On 8 July 2013 the United Kingdom Supreme Court heard its first appeal in a Freedom of Information case under the Freedom of Information (Scotland) Act 2002 since the functions of the Law Lords in the House of Lords transferred to the Supreme Court. The case concerned the appeal by South Lanarkshire Council agains a decision of the Inner House of the Court of Session. That appeal was brought by South Lanarkshire Council against decision notice 056/2011 issued by the Scottish Information Commissioner. The UK Supreme Court (Lady Hale sitting with Lords Kerr, Wilson, Reed and Carnworth) issued its judgment dismissing the appeal on 29 July 2013.
In Decision 056/2011 the Scottish Information Commissioner had found that South Lanarkshire Council had not been enetitled to withhold information as to the number of persons at specific points on the Council’s pay spine under section 38 of the Freedom of Information (Scotland) Act 2002. I wrote about this case when the Inner House issued its decision (also dismissing the appeal by South Lanarkshire Council), you can find out more about the case generally (and the Court of Session’s opinion) in that post.
The case is an important one for information law as it provides some important guidance on the tension between the Freedom of Information (Scotland) Act 2002 and the Data Protection Act 1998 (specifically, condition 6 of Schedule 2). It is clear from this case and others (such as Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, 2008 SC (HL) 184) that there is certainly no presumption in favour of Freedom of Information over the protections in the Data Protection Act 1998. Indeed, reading the legislation gives the opposite impression. The protections for personal data in the Freedom of Information (Scotland) Act 2002 are absolute (i.e. once they apply, that is the end of the matter).
The first data protection principle in Schedule 1 to the Data Protection Act 1998 requires that a data controller shall process personal data only in a way that is fair and lawful. The Act goes on to provide that personal data cannot be processed unless at least one of the conditions in Schedule 2 are met. The case at had concerned condition 6 in schedule 2 which permits the processing of personal data where it is necessray for the legitimate interests of the data controller or any third party. There is a qualification, in that the processing must not happen if it would be contrary to the fundamental rights of the data subject. The case centred on the correct interpretation of ‘necessary’ in condition 6 of schedule 2.
In the Supreme Court’s judgment, Lady Hale made reference to a number of decicions of the European Court of Justice which supported the view taken by the Divisional Court in Corporate Office of the House of Commons v The Information Commisisoner [2008] EWHC 1084 (Admin) that the word ‘necessary’ had to be inrepreted in light of the European Convention on Human Rights and Fundamental Freedoms 1950.
In Rechnungshof v Osterrichischer Rundfunk the European Court of Justice stated, at paragraph 68:
“the provisions of Directive 95/46, in so far as they govern the processing of personal data likely to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of fundamental rights, which, according to settled case law, form an integral part of the general principles of law whose observance the Court ensures.”
The ECJ held that if the national legislation was incompatable with Article 8, it was unable to satisfy the proportionality requirements in article 7(c) or (e) of the EC Directive 95/46 (to which the Data Protection Act 1998 gives effect to in the United Kingdom).
This approach was followed by the ECJ in Huber v Bundesrepublik Deutschland, and so in order to be compatable with the proportionality requirements in the Data Protection Directive, the processing must be compatale with Article 8 of the European Convention on Human Rights and Fundemantal Freedoms.
Lady Hale observed at paragraph 26 that the information which Mr Irvine had requested would not allow him, or anyone else, to identify the individuals in question. As such it was “quite difficult to see why there is any interference with their right to respect for their private lives.” As such, Lady Hale stated, also at paragