provisions of Part 4 of
the Children and Young People (Scotland) Act 2014 lie within the legislative
competence of the Scottish Parliament. Before considering the issues that arise
(summarised in para 26 below), it is helpful to begin with an account of the
background to the legislation. A suitable starting point is the consultation
paper, “A Scotland for Children”, published by the Scottish Government
in July 2012. In general terms, two ideas underlay many of the proposals. The
first was a shift away from intervention by public authorities after a risk to
children’s and young people’s welfare had been identified, to an emphasis on
early intervention to promote their wellbeing, understood as including all the
factors that could affect their development. The second was a shift away from a
legal structure under which the duties of statutory bodies to cooperate with
one another (under, for example, section 13 of the National Health Service
(Scotland) Act 1978 and section 21 of the Children (Scotland) Act 1995) were
linked to the performance of their individual functions, to ensuring that they
work collaboratively and share relevant information so that “all relevant
public services can support the whole wellbeing of children and young people”
(para 73). In that regard, the consultation paper stated that it was “essential
that information is shared not only in response to a crisis or serious
occurrence but, in many cases, information should be shared about relevant
changes in a child's and young person’s life”. There was, however, “no commonly
agreed process for routine information sharing about concerns about wellbeing”
(para 110). The establishment of a new professional role, that of named person,
was proposed in order to address those concerns (para 111).
2.
On its introduction in April 2013, the Children and Young People
(Scotland) Bill was accompanied by a Policy Memorandum which was similar in
content to the consultation paper. It stated, in relation to named persons:
“They can monitor what children
and young people need, within the context of their professional
responsibilities, link with the relevant services that can help them, and be a
single point of contact for services that children and families can use, if
they wish. The named person is in a position to intervene early to prevent
difficulties escalating. The role offers a way for children and young people to
make sense of a complicated service environment as well as a way to prevent any
problems or challenges they are facing in their lives remaining unaddressed due
to professional service boundaries.” (para 68)
The Bill aimed to ensure that every child in Scotland had a
named person (para 70). It provided for a wide-ranging duty on all relevant
public authorities to cooperate with the named person in the conduct of their
duties. This would be of particular importance in the area of information
sharing, since the “role of the named person will depend on the successful
sharing of information between relevant public authorities” (para 73).
3.
The memorandum explained that concern had been expressed about the
existing legal framework for information sharing. This was felt to be confusing
and potentially insufficient to enable the role of the named person to operate
as well as anticipated. In particular, there were concerns regarding sharing information
about children where consent was not given (para 75). The memorandum continued:
“Currently, information about a
child may be shared where the child is at a significant risk of harm. However,
the role of the named person is based on the idea that information on less critical
concerns about a child’s wellbeing must be shared if a full picture of their
wellbeing is to be put together and if action is to be taken to prevent these
concerns developing into more serious issues. Without the necessary power to
share that kind of information, the named person will not be able to act as
effectively as is intended … Specific provisions in the Bill, therefore, set
out arrangements on information sharing, to give professionals and named
persons the power to share information about those concerns.” (paras 76-77)
4.
It appears, therefore, that one of the principal purposes of Part 4, as
envisaged at that stage, was to alter the existing law in relation to the
sharing of information about children and young people, so as to enable
information about concerns about their wellbeing, held by individual bodies, to
be pooled in the hands of named persons and shared with other bodies, with the
ultimate aim of promoting their wellbeing.
The provisions of Part 4
5.
Part 4 of the Act begins with section 19, which defines a “named person
service” as the service of making available, in relation to a child or young
person, an identified individual who is to exercise the functions listed in
subsection (5):
“(a) … doing such of the following
where the named person considers it to be appropriate in order to promote,
support or safeguard the wellbeing of the child or young person -
(i) advising, informing or
supporting the child or young person, or a parent of the child or young person,
(ii) helping the child or
young person, or a parent of the child or young person, to access a service or
support, or
(iii) discussing, or raising,
a matter about the child or young person with a service provider or relevant
authority, and
(b) such other functions as
are specified by this Act or any other enactment as being functions of a named
person in relation to a child or young person.”
In relation to section 19(5)(a)(iii), the expression “service provider” is defined by
section 32 as meaning, in a context of this kind, each health board, local
authority, directing authority, and the Scottish Ministers. The expression
“directing authority” is defined by section 32 as meaning the managers of each
grant-aided school, the proprietor of each independent school, and the local
authority or other person who manages each residential establishment which
comprises secure accommodation. The expression “relevant authorities” is
defined by section 31 and Schedule 2 as including a wide variety of public
bodies, including NHS 24, NHS National Services Scotland, the Scottish
Ambulance Service Board, the Scottish Sports Council, the Scottish Police
Authority, and the Scottish Fire and Rescue Service.
6.
Under sections 20 and 21, responsibility for the provision of a named
person service lies with health boards in relation to all pre-school children
residing within their area, and generally with local authorities in relation to
all other children residing within their area. There are exceptions in relation
to pupils at independent and grant-aided schools, where responsibility lies
with the directing authority; children kept in secure accommodation, where
responsibility lies with the directing authority; children kept in custody,
where responsibility lies with the Ministers; and children (as defined) who are
members of the armed forces. Under section 22, named person services must also
be provided in relation to all young people over 18 who remain at school.
Responsibility for making provision for them in that situation lies with the
local authority, except in relation to young people at independent or
grant-aided schools, where responsibility lies with the directing authority.
7.
Section 23 deals with the communication of information following a
change in the identity of the service provider in relation to a child or young
person (defined by section 32, in this context, as meaning the person whose function
it is to make arrangements for the provision of a named person service in
relation to the child or young person). That will occur, for example, when a
child first goes to school, and the service provider ceases to be the health
board and becomes the local authority or directing authority, or when a child
goes from a local authority school to an independent or grant-aided school, and
the service provider ceases to be the local authority and becomes the directing
authority of the school. In terms of section 23(2)(b), the outgoing service
provider must provide the incoming service provider with:
“(i) the name and address of
the child or young person and each parent of the child or young person (so far
as the outgoing service provider has that information), and
(ii) all information which
the outgoing service provider holds which falls within subsection (3).”
Information falls within section 23(3) if the outgoing
service provider considers that:
“(a) it is likely to be
relevant to -
(i) the exercise by the
incoming service provider of any functions of a service provider under this
Part, or
(ii) the future exercise of
the named person functions in relation to the child or young person,
(b) it ought to be provided
for that purpose, and
(c) its provision would not
prejudice the conduct of a criminal investigation or the prosecution of any
offence.”
8.
In considering for the purpose of section 23(3)(b) whether information
ought to be provided, the outgoing service provider is, so far as reasonably
practicable, to ascertain and have regard to the views of the child or young
person, taking account of the child’s age and maturity: section 23(4) and (5).
In terms of section 23(6), the outgoing service provider may decide for the
purpose of section 23(3)(b) that information ought to be provided only if the
likely benefit to the wellbeing of the child or young person outweighs any
likely adverse effect on that wellbeing. Section 23(7) provides:
“Other than in relation to a duty
of confidentiality, this section does not permit or require the provision of
information in breach of a prohibition or restriction on the disclosure of information
arising by virtue of an enactment or rule of law.”
9.
Section 24 imposes on service providers a duty to publish information
about the operation of the named person service, and to provide children and
young people and their parents with information about the arrangements for
contacting named persons. Section 25 imposes on service providers and relevant
authorities a duty to help in the exercise of named person functions.
10.
Section 26 is concerned with the sharing of information, and is
expressed in similar language to section 23. It imposes two duties to disclose
information, and also confers a power. First, under section 26(1), a service provider
or relevant authority (or any person exercising a function on their behalf,
such as an independent contractor: section 26(10)) must provide to the service
provider in relation to a child or young person any information which falls
within subsection (2). Information falls within section 26(2) if the
information holder considers that:
“(a) it is likely to be
relevant to the exercise of the named person functions in relation to the child
or young person,
(b) it ought to be provided
for that purpose, and
(c) its provision to the
service provider in relation to the child or young person would not prejudice
the conduct of any criminal investigation or the prosecution of any offence.”
11.
Secondly, under section 26(3) the service provider in relation to a
child or young person must provide to a service provider or relevant authority
(or any person exercising a function on their behalf) any information which
falls within subsection (4). Information falls within section 26(4) if the
information holder considers that:
“(a) it is likely to be
relevant to the exercise of any function of the service provider or relevant
authority which affects or may affect the wellbeing of the child or young person,
(b) it ought to be provided
for that purpose, and
(c) its provision to the
service provider or relevant authority would not prejudice the conduct of any
criminal investigation or the prosecution of any offence.”
In considering for the purpose of section 26(2)(b) and
the corresponding provision in section 26(4)(b) whether information ought to be
provided, the information holder is, so far as reasonably practicable, to
ascertain and have regard to the views of the child or young person, taking
account of the child’s age and maturity: section 26(5) and (6). In terms of
section 26(7), the information holder may decide for the purpose of section 26(2)(b)
and (4)(b) that information ought to be provided only if the likely benefit to
the wellbeing of the child or young person outweighs any likely adverse effect on
that wellbeing.
12.
Thirdly, section 26(8) confers an additional power: the service provider
in relation to a child or young person may provide to a service provider or
relevant authority any information which falls within subsection (9).
Information falls within section 26(9) if the information holder considers that
its provision to the service provider or relevant authority is necessary or
expedient for the purpose of the exercise of any of the named person functions.
13.
Finally, in relation to section 26, subsection (11) provides:
“Other than in relation to a duty
of confidentiality, this section does not permit or require the provision of
information in breach of a prohibition or restriction on the disclosure of information
arising by virtue of an enactment or rule of law.”
Section 27 makes further provision in relation to the
disclosure of information in breach of a duty of confidentiality: where a
person by virtue of Part 4 provides information in breach of such a duty and
informs the recipient of that breach, the recipient may not provide the
information to another person unless its provision is permitted or required by
virtue of any enactment or rule of law.
14.
Section 28 imposes a duty on local authorities, health boards, directing
authorities and relevant authorities to have regard to guidance issued by the
Ministers about the exercise of functions conferred by Part 4. Section 29
imposes a duty on the same bodies to comply with any direction issued by the
Ministers. Section 30 confers on the Ministers a power to make provision about
complaints concerning the exercise of functions conferred by or under Part 4.
15.
These provisions confirm that one of the central purposes of Part 4 is
to establish new legal powers and duties, and new administrative arrangements,
in relation to the sharing of information about children and young people, so
as to create a focal point, in the form of named persons, for the pooling and
sharing of such information, and the initiation of action to promote their
wellbeing.
16.
The terms in which sections 23 and 26 define the information which is
subject to those powers and duties indicate an intention that the range of
information to be shared will depend on the exercise of judgement by the
information holder, and is potentially very wide. That is consistent with the
emphasis in the consultation paper on collaborative working and routine
information-sharing. Thus, under sections 23(3) and 26(2), the duty to share
information does not depend on whether it is objectively relevant or necessary
that it should be shared, but on whether the information holder considers that
the information is likely to be relevant to the exercise of the named person
functions (or, as the case may be, the functions of a service provider under
Part 4): functions which are defined by section 19(5) by reference to what the
named person considers to be appropriate in order to promote, support or
safeguard wellbeing. Section 26(4)(a) is equally wide: the duty again applies
to information which the information holder considers is likely to be relevant
to the exercise of a function, and in addition the function need not be one
which actually affects the wellbeing of a child or young person, but merely one
which the information holder considers may affect their wellbeing. Section
26(9) is wider still: the power of disclosure conferred by section 26(8) can be
exercised in relation to information whose disclosure the information holder
considers to be necessary or expedient for the purpose of the exercise of any
of the named person functions. “Wellbeing” is not defined. The only guidance as
to its meaning is provided by section 96(2), which lists eight factors to which
regard is to be had when assessing wellbeing. The factors, which are known
under the acronym SHANARRI, are that the child or young person is or would be:
“safe, healthy, achieving, nurtured, active, respected, responsible, and included”.
These factors are not themselves defined, and in some cases are notably vague:
for example, that the child or young person is “achieving” and “included”.
17.
The identification of a wellbeing need does not of itself give rise to
compulsory measures. Part 5 of the Act introduces the “child’s plan” and
“targeted interventions”. Section 33(2) defines “wellbeing need” broadly: a
child has a wellbeing need “if the child’s wellbeing is being, or is at risk of
being, adversely affected by any matter”. Where the responsible authority
considers that a child has a wellbeing need and that that need cannot be met,
or met fully, without a targeted intervention which is capable of meeting the
need to some extent, it is to prepare a child’s plan for a targeted
intervention or interventions. A targeted intervention is the provision of
services for the child to meet needs which are not capable of being fully met
by the general services to children which the relevant authority provides
(section 33(4)). The child’s plan identifies the relevant authority which is to
provide the service, the manner in which it is to be provided and the outcome
which the targeted intervention is intended to achieve (section 34(1)). This does
not involve any compulsion. Further, in deciding whether a child requires a
child’s plan the responsible authority is required to consult the named person
and, so far as reasonably practicable, to ascertain and have regard to the
views of the child and the child’s parents, among others (section 33(6)).
The Scottish Government’s revised draft statutory guidance
18.
Section 28(1) of the Act provides that a local authority, a health
board, a directing authority and a relevant authority must have regard to
guidance issued by the Scottish Ministers about the exercise of functions under
Part 4. The Scottish Government in performance of its duty under section 96(3)
published revised draft statutory guidance (“RDSG”) in December 2015. The RDSG
is aimed at the strategic leaders and operational managers of health boards,
local authorities, directing authorities and relevant authorities, which are
responsible for operating Parts 4, 5 and 18 of the Act. It provides that the
organisations must have regard to the guidance in carrying out those functions
(para 1.2.2). It states (para 1.2.5) that separate practice materials will be
made available for practitioners. It records the success of the pathfinder
project set up in the Highland council area in 2006, which achieved the better
coordination of assessment and planning in support of children’s needs by
establishing common procedures and processes for sharing concerns about a child
(para 1.3.3). It states:
“The pathfinder brought significant
improvements to children and young people and their families, reducing the need
for statutory intervention in children’s and families’ lives by resolving
potential problems at an earlier stage.”
The improvements included greater clarity about whom
families should go to when they needed help, falls in the number of referrals
to the Children’s Reporter, a reduced number of children placed on the Child
Protection Register, and the focussing of resources on the children who needed
most support (para 1.3.3). It records that the approach had been adopted to
varying degrees across Scotland (para 1.3.4).
19.
The RDSG provides a useful insight into the context in which the named person
is expected to operate. It explains that “wellbeing is multidimensional” (para
2.3.4) and that wellbeing is “a broader, more holistic concept” than welfare
(para 2.3.5). It advises on the relationship between child protection and
wellbeing in these terms at para 2.3.6:
“child protection is not something
which sits separately from wellbeing. Indeed a series of low level indicators
of wellbeing need (whether obviously related or not) taken together can amount
to a child protection issue. Child protection requires taking prompt action to
safeguard a child where an assessment indicates that the child may be at risk
of significant harm. The child’s wider wellbeing should also be assessed to
ensure their current and future holistic needs are considered.”
In para 2.4.2, it gives guidance on the interpretation of
the eight wellbeing indicators in section 96(2) as follows:
“Safe - protected from abuse,
neglect or harm at home, at school and in the community.
Healthy - having the highest
attainable standards of physical and mental health, access to suitable
healthcare, and support in learning to make healthy, safe choices.
Achieving - being supported and
guided in learning and in the development of skills, confidence and
self-esteem, at home, in school and in the community.
Nurtured - having a nurturing
place to live in a family setting, with additional help if needed, or, where
this is not possible, in a suitable care setting.
Active - having opportunities to
take part in activities such as play, recreation and sport, which contribute to
healthy growth and development, at home, in school and in the community.
Respected - having the
opportunity, along with carers, to be heard and involved in decisions that
affect them.
Responsible - having opportunities
and encouragement to play active and responsible roles at home, in school and
in the community, and where necessary, having appropriate guidance and
supervision, and being involved in decisions that affect them.
Included - having help to overcome
social, educational, physical and economic inequalities, and being accepted as
part of the community in which they live and learn.”
20.
The RDSG observes (at para 2.5.4) that the views of the child, young
person or parents may differ from the practitioner’s view of wellbeing needs
and states that “a holistic assessment should take account of all views”. It
recognises that children can thrive in different environments and counsels
respect for their and their parents’ culture and beliefs (para 2.5.5). It
advises that a referral to the Children’s Reporter should be made where the
wellbeing assessment reveals that a child needs protection, guidance, treatment
or control and that a compulsory supervision order might be needed (para
2.5.6). It continues (at para 2.5.7):
“Early intervention and a
compulsory supervision order are not mutually exclusive in promoting,
supporting and safeguarding the wellbeing of a child or young person. The use
of compulsion at an early stage may help to ensure compliance with
interventions, and prevent wellbeing needs escalating. Parental capacity and
willingness to change should be considered in order to assess whether the
child’s wellbeing needs are likely to be met by voluntary support or whether a
compulsory supervision order might be necessary.”
21.
A named person, on becoming aware of a wellbeing need, should use
professional judgement in deciding how to respond. “Seeking and considering the
views of the child and parent should be a key part of the process unless doing
this is likely to be detrimental to the child’s wellbeing” (para 4.1.28).
22.
The RDSG also gives guidance on the information-sharing duties contained
in sections 23, 26 and 27 of the Act. It records (para 10.1.2) that Part 4 of
the Act does not change the type of information being shared and received by
service providers and relevant authorities but expresses the view that the Act
will increase consistency in practice which in turn is likely to mean that more
information will be shared. It advises that the Information Commissioner’s
Office (ICO) Guide to Data Protection and its Data Sharing Code of Practice
should be used to support the governance of data sharing (para 10.1.4). On
article 8 of the European Convention on Human Rights (“ECHR”) it states (para
10.3.1):
“The right to privacy in article 8
is a qualified rather than an absolute right. Public authorities can share
information if it is lawful and proportionate to do so, but each case must be
considered carefully to assess what is lawful and proportionate in the
particular circumstances.”
23.
The RDSG refers to the three tests for the sharing of information in
section 26(2) and (4), namely (i) that the information is likely to be relevant
to the exercise of the functions in question, (ii) that it ought to be provided
for that purpose, and (iii) that the sharing of the information would not
prejudice the conduct of a criminal investigation or the prosecution of any
offence. In its discussion of the second test (para 10.7.4) it states:
“It is routine good practice to seek
parents’ views about information shared, unless it would be against the child’s
wishes, where they are considered capable of making that decision, or where
seeking the views of the parent may be detrimental to the child’s wellbeing.”
It states that “in all but exceptional situations, the
child or young person, and, as appropriate, their parents” will be
involved in the decision to share information (para 10.10.3) (emphasis added). It
does not make the involvement of the parents a requirement in all but
exceptional circumstances. It says, without elaborating, that there must be no
other legal restrictions (paras 10.7.1 and 10.8.1). It explains the
discretionary power of a named person service provider to share information
under section 26(8) and (9) in para 10.11:
“where the named person service
has identified a wellbeing need or has been made aware of a likely wellbeing
need they have the opportunity to share information in order to explore options
for support or to make enquiries on behalf of the child, young person or
parents.”
It states in relation to this discretionary sharing of
information (para 10.11.2): “Any information shared must be legal and
considered in terms of the principles and boundaries of data protection, human
rights and children’s rights”, again without elaboration.
24.
It explains section 26(11) in these terms (paras 10.13.2 - 10.13.4):
“This sub-section of the Act
permits health professionals and others governed by a professional or common
law duty of confidentiality to legally disclose relevant information without
the information provider’s consent where disclosure of that information has
been considered and meets the tests set out in the relevant sub-sections of
section 26.
Section 26(11) does not permit or
require the sharing of information in breach of any other legal restriction
such as the [Data Protection Act 1998 (‘DPA’)], the Human Rights Act 1998, an
order of the court or a decision by a Children’s Hearing specifying non-disclosure
of specific information.
In all but exceptional situations,
the child or young person, and - as appropriate - their parents, will be
involved in the decision to share information and will be told what information
has been shared in breach of a duty of confidentiality.” (emphasis added)
25.
Finally, the RDSG’s guidance on section 27 (disclosure of information
provided in breach of confidentiality) is as follows (para 10.14.2):
“If the person receiving the
information believes it is necessary to share all or part of it in order to
promote, support or safeguard the child’s wellbeing, then the considerations in
section 26 must be applied. This would include taking into account the
child’s views and understanding the likely effect of sharing on the child’s
wellbeing. Other legal requirements must also be considered, including the DPA
and the child’s right to private and family life under article 8 of the ECHR. Decisions
to share information in these situations will need to be evidenced, and the
rationale recorded.” (emphasis added)
The challenges to legislative competence
26.
Section 29(1) of the Scotland Act 1998 provides that an Act of the
Scottish Parliament is not law so far as any provision of the Act is outside
its legislative competence. In terms of section 29(2), a provision is outside
its competence so far as any of the following paragraphs apply. Paragraph (b)
applies where the provision “relates to reserved matters”. We address that
challenge in section I (paras 27 to 66 below). Paragraph (d) applies where the
provision “is incompatible with any of the Convention rights or with EU law.” We
address the Convention rights challenge and comment briefly on the EU law
challenge in sections II and III (paras 67 to 105 below).
I The reserved matters challenge
27.
The appellants are four registered charities with an interest in family
matters and three individual parents. They challenge the lawfulness of the data
sharing and retention provisions in the Act on the ground that they relate to
reserved matters, with the consequence that section 29(2)(b) of the Scotland
Act applies. They have focused on sections 26 and 27 of the 2014 Act, but their
arguments apply also in relation to section 23(2). In terms of section 29(3) of
the Scotland Act, the question whether a provision relates to a reserved matter
is to be determined (subject to subsection (4), which has no bearing on the
present case) “by reference to the purpose of the provision, having regard
(among other things) to its effect in all the circumstances”.
28.
Section 30 of the Scotland Act gives effect to Schedule 5, in which
reserved matters are defined. In particular, paragraph 1 of Part II of Schedule
5 provides that the matters to which the Sections in that Part apply are
reserved matters. As was pointed out by Lord Hope in Imperial Tobacco Ltd v
Lord Advocate [2012] UKSC 61; 2013 SC (UKSC) 153, in a judgment with which
the other members of the court agreed, the matters listed have a common theme:
“It is that matters in which the
United Kingdom as a whole has an interest should continue to be the
responsibility of the UK Parliament at Westminster. They include matters which
are affected by its treaty obligations and matters that are designed to ensure
that there is a single market within the United Kingdom for the free movement
of goods and services.” (para 29)
Amongst the matters listed in Schedule 5 is Section B2:
“B2. Data protection
The subject-matter of -
(a) the Data Protection Act
1998, and
(b) Council Directive 95/46/EC (protection of
individuals with regard to the processing of personal data and on the free
movement of such data).”
Paragraph 5 of Part III of Schedule 5 provides that
references in the schedule to the subject-matter of any enactment are to be
read as references to the subject-matter of that enactment as it had effect on
the principal appointed day, which was 1 July 1999. It is therefore the version
of the Data Protection Act (“DPA”) which was in force on that date which is
relevant.
29.
This court has had to apply section 29(2)(b) and (3) on a number of
occasions, and the approach to be adopted is now well established. In Martin
v Most [2010] UKSC 10; 2010 SC (UKSC) 40, para 49, Lord Walker said that
the expression “relates to” was
“familiar in this sort of context,
indicating more than a loose or consequential connection, and the language of
section 29(3), referring to a provision’s purpose and effect, reinforces that.”
That approach was endorsed by Lord Hope in Imperial
Tobacco (para 16).
30.
Whether a provision “relates to” a reserved matter, in the sense
explained by Lord Walker, is determined by reference to the purpose of the
provision in question. That purpose is to be ascertained having regard to the
effect of the provision, amongst other relevant matters. As was said in
relation to the similar provisions in the Government of Wales Act 2006 in In
re Agricultural Sector (Wales) Bill [2014] UKSC 43; [2014] 1 WLR 2622, para
50:
“As the section requires the
purpose of the provision to be examined it is necessary to look not merely at
what can be discerned from an objective consideration of the effect of its
terms.”
31.
Determining the purpose of a provision may not be an easy matter. For
example, must a single predominant purpose be identified, or will the provision
relate to a reserved matter provided one purpose which can properly be
attributed to it justifies that conclusion? That question was considered,
obiter, by Lord Hope in Imperial Tobacco. The legislation in issue
imposed restrictions upon the advertising and sale of tobacco products, and was
challenged as relating to reserved matters, namely consumer protection and
product safety. Lord Hope stated:
“I do not see this as a case which
gives rise to the problem which may need to be dealt with if the provision in
question has two or more purposes, one of which relates to a reserved matter.
In such a situation the fact that one of its purposes relates to a reserved
matter will mean that the provision is outside competence, unless the purpose
can be regarded as consequential and thus of no real significance when regard
is had to what the provision overall seeks to achieve.” (para 43)
32.
This approach should not be confused with the “pith and substance” test
developed to resolve problems in a number of federal systems, to which the
Court of Session referred in the present case. Although in Martin v Most
Lord Hope mentioned cases applying that test as forming part of the
background to the scheme applied in the Scotland Act, he went on to point out
that the phrase did not appear in the Act, and that the rules which had to be
applied were those laid down in the Act (para 15). In Imperial Tobacco, Lord
Hope emphasised the latter point:
“[T]he intention was that it was
to the 1998 Act itself, not to decisions as to how the problem was handled in
other jurisdictions, that one should look for guidance. So it is to the rules
that the 1998 Act lays down that the court must address its attention.” (para
13)
So, in the present case, the Second Division’s finding
that the pith and substance of the 2014 Act are child protection does not
answer the question whether any of its provisions relate to the subject-matter
of the DPA and Directive 95/46/EC (“the Directive”).
33.
It is necessary only to add that the question whether a provision of an
Act of the Scottish Parliament relates to a reserved matter is different from
the question whether such a provision modifies the law on reserved matters. The
latter question is addressed by section 29(2)(c) of the Scotland Act and
Schedule 4, paragraph 2.
The subject-matter of the Directive
34.
The Directive was made under article 100a of the EC Treaty, which
authorises measures for the harmonisation of national laws with the aim of
achieving the internal market. The subject-matter of the Directive is described
in general terms in its title: it is a directive “on the protection of
individuals with regard to the processing of personal data, and the free
movement of such data”. The link between these two subjects is explained in the
recitals. In particular, recital 7 states that “the difference in levels of
protection of the rights and freedoms of individuals, notably the right to privacy,
with regard to the processing of personal data afforded in the member states
may ... constitute an obstacle to the pursuit of a number of economic
activities at Community level, distort competition and impede authorities in
the discharge of their responsibilities under Community law.” The recital
continues by noting that “this difference in levels of protection is due to the
existence of a wide variety of national laws, regulations and administrative
provisions”. Accordingly, recital 8 states that “in order to remove the
obstacles to flows of personal data, the level of protection of the rights and
freedoms of individuals with regard to the processing of such data must be
equivalent in all member states”. The intended result, as recital 9 states, is
that “given the equivalent protection resulting from the approximation of
national laws, the member states will no longer be able to inhibit the free
movement between them of personal data on grounds relating to protection of the
rights and freedoms of individuals, and in particular the right to privacy”.
The scope of application of the Directive is not, however, restricted to
situations involving free movement: Bodil Lindquist (Case C-101/01) [2003] ECR I-12971, paras 40-44.
35.
Turning to the substantive articles of the Directive, Chapter I sets out
general provisions. In particular, article 1 defines the twofold object of the
Directive:
“1. In accordance with this
Directive, member states shall protect the fundamental rights and freedoms of natural
persons, and in particular their right to privacy with respect to the
processing of personal data.
2. Member states shall
neither restrict nor prohibit the free flow of personal data between member states
for reasons connected with the protection afforded under paragraph 1.”
36.
Article 2 defines certain terms, and article 3 describes the scope of
the Directive. In terms of article 3(1), it applies to “the processing of personal
data wholly or partly by automatic means, and to the processing otherwise than
by automatic means of personal data which form part of a filing system or are intended
to form part of a filing system.” “Personal data” is defined by article 2(a) as
meaning “any information relating to an identified or identifiable natural
person (‘data subject’)”. “Processing of personal data” is defined by article
2(b) as meaning “any operation or set of operations which is performed upon
personal data, whether or not by automatic means, such as collection,
recording, organization, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making available, alignment
or combination, blocking, erasure or destruction”. Article 3(2) lists certain
circumstances in which the Directive is not to apply. It has not been argued
that any of those circumstances applies in the present case.
37.
Chapter II sets out general rules on the lawfulness of the processing of
personal data. Article 5 requires member states, within the limits of the
provisions of that Chapter, to determine more precisely the conditions under
which the processing of personal data is lawful. Article 6 sets out five
general principles, somewhat misleadingly described as “principles relating to
data quality”, to which member states must give effect. For example, the second
principle is that personal data must be “collected for specified, explicit and
legitimate purposes and not further processed in a way incompatible with those
purposes”. Article 7 sets out six general conditions, described as “criteria for
making data processing legitimate”, which member states must apply to the
processing of personal data, so that at least one of the conditions is
satisfied. Article 8 sets out particular rules in relation to the processing of
what are described as special categories of data, including data revealing
racial or ethnic origins, and data concerning health or sex life. Article 8(1)
requires member states to prohibit the processing of such data. The remaining
paragraphs of article 8 then disapply article 8(1) in a number of specified
circumstances, to which it will be necessary to return.
38.
Articles 10 and 11 require member states to provide that the data
controller must provide the data subject with information about the processing
of his personal data. Article 12 requires member states to guarantee certain
rights of data subjects in relation to data controllers. Article 13 permits
member states to adopt legislation restricting the scope of certain of these
rights and obligations where specified conditions are met. Article 14 requires
member states to grant the data subject the right to object to the processing
of his personal data in certain circumstances. Most of the remaining provisions
of Chapter II are concerned with the regulation of data controllers. Chapter III
is concerned with judicial remedies, liability, and sanctions. Chapter IV is
concerned with the transfer of personal data to third countries. Chapter V is
concerned with codes of conduct, and Chapter VI with the establishment of
national supervisory authorities and of an EU working party. Finally, Chapter
VII is concerned with Community implementing measures.
39.
Put shortly, therefore, the Directive was designed to harmonise the laws
of the member states relating to the protection of individuals’ interests in
relation to the use of their personal data. Its provisions specify the
standards of protection which the laws of the member states must afford, and
the methods by which those standards are to be secured and enforced.
The subject-matter of the DPA
40.
The DPA is the measure implementing the Directive in the UK. One would
therefore expect its subject-matter to be the same as that of the Directive,
and so it proves. The subject-matter of the DPA is described in general terms
in its short title: “the regulation of the processing of information relating
to individuals, including the obtaining, holding, use or disclosure of such
information”.
41.
Part I of the DPA defines some of the critical terms, broadly following
the definitions in the Directive. Part I also contains some other fundamental
provisions of the DPA. Section 4 imposes on a data controller an obligation to
comply with the data protection principles set out in Part I of Schedule 1, to
which it will be necessary to return. Section 6 establishes the office of
Information Commissioner, known in 1999 (cf para 28 above) as the Data
Protection Commissioner. Part II of the DPA confers various rights on
individuals relating to information concerning themselves, including rights to
access personal data (section 7), to prevent processing which is likely to
cause damage or distress (section 10), and to apply for the rectification or
destruction of inaccurate data (section 14). Part III contains provisions
relating to the regulation of data controllers by the Commissioner. Part IV
makes provision for exemptions from the data protection principles, and from
Parts II and III. Part V concerns enforcement by the Commissioner, and Part VI
contains miscellaneous and general provisions.
42.
It is apparent that the DPA is intended to secure equivalent standards
of protection of the rights of individuals in relation to the processing of
personal data throughout the UK, and equivalent methods of securing and
enforcing those standards. That is as one would expect, given the aims of the
Directive. Accordingly, the DPA applies to data controllers throughout the UK:
section 5. It establishes a single regulatory authority for the whole of the
UK: section 6. (Somewhat confusingly, a separate Scottish Information
Commissioner exercises functions under the Freedom of Information (Scotland)
Act 2002, but has no regulatory role in relation to data protection). The
Commissioner is the designated authority in the UK for the purposes of the 1981
Council of Europe Convention for the Protection of Individuals with regard to
Automatic Processing of Personal Data, and is also the supervisory authority in
the UK for the purposes of the Directive: section 54(1). He is accountable to
the UK Parliament, and must lay before it reports and codes of practice: section
52. His accounts are examined by the Comptroller and Auditor General: Schedule
5, Part I, paragraph 10. His power to issue codes of practice is exercisable as
directed by the Secretary of State: section 51(3). The powers to make orders,
regulations and rules under the DPA are exercisable only by the Secretary of
State, and only by means of a statutory instrument approved by the UK
Parliament: see, for example, sections 30, 38, 54, 64 and 67. The power to
designate codes of practice, for the purpose of exemptions relating to
journalism, literature and art, is similarly conferred on the Secretary of
State: section 32(3). Appeals under the DPA lie to the First-tier and Upper
Tribunals (in 1999, to the Data Protection Tribunal) throughout the UK: section
70(1).
43.
The DPA allows scope for derogation from certain of its requirements by
enactments either of the UK Parliament or of the Scottish Parliament. An
example relevant to the present case, to which it will be necessary to return,
is section 35(1), under which personal data are exempt from certain provisions
relating to the disclosure of information where the disclosure is required by
or under any “enactment”, an expression which is defined by section 70(1) as
including any enactment comprised in, or in any instrument made under, an Act
of the Scottish Parliament.
44.
Put shortly, therefore, the DPA was designed to implement the Directive
by establishing standards of protection of individuals’ interests in relation
to the use of their personal data, and methods by which those standards are to
be secured and enforced, which are equivalent in effect throughout the UK. In
particular, it imposes obligations on data controllers in relation to the
processing of data, and creates rights on the part of data subjects. It also
creates a system for the regulation of data controllers by the Commissioner. It
allows scope, however, for derogation from certain of its requirements by
legislation which need not be UK-wide in application.
The effect of Part 4 of the 2014 Act in relation to the
DPA
45.
The bodies described in Part 4 of the 2014 Act as service providers,
relevant authorities and directing authorities are currently subject, prior to
the entry into force of that Act, to a variety of legal duties in relation to
the disclosure of information, including duties imposed by the DPA. In
particular, as mentioned earlier, section 4 of that Act imposes on a data
controller an obligation to comply with the data protection principles set out
in Part I of Schedule 1. Those principles include the following:
“1. Personal data shall be
processed fairly and lawfully and, in particular, shall not be processed unless
-
(a) at least one of the
conditions in Schedule 2 is met, and
(b) in the case of
sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be
obtained only for one or more specified and lawful purposes, and shall not be
further processed in any manner incompatible with that purpose or those
purposes.
3. Personal data shall be adequate,
relevant and not excessive in relation to the purpose or purposes for which
they are processed.”
Section 2 of the DPA defines “sensitive personal data” as
including (amongst other matters) information as to a person’s racial or ethnic
origins, his physical or mental health or condition, his sexual life, or the
commission or alleged commission by him of any offence.
46.
Those principles are supplemented by the provisions of Part II of
Schedule 1 to the DPA, which indicate how they are to be interpreted. For
example, Part II contains provisions specifying circumstances in which a data
subject is to be provided with information, and the nature of that information,
in order for the data to be regarded as having been processed fairly for the purposes
of the first principle.
47.
In relation to the conditions referred to in the first principle,
Schedule 2 sets out the following conditions, so far as material to the present
case:
“1. The data subject has
given his consent to the processing.
...
3. The processing is
necessary for compliance with any legal obligation to which the data controller
is subject, other than an obligation imposed by contract.
4. The processing is
necessary in order to protect the vital interests of the data subject.
5. The processing is necessary
-
...
(b) for the exercise of any
functions conferred on any person by or under any enactment ...
6. (1) The processing is
necessary for the purposes of legitimate interests pursued by the data
controller or by the third party or parties to whom the data are disclosed,
except where the processing is unwarranted in any particular case by reason of
prejudice to the rights and freedoms or legitimate interests of the data
subject.”
48.
It follows from those conditions that, prior to the entry into force of
the 2014 Act, a data controller in Scotland can disclose information about a
child or young person without her consent (assuming, in the case of a statutory
body, that the disclosure is otherwise within its powers), if the disclosure is
necessary to protect her vital interests (condition 4), a test which requires
more than that it is likely to benefit her wellbeing; or if the disclosure is
necessary for the exercise of a statutory function (condition 5(b)), but not
merely because it considers that the information is likely to be relevant to
the exercise of that function. The data controller is also, of course, obliged
to comply with the other data protection principles so far as relevant, and
with any requirements arising from Part II of Schedule 1. In particular, it is
required to comply with the third data protection principle, in terms of which
personal data must be relevant (and not merely considered by the data
controller to be likely to be relevant) in relation to the purpose or purposes for
which they are processed.
49.
In relation to sensitive data, Schedule 3 sets out the following
additional conditions, so far as material:
“1. The data subject has
given his explicit consent to the processing of the personal data.
...
3. The processing is
necessary -
(a) in order to protect the
vital interests of the data subject or another person, in a case where -
(i) consent cannot be
given by or on behalf of the data subject, or
(ii) the data controller
cannot reasonably be expected to obtain the consent of the data subject, or
(b) in order to protect the
vital interests of another person, in a case where consent by or on behalf of
the data subject has been unreasonably withheld.
...
7. (1) The processing is
necessary -
...
(b) for the exercise of any
functions conferred on any person by or under an enactment ...
8. The processing is
necessary for medical purposes and is undertaken by -
(a) a health professional,
or
(b) a person who in the
circumstances owes a duty of confidentiality which is equivalent to that which
would arise if that person were a health professional.”
50.
It follows from those conditions that, prior to the entry into force of
the 2014 Act, a data controller in Scotland of sensitive data can disclose
information about the health or sexual life of a child or young person, without
his or her explicit consent (assuming, in the case of a statutory body, that
the disclosure is otherwise within its powers), if the disclosure is necessary
in order to protect his or her vital interests (and not merely because it is likely
to benefit her wellbeing) and, in addition, it is either impossible for him or
her to give consent or the data controller cannot reasonably be expected to
obtain it (condition 3). The information can also be disclosed if its
disclosure is necessary for the exercise of a statutory function (condition
7(1)(b)), but not merely because the data controller considers that the
information is likely be relevant to the exercise of that function. It can also
be disclosed for medical purposes, but only where a duty of confidentiality is
owed (condition 8): a requirement which gives rise to a difficulty (not
discussed in this appeal) where disclosure is liable to be made under Part 4 of
the 2014 Act, since sections 23(7) and 26(11) of the 2014 Act override duties of
confidentiality. It is in addition necessary to comply with the other data
protection principles, and with any requirements arising from Part II of
Schedule 1.
51.
The effect of Part 4 of the 2014 Act on the requirements of the DPA is
extremely complex. Numerous difficult questions are liable to arise, which were
not discussed in detail, if at all, in the present appeal. A sufficient idea of
the effect of Part 4 can, however, be obtained to enable the issue arising in
relation to reserved matters to be determined.
52.
It may be helpful to explain at the outset that much of the difficulty
arises from sections 23(7) and 26(11) of the 2014 Act, in terms of which
sections 23 and 26 do not permit or authorise the provision of information in
breach of a prohibition or restriction on its disclosure arising by virtue of
an enactment or rule of law (other than in relation to a duty of
confidentiality). This means that the powers and duties of disclosure set out
in sections 23 and 26 cannot be taken at face value. To the extent that their
terms may be inconsistent with the requirements of the DPA, they have no
effect. The DPA itself, however, contains provisions which confer exemptions
from some of its requirements where they are inconsistent with another
enactment, or which treat some of its requirements as satisfied where
disclosure is necessary for compliance with a statutory obligation. In these
circumstances, it is necessary for anyone wanting to understand the effect of
sections 23 and 26 on the disclosure of information to have the 2014 Act in one
hand and the DPA in the other, to determine the priority which their provisions
have vis-à-vis one another notwithstanding the logical puzzle created by
sections 23(7) and 26(11) of the 2014 Act when read with the DPA, and to try,
by cross-reference, to work out their cumulative effect.
53.
One potentially significant effect follows from section 35(1) of the DPA,
in terms of which personal data are exempt from the non-disclosure provisions
where the disclosure is “required” by or under any enactment. A provision of an
Act of the Scottish Parliament is an enactment for this purpose: section 70(1).
The non-disclosure provisions are defined by section 27(3) of the DPA as
meaning the provisions specified in section 27(4) of that Act, to the extent to
which they are inconsistent with the disclosure in question. Those provisions
are the first data protection principle, except to the extent to which it
requires compliance with the conditions in Schedules 2 and 3, the second,
third, fourth and fifth data protection principles, section 10 (the right to
prevent processing likely to cause damage or distress) and section 14(1) to (3)
(the rectification, blocking, erasure and destruction of data). Sections 23(2),
26(1) and 26(3) of the 2014 Act require the disclosure of personal data,
subject to sections 23(7) and 26(11). Accordingly, if those provisions are
within devolved competence, and if the logical puzzle as to whether section
35(1) of the DPA prevails over sections 23(7) and 26(11) of the 2014 Act is
resolved in favour of section 35(1) (a point which was not the subject of
argument in this appeal, but was the implicit basis on which the arguments
proceeded), then it follows that disclosure as required by sections 23 and 26
is exempt from the non-disclosure provisions, as defined, to the extent that
the non-disclosure provisions are inconsistent with the disclosure.
54.
For example, the third data protection principle is inconsistent with
the disclosure required by sections 23(2), 26(1) and 26(3) of the 2014 Act,
since those provisions require disclosure of information which is considered by
the data processor to be “likely to be relevant”, whereas the third principle
requires any personal data disclosed to be “relevant”, as well as adequate and
not excessive in relation to the purpose or purposes for which they are
processed. On the other hand, the fifth principle (that data processed for any
purpose or purposes shall not be kept for longer than is necessary for that
purpose or those purposes) is not inconsistent with sections 23 and 26 of the
2014 Act, and therefore continues to apply. The duties of disclosure imposed by
sections 23 and 26 remain subject to numerous other provisions of the DPA,
including the first data protection principle, to the extent to which it
requires compliance with the conditions in Schedules 2 and 3. The power
conferred by section 26(8) of the 2014 Act, on the other hand, does not
“require” disclosure, and therefore cannot benefit from the exemption conferred
by section 35(1) of the DPA.
55.
The discussion in this appeal focused on only one aspect of the complex
inter-relationship between Part 4 of the 2014 Act and the DPA, namely the
question whether disclosure in accordance with the duties imposed by Part 4 of
the 2014 Act would comply with the conditions imposed by Schedules 2 and 3 to
the DPA. It was argued on behalf of the Ministers that conditions 3 and 5(b) in
Schedule 2, and condition 7(1)(b) in Schedule 3, would be met. Condition 3 is
satisfied where the processing “is necessary for compliance with any legal
obligation to which the data controller is subject, other than an obligation
imposed by contract”. Condition 5(b) in Schedule 2, and condition 7(1)(b) in
Schedule 3, are satisfied where the processing “is necessary ... for the
exercise of any functions conferred on any person by or under any [or an]
enactment”.
56.
The imposition of a statutory duty of disclosure by sections 23(2),
26(1) and 26(3) of the 2014 Act has the consequence that condition 3 in
Schedule 2 to the DPA is satisfied. The terms in which that duty is imposed do
not, on the other hand, meet the requirements of condition 5(b) in Schedule 2
and condition 7(1)(b) in Schedule 3. In each case, the data controller is
required by the 2014 Act to disclose personal data to a third party if he
“considers” that the data are “likely to be relevant” to the exercise of
certain statutory functions by the third party and “ought to be provided for
that purpose”. The test imposed by condition 5(b) in Schedule 2 and condition
7(1)(b) in Schedule 3 to the DPA requires that disclosure must be “necessary”
for the exercise of statutory functions (which must again refer to the
functions of the person to whom the disclosure is made, given that section
35(1), read with section 27, requires that a data processor who is under a
statutory duty to make the disclosure must comply with Schedules 2 and 3: a
requirement which would be pointless if it were met ex hypothesi). The meaning
of “necessary” was considered by this court in South Lanarkshire Council v
Scottish Information Comr [2013] UKSC 55; 2014 SC (UKSC) 1; [2013] 1 WLR 2421. As was explained there at paras 25-27, it is an expression whose meaning
depends on the context in which it falls to be applied. Where the disclosure of
information constitutes an interference with rights protected by article 8 of
the ECHR, as in the present context (as explained at paras 75-77 below), the
requirement that disclosure is “necessary” forms part of a proportionality
test: the disclosure must involve the least interference with the right to
respect for private and family life which is required for the achievement of
the legitimate aim pursued. Disclosure where the data processor considers that
the information is likely to be relevant cannot be regarded as necessary if the
legitimate aim could be achieved by something less. It cannot be “necessary”,
in that sense, to disclose information merely on the ground that it is
objectively relevant, let alone on the ground that a particular body considers
that it is likely to be relevant. Relevance is a relatively low threshold:
information may be relevant but of little significance. A test of potential
relevance fails to recognise the need to weigh the importance of the disclosure
in achieving a legitimate aim against the importance of the interference with
the individual’s right to respect for her private and family life. That
deficiency is not made good by the requirement that the data controller
considers that the information ought to be provided. It will be necessary to
return to the question of proportionality when we consider the challenge to the
legislation under article 8.
57.
So far as the power conferred by section 26(8) is concerned, a data
controller “may” disclose information to a third party if he “considers” that
to do so is “necessary or expedient” for the purpose of the exercise of any of
the named person functions. Those conditions are less demanding than any of the
conditions in Schedules 2 and 3 to the DPA that are relied on by the Ministers.
Condition 3 in Schedule 2 is not satisfied, since the disclosure does not have
to be necessary for compliance with any legal obligation imposed on the data
controller. Condition 5(b) in Schedule 2, and condition 7(1)(b) in Schedule 3,
are not satisfied, since the processing does not have to be necessary for the
exercise of any of the named person functions. Nor is the third data protection
principle met, since there is no requirement that the information should be
relevant.
58.
The first data protection principle is therefore complied with, in so
far as the duties of disclosure imposed by Part 4 of the 2014 Act apply to
non-sensitive data, but not in so far as they apply to sensitive data or in so
far as Part 4 confers a power to disclose information rather than imposing a
duty. Sections 23(7) and 26(11) therefore apply, with the consequence that the
duties imposed by sections 23(2), 26(1) and 26(3) in respect of sensitive data,
and the power conferred by section 26(8) in respect of data of all kinds,
cannot be taken at face value. Instead, the duties imposed by sections 23(2),
26(1) and 26(3) in respect of sensitive data must be understood as being
conditional upon compliance with at least one of the conditions in Schedule 3
to the DPA, and therefore as being subject to more stringent criteria than
those which appear on the face of the 2014 Act. The power conferred by section
26(8) must likewise be understood as being conditional upon compliance with at
least one of the conditions in Schedule 2 to the DPA, and also, if the
information in question is sensitive data, upon compliance with at least one of
the conditions in Schedule 3. In addition, it is subject to compliance with the
requirements arising in relation to the first data protection principle under
Part II of Schedule 1 to the DPA, and also to compliance with the other data
protection principles and the other duties imposed by the DPA.
The effect of Part 4 of the 2014 Act in relation to the
Directive
59.
As explained earlier, the Directive requires member states to establish
a number of principles relating to the processing of data, which find their
counterpart in the data protection principles laid down in the DPA. The
principles set out in the Directive are complex and raise numerous issues of
interpretation, like their UK counterparts. For present purposes, it is
sufficient to focus on the provisions corresponding to Schedules 2 and 3 to the
DPA.
60.
As explained earlier, article 7 sets out six general criteria which
member states must apply to the processing of personal data, so that at least
one of the criteria is satisfied. The criteria which the Ministers maintain are
satisfied by the terms of Part 4 of the 2014 Act are the following:
“(c) processing is necessary
for compliance with a legal obligation to which the controller is subject; or
...
(e) processing is necessary
for the performance of a task carried out in the public interest or in the
exercise of official authority vested in the controller or in a third party to
whom the data are disclosed.”
These criteria are almost identical to those set out in
conditions 3 and 5(b) in Schedule 2 to the DPA. For the reasons explained
earlier, sections 23(2), 26(1) and 26(3) meet the requirements of criterion
(c), but section 26(8) does not meet the requirements of any of the criteria.
61.
As explained earlier, article 8(2) permits specified exemptions from the
general prohibition imposed by article 8(1) on the processing of personal data
revealing racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade-union membership, and the processing of data
concerning health or sex life. The exemptions, so far as potentially relevant,
are as follows:
“(a) the data subject has
given his explicit consent to the processing of those data, except where the
laws of the member state provide that the prohibition referred to in paragraph
1 may not be lifted by the data subject’s giving his consent; or
...
(c) processing is necessary
to protect the vital interests of the data subject or of another person where
the data subject is physically or legally incapable of giving his consent.”
Article 8(3) disapplies the prohibition in article 8(1)
where
“processing of the data is
required for the purposes of preventive medicine, medical diagnosis, the
provision of care or treatment or the management of health-care services, and
where those data are processed by a health professional subject ... to the
obligation of professional secrecy or by another person also subject to an
equivalent obligation of secrecy.”
Article 8(4) of the Directive permits member states to
lay down additional exemptions for reasons of substantial public interest,
subject to the provision of suitable safeguards. Any such additional exemptions
must be notified to the Commission.
62.
Sections 23(2) and 26(1), (3) and (8) of the 2014 Act do not meet the
requirements of the exemptions in article 8(2). The provisions of Part 4 of the
2014 Act have not been notified to the Commission, and it is not suggested that
there has been any other relevant notification. Nor has it been argued that the
provisions of Part 4 would meet the other requirements of article 8(4). It
follows for this reason also that, applying sections 23(7) and 26(11), sections
23 and 26 cannot be taken at face value. The performance of the powers and
duties created by those provisions, in respect of data falling within the scope
of article 8, must be understood as being permissible only where either one of
the exemptions listed in article 8(2) applies, or the processing falls within
the scope of article 8(3).
Discussion
63.
Does it follow, for the purposes of Section B2 of Schedule 5 to the
Scotland Act, that any of the provisions of Part 4 of the 2014 Act relate to
the subject-matter of the DPA and the Directive? The fact that a provision of
an Act of the Scottish Parliament requires or authorises the disclosure of
personal data does not in itself mean that the provision is outside legislative
competence: as explained earlier, the DPA envisages in section 35(1), read with
section 70(1), that the disclosure of personal data may be required by an
enactment comprised in an Act of the Scottish Parliament. In view of that
provision, the Scotland Act cannot sensibly be interpreted as meaning that an
enactment “relates to” the subject-matter of the DPA, and is therefore outside
the powers of the Scottish Parliament, merely because it requires or authorises
the disclosure of personal data. On the other hand, an enactment does not have
to modify the DPA in order to relate to the subject-matter of that Act. That follows
from the distinction between section 29(2)(b) and (c) of the Scotland Act. The
question whether an enactment relates to the subject-matter of the DPA and the
Directive has to be decided by following the approach described in paras 29 to
31 above.
64.
Following that approach, it was argued on behalf of the Ministers that
the purpose of Part 4 is to promote the wellbeing of children and young people,
and that the provisions concerning the processing of personal data are merely
consequential upon, or incidental to, that purpose. It is true that the
ultimate aim of Part 4 is to promote the wellbeing of children and young
people. Its more specific objective is to alter the institutional arrangements,
and the legal structure of powers and duties, governing cooperation between the
different agencies which deal with children and young people, so that they work
collaboratively, with the named person playing a coordinating role. That
objective reflects the concern, noted in the background material to the 2014
Act, that a weakness in the existing arrangements was that information was not
shared until the stage had been reached where a child or young person was at
risk of harm. Part 4 is designed to address that concern by ensuring that
information is shared between the relevant agencies, and acted on where
appropriate, before that stage is reached. Accordingly, although Part 4
contains provisions whose objective is to ensure that information relating to
children and young people is shared, that objective is not truly distinct from
the overall purpose of promoting their wellbeing, but can be regarded as
consequential upon it.
65.
It is also important to bear in mind the central aim of the provisions
in the Scotland Act concerning reserved matters, explained at para 28 above: that
matters in which the UK as a whole has an interest should continue to be the
responsibility of the UK Parliament. As explained at para 44 above, the DPA
deals with matters in which the UK as a whole has an interest, because it
implements the Directive, in accordance with the UK’s treaty obligations, by
establishing standards of protection of individuals’ interests in relation to
the use of their personal data, and methods by which those standards are to be
secured and enforced, which are equivalent in effect throughout the UK. But it
also, in section 35 and elsewhere, leaves scope for derogation from certain of
its requirements by the UK Parliament and by the Scottish Parliament. To the
extent that Part 4 of the 2014 Act affects the way in which the data protection
regime under the DPA applies to matters falling within its scope, that
possibility is contemplated by the DPA itself, in section 35. Part 4 does not
detract from the regime established by the DPA and the Directive, even if that
is only by reason of the fail-safe provisions of sections 23(7) and 26(11).
66.
For these reasons, we are not persuaded that the provisions of Part 4
relate to the subject-matter of the DPA and the Directive.
II The human rights challenge
67.
The appellants challenge the compulsory appointment of a named person as
a breach of the rights of the parents of children under article 8 of the ECHR. Article
8 provides:
“1. Everyone has the right
to respect for his private and family life, his home and his correspondence.
2. There shall be no
interference by a public authority with the exercise of this right except such
as is in accordance with the law and is necessary in a democratic society in
the interests of national security, public safety or the economic wellbeing of
the country, for the prevention of disorder or crime, for the protection of
health or morals, or for the protection of the rights and freedoms of others.”
68.
The appellants’ challenge proceeds on both a broad basis and a narrower
basis. The broad challenge is that the compulsory appointment of a named person
to a child involves a breach of the parents’ article 8 rights unless the
parents have consented to the appointment or the appointment is necessary to
protect the child from significant harm. The narrower challenge focusses on the
provisions in sections 26 and 27 for the sharing of information about a child. Before
the Inner House, the appellants’ narrower challenge, as recorded by the Lord
Justice Clerk, raised article 8 of the ECHR but concentrated on EU law. That
was also the appellants’ focus in this court.
69.
The intervener, Community Law Advice Network, challenges only the
information sharing provisions, arguing that they impose too low a threshold
for the disclosure of confidential information and amount to an infringement of
the article 8 rights of children and young people. As a result there was more
focus on article 8 of the ECHR in the narrower challenge than there had been in
the debates both in the Inner House and before the Lord Ordinary.
70.
In our view these challenges raise the following four questions: (i)
what are the interests which article 8 of ECHR protects in this context, (ii)
whether and in what respects the operation of the Act interferes with the
article 8 rights of parents or of children and young people, (iii) whether that
interference is in accordance with the law, and (iv) whether that interference
is proportionate, having regard to the legitimate aim pursued.
(i) The interests protected by article 8
71.
In the context of this legislation, the interests protected by article 8
include both family life and privacy. The relationship between parent and child
is an integral part of family life. As the European Court of Human Rights
(“ECtHR”) stated in, among others, Olsson v Sweden (No 1) (1989) 11 EHRR 259, “[t]he mutual enjoyment by parent and child of each other’s company
constitutes a fundamental element of family life” (para 59). Family life also
encompasses a broad range of parental rights and responsibilities with regard
to the care and upbringing of minor children, enabling parents to take
important decisions on their behalf, and article 8 protects the rights of
parents to exercise such parental authority: Nielsen v Denmark (1988) 11 EHRR 175, para 61.
72.
As is well known, it is proper to look to international instruments,
such as the UN Convention on the Rights of the Child 1989 (“UNCRC”), as aids to
the interpretation of the ECHR. The Preamble to the UNCRC states:
“the family, as the fundamental
group of society and the natural environment for the growth and wellbeing of
all its members and particularly children, should be afforded the necessary
protection and assistance so that it can fully assume its responsibilities within
the community.”
Many articles in the UNCRC acknowledge that it is the
right and responsibility of parents to bring up their children. Thus article
3(2) requires States Parties, in their actions to protect a child’s wellbeing,
to take into account the rights and duties of his or her parents or other
individuals legally responsible for him or her; article 5 requires States
Parties to respect the responsibilities, rights and duties of parents or, where
applicable, other family or community members or others legally responsible for
the child to provide appropriate direction and guidance to the child in the
exercise of his or her rights under the Convention; article 14(2) makes similar
provision in relation to the child’s right to freedom of thought, conscience
and religion; article 27(2) emphasises that the parents have the primary
responsibility to secure, within their abilities and financial capabilities,
the conditions of living necessary for the child’s development; article 18(1)
provides that:
“States Parties shall use their
best efforts to ensure recognition of the principle that both parents have
common responsibilities for the upbringing and development of the child.
Parents or, as the case may be, legal guardians, have the primary
responsibility for the upbringing and development of the child. The best
interests of the child will be their basic concern.” (Emphasis supplied)
Articles 27(3) and 18(2) make it clear that the state’s
role is to assist the parents in carrying out their responsibilities, although
article 19(1) requires the state also to take appropriate measures to protect
the child from all forms of abuse or neglect.
73.
This represents the detailed working out, for children, of the principle
established in article 16(3) of the Universal Declaration of Human Rights and
article 23(1) of the International Covenant on Civil and Political Rights that
“the family is the natural and fundamental group unit of society and is
entitled to protection by society and the state”. There is an inextricable link
between the protection of the family and the protection of fundamental freedoms
in liberal democracies. The noble concept in article 1 of the Universal
Declaration, that “all human beings are born free and equal in dignity and
rights” is premised on difference. If we were all the same, we would not need
to guarantee that individual differences should be respected. Justice Barak of
the Supreme Court of Israel has put it like this (in El-Al Israeli Airlines
Ltd v Danielowitz [1992-4] IsrLR 478, para 14):
“The factual premise is that
people are different from one another, ‘no person is completely identical to
another’ … Every person is a world in himself. Society is based on people who
are different from one another. Only the worst dictatorships try to eradicate
these differences.”
Individual differences are the product of the interplay
between the individual person and his upbringing and environment. Different
upbringings produce different people. The first thing that a totalitarian
regime tries to do is to get at the children, to distance them from the
subversive, varied influences of their families, and indoctrinate them in their
rulers’ view of the world. Within limits, families must be left to bring up
their children in their own way. As Justice McReynolds, delivering the Opinion
of the Supreme Court of the United States famously put it in Pierce v
Society of Sisters 268 US 510 (1925), 534-535:
“The fundamental theory of liberty
upon which all governments in this Union repose excludes any general power of
the state to standardize its children by forcing them to accept instruction
from public teachers only. The child is not the mere creature of the state;
those who nurture him and direct his destiny have the right, coupled with the
high duty, to recognize and prepare him for additional obligations.”
74.
Thus it is not surprising that the ECtHR, in Neulinger and Shuruk v
Switzerland (2012) 54 EHRR 31, interpreted article 8 in the context, among
other instruments, of the UNCRC and explained the concept of the child’s best
interests in this way:
“The child’s interest comprises
two limbs. On the one hand, it dictates that the child’s ties with its family
must be maintained, except in cases where the family has proved particularly
unfit. It follows that family ties may only be severed in very exceptional
circumstances and that everything must be done to preserve personal relations
and, if and when appropriate, to ‘rebuild’ the family (see Gnahoré, cited
above, para 59). On the other hand, it is clearly also in the child’s interest
to ensure its development in a sound environment, and a parent cannot be entitled
under article 8 to have such measures taken as would harm the child’s health
and development (see, among many other authorities, Elsholz v Germany (2002) 34 EHRR 58 at [50], and Maršálek v the Czech Republic, no 8153/04, [2006] ECHR 321, at [71],
4 April 2006).” (para 136)
75.
The privacy of a child or young person is also an important interest.
Article 16 of the UNCRC provides:
“1. No child shall be
subjected to arbitrary or unlawful interference with his or her privacy,
family, home or correspondence, nor to unlawful attacks on his or her honour
and reputation.
2. The child has the right
to the protection of the law against such interference or attacks.”
The concept of “private life” in article 8 covers the
disclosure of personal data, such as information about a person’s health,
criminal offending, sexual activities or other personal matters. The notion of
personal autonomy is an important principle underlying the guarantees of the
ECHR. See, for example, Gillan v United Kingdom (2010) 50 EHRR 45,
para 61.
76.
Article 8 protects confidential information as an aspect of human
autonomy and dignity: Campbell v MGN Ltd [2004] 2 AC 457, Lord Hoffmann
paras 50-51, Lady Hale para 134. Thus in Z v Finland (1998) 25 EHRR 371,
para 95, a case concerning the disclosure by a court of a person’s identity and
medical data, the ECtHR stated:
“… the protection of personal
data, not least medical data, is of fundamental importance to a person’s
enjoyment of his or her right to respect for private and family life as
guaranteed by article 8 of the Convention. Respecting the confidentiality of
health data is a vital principle in the legal systems of all the Contracting
Parties to the Convention. It is crucial not only to respect the sense of
privacy of a patient but also to preserve his or her confidence in the medical
profession and in the health services in general.
Without such protection, those in
need of medical assistance may be deterred from revealing such information of a
personal and intimate nature as may be necessary in order to receive
appropriate treatment and, even, from seeking such assistance, thereby
endangering their own health and, in the case of transmissible diseases, that
of the community.
The domestic law must therefore
afford appropriate safeguards to prevent any such communication or disclosure
of personal health data as may be inconsistent with the guarantees in article 8
of the Convention.” (para 95)
77.
More recently, in a case concerning a complaint that a hospital had
failed to guarantee the security of a person’s data against unauthorised
access, the ECtHR repeated that statement and again confirmed that the
processing of information relating to an individual’s private life comes within
the scope of article 8 and that personal information relating to a patient
“undoubtedly belongs to his or her private life”: I v Finland (2009) 48 EHRR 31, paras 35-38. Similarly, the Court of Justice of the European Union in
X v Commission [1994] ECR I-4737 has opined (para 17) that the right to
respect for private life, embodied in article 8, “includes in particular a
person’s right to keep his state of health secret”.
(ii) Whether Part 4 of the 2014 Act interferes with
article 8 rights
78.
The provisions of Part 4 of the 2014 Act by which the state may
intervene in family life and private life engage article 8. But, while article
8 is engaged, not all that may be done under Part 4 would involve an
interference with a person’s article 8 rights. There are elements of the role
of the named person which are unlikely, by themselves, to involve any
interference with the right of a parent, child or young person to respect for
his or her private and family life. Thus, by themselves, the functions in
section 19(5)(a)(i) and (ii) of providing advice, information and support and
helping the parent, child or young person to access a service or support would
not normally constitute an interference with the article 8 rights of either the
child or his or her parents. But it is clear from the consultation paper, “A
Scotland for Children” and the Policy Memorandum, which we discussed in paras 1
to 3 above, that the sharing of personal data between relevant public
authorities is central to the role of the named person. As we have explained,
this may well constitute an interference with the article 8 rights of those to
whom the information relates. We are therefore satisfied that the operation of
the information-sharing provisions of Part 4 (in particular, sections 23, 26
and 27) will result in interferences with rights protected by article 8 of the
ECHR. The question therefore arises whether such interferences can be justified
under article 8(2).
(iii) In accordance with the law
79.
In order to be “in accordance with the law” under article 8(2), the
measure must not only have some basis in domestic law - which it has in the
provisions of the Act of the Scottish Parliament - but also be accessible to
the person concerned and foreseeable as to its effects. These qualitative
requirements of accessibility and foreseeability have two elements. First, a
rule must be formulated with sufficient precision to enable any individual - if
need be with appropriate advice - to regulate his or her conduct: Sunday
Times v United Kingdom (1979) 2 EHRR 245, para 49; Gillan v United
Kingdom (2010) 50 EHRR 1105, para 76. Secondly, it must be sufficiently
precise to give legal protection against arbitrariness:
“it must afford a measure of legal
protection against arbitrary interferences by public authorities with the
rights safeguarded by the Convention. In matters affecting fundamental rights
it would be contrary to the rule of law … for a legal discretion granted to the
executive to be expressed in terms of an unfettered power. Consequently, the
law must indicate with sufficient clarity the scope of any discretion conferred
on the competent authorities and the manner of its exercise. The level of
precision required of domestic legislation - which cannot in any case provide
for every eventuality - depends to a considerable degree on the content of the
instrument in question, the field it is designed to cover and the number and
status of those to whom it is addressed.” Gillan v United Kingdom, para
77; Peruzzo v Germany (2013) 57 EHRR SE17, [2013] ECHR 743, para 35.
80.
Recently, in R (T) v Chief Constable of Greater Manchester Police [2015] AC 49 this court has explained that the obligation to give protection against
arbitrary interference requires that there must be safeguards which have the
effect of enabling the proportionality of the interference to be adequately
examined. This is an issue of the rule of law and is not a matter on which
national authorities are given a margin of appreciation.
81.
In deciding whether there is sufficient foreseeability to allow a person
to regulate his or her conduct and sufficient safeguards against arbitrary
interference with fundamental rights, the court can look not only at formal
legislation but also at published official guidance and codes of conduct: Silver
v United Kingdom (1983) 5 EHRR 347 (paras 88-90); Gillan v United
Kingdom (paras 35, 36 and 78) and MM v United Kingdom (Application
no 24029/07, [2012] ECHR 1906). In R (Roberts) v Comr of Police of the Metropolis [2015] UKSC 79; [2016] 1 WLR 210 this court took into account as constraints on the
power of the police to stop and search not only the limits on that power in
section 60 of the Criminal Justice and Public Order Act 1994 and the legal
protection provided by both section 6 of the Human Rights Act 1998 and the
Equality Act 2010, but also the requirements of the Metropolitan Police’s
Standard Operating Procedures. That statutory document, which was published on
the Metropolitan Police’s website, regulated the authorisation of stop and
search, the operation and also the individual encounter between a police
officer and a member of the public on the street. In relation to the exercise
on the street of the stop and search power it not only gave officers detailed
instructions, which were designed to ensure their proportionate use of such
power, but also required them to explain to the individual who was to be
searched the reason for the search, to record that reason in writing and make
available to the affected individual a copy of that written record. These
provided adequate safeguards to enable the courts to examine the
proportionality of any interference with fundamental rights: see the judgment
of Lady Hale and Lord Reed at paras 43-48.
82.
Thus in assessing whether Part 4 of the 2014 Act is “in accordance with
the law” this court has been invited to take into account not only the terms of
the Act but also, proleptically, the RDSG, which we have discussed in paras 18
to 25 above. As we have stated (in para 18 above), the RDSG is directed to
specified public authorities, which under section 28(1) of the Act are required
to “have regard to” it. In contrast with, for example, the Metropolitan
Police’s Standard Operating Procedures which we have mentioned, there is no
compulsion to follow the guidance. The RDSG gives very little guidance as to
the requirements of the DPA or article 8 of the ECHR but envisages that
separate practice materials will be made available to practitioners.
83.
As we explained in paras 52 to 62 above when we discussed the effect of
the Act in relation to the DPA and the Directive, the powers and duties of
disclosure set out in sections 23 and 26 cannot be taken at face value. In
several crucial respects, the scope of the duties and powers to disclose or
share information set out on the face of the Act are, in reality, significantly
curtailed by the requirements of the DPA and the Directive. To recap:
(1)
Although section 23(2)(b) purports to impose on the outgoing service
provider a duty to provide the incoming service provider with all information
which it holds which falls within subsection (3), in reality no such duty
exists in relation to sensitive data as defined in the DPA, unless at least one
of the conditions set out in Schedule 3 to the DPA is satisfied (the conditions
set out in section 23(3)-(6) of the 2014 Act not in themselves ensuring their
satisfaction).
(2)
Although section 26(1) purports to impose on a service provider or
relevant authority (or any person exercising a function on their behalf) a duty
to provide to the service provider in relation to a child or young person any
information which the person holds which falls within subsection (2), in
reality no such duty exists in relation to sensitive data as defined in the
DPA, unless at least one of the conditions set out in Schedule 3 to the DPA is
satisfied (the conditions set out in section 26(2) and (5)-(7) of the 2014 Act
not in themselves ensuring their satisfaction).
(3)
Although section 26(3) purports to impose on the service provider in
relation to a child or young person a duty to provide to a service provider or
relevant authority (or any person exercising a function on their behalf) any
information which the person holds which falls within subsection (4), in
reality no such duty exists in relation to sensitive data as defined in the
DPA, unless at least one of the conditions set out in Schedule 3 to the DPA is
satisfied (the conditions set out in section 26(4) and (5)-(7) of the 2014 Act
not in themselves ensuring their satisfaction).
(4)
Although section 26(8) purports to confer on the service provider in
relation to a child or young person the power to provide to a service provider
or relevant authority (or any person exercising a function on their behalf) any
information which the person holds which falls within subsection (9), in
reality no such power can lawfully be exercised unless the requirements of the
DPA are satisfied (the condition set out in section 26(9) of the 2014 Act not
in itself ensuring their satisfaction). Those requirements include, but are not
limited to, compliance with at least one of the conditions in Schedule 2 to the
DPA, and also, if the information in question is sensitive data, compliance
with at least one of the conditions in Schedule 3. They also include compliance
with the requirements arising in relation to the first data principle under
Part II of Schedule 1 to the DPA, and also the other data protection principles
and the other duties imposed by the DPA.
That is not a comprehensive account of the requirements
imposed by the DPA: as explained above, those requirements were not fully
discussed at the hearing of the appeal. The relationship between the Act and
the DPA is rendered particularly obscure by what we have described as the
logical puzzle arising from sections 23(7) and 26(11) when read with section
35(1) of the DPA. It is also necessary to ensure that the requirements of
articles 7 and 8 of the Directive are met, so far as information falls within
its scope. There are thus very serious difficulties in accessing the relevant
legal rules when one has to read together and cross refer between Part 4 of the
Act and the DPA and work out the relative priority of their provisions.
84.
Of even greater concern is the lack of safeguards which would enable the
proportionality of an interference with article 8 rights to be adequately
examined. Section 26(5) requires an information holder, when considering
whether information ought to be provided in the exercise of the duties in
section 26(1) or (3), “so far as reasonably practicable to ascertain and have
regard to the views of the child or young person”. But there is no such
requirement in relation to a service provider’s discretionary power to share information
under section 26(8). There the test is merely that the provision of the
information is necessary or expedient for the purposes of the exercise of any of
the named person functions. Moreover, there is no statutory requirement,
qualified or otherwise, to inform the parents of a child about the sharing of
information. The RDSG is only guidance, speaks of “routine good practice”, and
leaves it to the discretion of the information holder whether to involve the
parent or parents. It is thus perfectly possible that information, including
confidential information concerning a child or young person’s state of health (for
example, as to contraception, pregnancy or sexually transmitted disease), could
be disclosed under section 26 to a wide range of public authorities without
either the child or young person or her parents being aware of the interference
with their article 8 rights, and in circumstances in which there was no
objectively compelling reason for the failure to ascertain and have regard to
their views. While para 10.14.2 of the RDSG advises that a record should be
kept of the rationale behind a decision to share information, such a record
will not assist a child, young person or parent who is not informed that the
information is to be or has been shared.
85.
We conclude therefore that the information-sharing provisions of Part 4
of the Act and the RDSG as currently drafted do not meet the article 8
criterion of being “in accordance with the law”.
(iv) Whether the interference is proportionate
86.
The fourth question is whether Part 4 of the Act, when considered along
with section 6 of the Human Rights Act 1998, the DPA and the RDSG, will give
rise to interferences with the article 8 rights of children, young persons or
parents which are proportionate, having regard to the legitimate aim pursued.
87.
In assessing proportionality it is necessary to distinguish between the
Act itself and its operation in individual cases. The Act gives the named
person three principal functions in section 19(5). As we have said (para 78
above), the first two would not normally constitute an interference with the
right to respect for private or family life. The third, which itself involves
the sharing of information, may more readily do so. The information-sharing
provisions in sections 23, 26 and 27 are, as we have said, limited by the DPA,
particularly in relation to the disclosure of sensitive personal data. Separately,
the operation of the Act in individual cases will involve the exercise of
powers in many different circumstances which may entail more or less serious
interferences with private and family life and which may provide stronger or
weaker justification for such interference.
88.
This court has explained that an ab ante challenge to the validity of
legislation on the basis of a lack of proportionality faces a high hurdle: if a
legislative provision is capable of being operated in a manner which is
compatible with Convention rights in that it will not give rise to an
unjustified interference with article 8 rights in all or almost all cases, the
legislation itself will not be incompatible with Convention rights: R (Bibi)
v Secretary of State for the Home Department [2015] UKSC 68; [2015] 1 WLR 5055, paras 2 and 60 per Lady Hale, para 69 per Lord Hodge. The proportionality
challenge in this case does not surmount that hurdle. Nonetheless, it can
readily be foreseen that in practice the sharing and exchange of information
between public authorities are likely to give rise to disproportionate
interferences with article 8 rights, unless the information holder carries out
a scrupulous and informed assessment of proportionality.
89.
In their submissions, the Ministers treated the promotion of children’s
wellbeing as being in itself a legitimate aim under article 8. They relied on
international instruments in which the term “wellbeing” is used, although
possibly not in quite as wide a sense as in the 2014 Act. For example, article
3(2) of the UNCRC provides:
“States Parties undertake to
ensure the child such protection and care as is necessary for his or her wellbeing,
taking into account the rights and duties of his or her parents, legal
guardians, or other individuals legally responsible for him or her, and, to
this end, shall take all appropriate legislative and administrative measures.”
Similarly, article 24(1) of the EU Charter of Fundamental
Rights (“CFR”) provides:
“Children shall have the right to
such protection and care as is necessary for their wellbeing …”
The promotion of the wellbeing of children and young
people is not, however, one of the aims listed in article 8(2) of the ECHR. At
the most general level, it can be said to be linked to the economic wellbeing
of the country, as the Ministers’ submissions emphasised. The extent to which
an individual intervention is likely to promote the achievement of such a
general aim is however very limited. Individual interventions may make a
greater contribution towards achieving other legitimate aims, such as the
prevention of disorder or crime, or the protection of health or morals, depending
on the circumstances. However, the more tenuous the link between the objective
pursued by the intervention (eg that a child or young person should be
“achieving, nurtured, active, respected, responsible and included”) and the
achievement of one of the legitimate aims listed in article 8(2), the more
difficult it will be to justify a significant interference with the
individual’s private and family life. For example, if (contrary to our view)
the 2014 Act as currently enacted had enabled the disclosure of sensitive
personal data without the consent of the affected party, the disclosure by
health professionals of information that a young person was being prescribed
contraceptives or had contracted a sexually transmitted disease would be a
major interference with private life which could only be justified on very
compelling grounds.
90.
It is now the standard approach of this court to address the following
four questions when it considers the question of proportionality:
(i)
whether the objective is sufficiently important to justify the
limitation of a protected right,
(ii)
whether the measure is rationally connected to the objective,
(iii)
whether a less intrusive measure could have been used without
unacceptably compromising the achievement of the objective, and
(iv)
whether, balancing the severity of the measure’s effects on the rights
of the persons to whom it applies against the importance of the objective, to
the extent that the measure will contribute to its achievement, the former
outweighs the latter (ie whether the impact of the rights infringement is
disproportionate to the likely benefit of the impugned measure).
See Huang v Secretary of State for the Home Department
[2007] UKHL 11; [2007] 2 AC 167, para 19 per Lord Bingham of Cornhill; R
(Aguilar Quila) v Secretary of State for the Home Department [2011] UKSC 45; [2012] 1 AC 621, para 45 per Lord Wilson; Bank Mellat v HM Treasury (No
2) [2013] UKSC 39; [2014] AC 700, para 74 per Lord Reed; and R (Bibi) v Secretary
of State for the Home Department [2015] UKSC 68; [2015] 1 WLR 5055, para 29
per Lady Hale.
91.
As to the first of those questions, it can be accepted, focusing on the
legislation itself rather than on individual cases dealt with under the
legislation, that Part 4 of the 2014 Act pursues legitimate aims. The public
interest in the flourishing of children is obvious. The aim of the Act, which
is unquestionably legitimate and benign, is the promotion and safeguarding of
the wellbeing of children and young persons. As the Dean of Faculty submitted,
the policy of promoting better outcomes for individual children and families is
not inconsistent with the primary responsibility of parents to promote the
wellbeing of their children. Improving access to, and the coordination of,
public services which can assist the promotion of a child’s wellbeing are
legitimate objectives which are sufficiently important to justify some
limitation on the right to respect for private and family life.
92.
Secondly, Part 4 of the Act is rationally connected to the legitimate
aims pursued. As the Scottish Government’s consultation paper, “A Scotland for
Children” showed, the aims of the legislation are to move public bodies with
responsibility for children towards early intervention to promote children’s
wellbeing rather than only responding to a serious occurrence and to ensure
that those public bodies collaborated and shared relevant information
concerning the wellbeing of individual children. As the Second Division stated
(para 63), the named person is at the heart of the Scottish Government’s proposals.
That person is tasked with advising on the wellbeing of a child, helping a
child or parent to access a service or support, and being the single point of
contact for public services in relation to the child in order to promote,
support or safeguard the child’s wellbeing.
93.
The third question (whether a less intrusive measure could have been
used) does not involve a court in identifying the alternative legislative measure
which was least intrusive. The court allows the legislature a margin of
discretion and asks whether the limitation on the fundamental right is one
which it was reasonable for the legislature to impose: Bank Mellat v HM
Treasury (No 2), para 75. If, as the appellants submitted in their broader
challenge, a named person should be appointed in relation to a child only if
the parents consented or, absent such consent, if the appointment was necessary
to protect the welfare of a child who was at risk of harm, the scope for early
intervention to resolve problems and for the coordination of public services in
support of a child’s wellbeing would be diminished. Separate questions will
arise as to whether, in an individual case, early intervention and coordination
of services could be achieved by less intrusive means. That issue can be
considered under the final question of fair balance.
94.
The fourth question is whether the impact of the rights infringement may
be disproportionate to the likely benefit of the impugned measure. This
requires consideration of the operation of Part 4 of the Act in particular
cases, since it cannot be said that its operation will necessarily give rise to
disproportionate interferences in all cases. In that regard, the named person’s
functions to give advice, information and support (section 19(5)(a)(i)) and to
help the child, young person or parent to access a service or support (section
19(5)(a)(ii)) are, as we have said, less likely to give rise to any question of
disproportion in a particular case. The provision of access to services could
involve the creation of a child’s plan under Part 5 of the Act, but that
involves no compulsion. The Act does not alter the statutory criteria of any
compulsory measures in relation to children and young people. Thus the criteria
for making a child assessment order in section 36(2) or a child protection
order in sections 38 and 39 of the Children’s Hearings (Scotland) Act 2011
require (put shortly) reasonable grounds to suspect that the child is likely to
suffer significant harm. The long list of grounds upon which a child may come
before a children’s hearing with a view to making a compulsory supervision
order (which can include taking the child away from home) in section 67 of that
Act remain focused upon the risk of harm to the child or the child’s own
misconduct.
95.
Nevertheless, there must be a risk that, in an individual case, parents
will be given the impression that they must accept the advice or services which
they are offered, especially in pursuance of a child’s plan for targeted
intervention under Part 5; and further, that their failure to co-operate with
such a plan will be taken to be evidence of a risk of harm. An assertion of
such compulsion, whether express or implied, and an assessment of
non-cooperation as evidence of such a risk could well amount to an interference
with the right to respect for family life which would require justification
under article 8(2). Given the very wide scope of the concept of “wellbeing” and
the SHANARRI factors, this might be difficult. Care should therefore be taken
to emphasise the voluntary nature of the advice, information, support and help
which are offered under section 19(5)(a)(i) and (ii) and the Guidance should
make this clear.
96.
The function, in section 19(5)(a)(iii), of discussing or raising a matter
about a child or young person with a service provider or relevant authority,
involves the disclosure of information. It and the information-sharing
provisions in sections 23, 26 and 27 raise difficult questions of
proportionality in particular cases, where the information holder, when
considering whether the information ought to be provided (section 26(2)(b) and
(4)(b)) or whether to provide information under section 26(8), will have to
consider carefully whether the particular circumstances justify the disclosure of
the particular information. In our view, given this role of the information
holder, it cannot be said that the operation of the information-sharing duties
and powers in relation to any of the named person’s functions will necessarily
amount to a disproportionate interference with article 8 rights. But for the
problem in relation to the requirement that the Act be “in accordance with the
law” (paras 79-85 above), we consider that the Act would be capable of being
operated in a manner which is compatible with the Convention rights.
97.
But the task facing the information holder is a daunting one because the
Act does not address the factors to be considered in an assessment of
proportionality and the RDSG gives exiguous guidance on that issue. The
provisions of the Act appear to point toward a more relaxed approach to disclosure
than is compatible with article 8. Section 26(1) and (3) oblige the information
holder to provide information which meets the criteria set out in subsections
(2) and (4). Those criteria include an assessment of whether the information is
likely to be relevant to the exercise of functions which may affect the
wellbeing of the child or young person. In turn, the assessment of that
wellbeing under section 96, as explained by the RDSG, involves the use of very
broad criteria which could trigger the sharing of information by a wide range
of public bodies (as to which see para 5 above) and also the initiation of
intrusive inquiries into a child’s wellbeing. In our view, the criteria in
sections 23(3), 26(2) and 26(4) by themselves create too low a threshold for disclosure
(as explained at para 56 above), and for the overriding of duties of
confidentiality in relation to sensitive personal information.
98.
Under sections 23(4) and 26(5) the information holder, when deciding
whether information ought to be provided under sections 23(2) and 26(1) or (3),
is obliged so far as is reasonably practicable to ascertain and have regard to
the views of the child or young person. But those provisions do not require
that person’s consent, or require that there be any good reason for dispensing
with her consent, before what may be highly personal information, imparted in
confidence, is shared. Further, the information holder is under no obligation
to ascertain the views of the child or young person, or her parents, when
exercising a discretion under section 26(8), in which the test is whether the
provision of the information is considered to be “necessary or expedient” for
the purposes of the exercise of any of the named person functions. Thus the
exercise of the section 26(8) power could involve the overriding of duties of
confidentiality without any obligation even to consult the child, young person
or parent. The RDSG (at paras 4.1.28 and 10.7.4) presents such consultation as
good practice but it is not obligatory, even on a qualified basis. Further,
there is no provision imposing even a qualified requirement that the child or
young person or her parents be warned that confidential information may be disclosed,
or informed after the event that it has been shared.
99.
In many circumstances the Act’s intended overriding of the duty of confidentiality
may not be achieved. In our discussion of reserved matters (paras 27 to 66
above) we showed that, because of the terms of sections 23(7) and 26(11), the
DPA and the Directive impose significant restrictions on the ability of public
authorities in the performance of their duties under sections 23(2), 26(1) and
(3) to share information which is “sensitive personal data”, such as
information about a person’s health or sexual life, without the explicit
consent of the data subject. We showed that, for the same reasons, the power under
section 26(8) to share information remains subject to all of the restrictions
of the DPA against disclosure, thus normally requiring consent of the data
subject, in relation also to non-sensitive personal data. Thus some of the
concerns of the appellants and the interveners in relation to the criteria for
the sharing of information are, on a proper interpretation of the legislation,
addressed by the continued operation of the DPA and the Directive, which in many
cases will require the consent of the data subject to the sharing of the
information.
100.
Nonetheless, there may be information which is not “sensitive personal
data” which is nonetheless confidential. Even with the restrictions of the DPA,
the Act does not point towards a fair balance in relation to the disclosure of
such confidential information in the performance of duties under sections
23(2), 26(1) and 26(3). The central problems are the lack of any requirement to
obtain the consent of the child, young person, or his or her parents to the
disclosure, the lack of any requirement to inform them about the possibility of
such disclosure at the time when the information is obtained from them, and the
lack of any requirement to inform them about such disclosure after it has taken
place. Such requirements cannot, of course, be absolute: reasonable exceptions
can be made where, for example, the child is unable to give consent, or the
circumstances are such that it would be inappropriate for the parents’ consent
to be sought, or the child’s best interests might be harmed. But, without such
safeguards, the overriding of confidentiality is likely often to be
disproportionate.
101.
In order to reduce the risk of disproportionate interferences, there is
a need for guidance to the information holder on the assessment of
proportionality when considering whether information should be provided. In
particular, there is a need for guidance on (a) the circumstances in which
consent should be obtained, (b) those in which such consent can be dispensed
with and (c) whether, if consent is not to be obtained, the affected parties
should be informed of the disclosure either before or after it has occurred. Also
relevant is whether the recipient of the information is subject to sufficient
safeguards to prevent abuse: MS v Sweden (1999) 28 EHRR 313. Further, if
the guidance is to operate as “law” for the purposes of article 8, the
information holder should be required to do more than merely have regard to it.
III The EU Law challenge
102.
The appellants also challenge the information-sharing provisions of
sections 26 and 27 of the Act on the ground that they are incompatible with EU
law. Counsel referred to the following articles of the CFR: article 7 (respect
for private and family life), article 8 (protection of personal data), article
14 (right to education) - particularly 14(3): respect for the right of parents
to ensure that the education of their children conforms with their convictions
- and article 33(1) (family and professional life). In short, they submitted
that the sharing of personal data without consent and absent strict necessity
infringed one or more of those articles of the CFR.
103.
It is not suggested that the DPA fails to transpose the Directive or is
contrary to the CFR. In so far as the appellants’ complaint relates to the sharing
of what the DPA describes as “sensitive personal data”, we have, in large
measure in agreement with the Inner House and the Lord Ordinary, interpreted
the relevant provisions of the DPA and the 2014 Act as preserving the stringent
restrictions in Schedule 3 to the DPA and having the effect that condition
7(1)(b) of Schedule 3 is not met (paras 49 to 58 above). In so far as the DPA
allows the 2014 Act to authorise the disclosure of (non-sensitive) personal
data which are not subject to any duty of confidentiality, we do not see a
separate issue arising under EU law.
104.
In so far as the challenge relates to the over-riding of confidentiality
of personal data (whether or not sensitive), we have addressed this in our
discussion of article 8 of the ECHR. In Volker und Marcus Schecke GbR and
Hartmut Eifert v Land Hessen (Cases C-92/09 and C-93/09) [2010] ECR I-11063, the Court of Justice of the European Union (Grand Chamber) held (para
52) that the limitations which may lawfully be placed on the right to the protection
of personal data correspond to those tolerated in relation to article 8 of the
ECHR. We are therefore satisfied that there is no additional incompatibility
with EU law beyond that which we have found in relation to article 8 of the
ECHR.
105.
The appellants also submit that the Act contravenes EU law because there
is no provision enabling a parent or child to seek the removal of information
concerning a child from a named person’s database once the data are no longer
needed for the purposes for which they were collected or processed. Reference
was made to Google Spain SL v Agencia Española de Protección de Datos (Case
C-131/12) [2014] QB 1022, paras 93-97. We do not accept this submission.
In our view the data retained by public authorities in the exercise of powers
under the Act are subject to the fifth data protection principle in Part I of
Schedule 1 to the DPA, namely that “personal data processed for any purpose or
purposes shall not be kept for longer than is necessary for that purpose or those
purposes”. This is because this provision is not inconsistent with the
disclosure which sections 23(2), 26(1) and 26(3) of the 2014 Act allows: DPA
section 27(3) & (4) (paras 53 and 54 above). Part V of the DPA empowers the
Information Commissioner, whether at the request of a data subject or
otherwise, to enquire into a data controller’s compliance with the data
protection principles. Under section 40 of the DPA, the Information
Commissioner is empowered to serve an enforcement notice on a data controller
to require such compliance. The DPA thus has protections for a data subject,
who can also, if necessary, seek judicial review of a decision of the
Information Commissioner. In our view, the data subject is thereby given a
legal remedy and judicial protection as required by Schrems v Data
Protection Comr (Case C-362/14) [2016] QB 527, para 95.
IV Remedy
106.
In summary, we conclude that the information-sharing provisions of Part
4 of the Act (a) do not relate to reserved matters, namely the subject matter of
the DPA and the Directive, (b) are incompatible with the rights of children,
young persons and parents under article 8 of the ECHR because they are not “in
accordance with the law” as that article requires, (c) may in practice result
in a disproportionate interference with the article 8 rights of many children,
young persons and their parents, through the sharing of private information,
and (d) are not incompatible with EU law in any way which goes beyond their
incompatibility with article 8 of the ECHR. We are satisfied that it is not
possible to remedy this defect by reading down the provisions under section 101
of the Scotland Act 1998. Conclusion (b) therefore means that the
information-sharing provisions of Part 4 of the Act are not within the legislative
competence of the Scottish Parliament.
107.
It would not be appropriate for this court to propose particular
legislative solutions. But we can properly say the following. We do not think
that amendment of the RDSG will get round the problem in conclusion (b) or be
sufficient in itself to prevent many instances of disproportionate interference
to which we refer in conclusion (c). Section 28 requires the specified public
authorities merely to have regard to the guidance. In relation to conclusion
(b), it is necessary to address the lack of clarity as to the relationship
between the Act and the DPA, arising from the conflict between the provisions
of sections 23, 26 and 27 of the Act and the non-disclosure provisions of the
DPA, and, in particular, the confusion caused by sections 23(7) and 26(11) when
read together with provisions of the DPA such as section 35(1). Further, in
relation to conclusion (c), the Act, subordinate legislation, or binding “guidance”,
should address the circumstances in which (i) the child, young person or parent
should be informed of the sharing of information or (ii) consent should be
obtained for the sharing of information, including confidential information. If
the resolution of the problem in conclusion (b) leads to the authorisation of
the disclosure of sensitive personal data, the problem identified in conclusion
(c) will become even more acute as the sharing of such data will require a
compelling justification. In short, changes are needed both to improve the
accessibility of the legal rules and to provide safeguards so that the
proportionality of an interference can be challenged and assessed. The
reconsideration of the terms of the Act and the RDSG also provides an
opportunity to minimise the risk of disproportionate interferences with the
article 8 rights of children, young persons and parents. Consideration of these
matters will involve policy questions which are the responsibility of the
Scottish Ministers and the democratic legislature.
108.
Section 102 of the Scotland Act 1998 provides:
“(1) This section applies
where any court or tribunal decides that -
(a) an Act of the Scottish
Parliament or any provision of such an Act is not within the legislative
competence of the Parliament …
(2) The court or tribunal
may make an order -
…
(b) suspending the effect
of the decision for any period and on any conditions to allow the defect to be
corrected.”
109.
We are of the view that this court should consider making an order under
section 102(2)(b) of the Scotland Act 1998 to allow the Scottish Parliament and
the Scottish Ministers an opportunity, if so advised, to correct the defects
which we have identified. We do not think that it is appropriate to set out the
possible terms of such an order until we have received written submissions from
the parties on the terms of the order, including both the period of suspension
and any conditions which should be attached to the order. As was said in Salvesen
v Riddell 2013 SC (UKSC) 236, [2013] UKSC 22 (Lord Hope at para 57), if such an order is
made, it may be appropriate to give permission to the Lord Advocate to return
to the court for any further orders under section 102(2)(b) as may be required.
The court which is best placed to make such further orders may be the Court of
Session. In the meantime, since the defective provisions are not within the
legislative competence of the Parliament, they cannot be brought into force.
Conclusion
110.
We would allow the appeal and invite the parties to produce written
submissions on the terms of a section 102 order within 42 days of the date of
this judgment.
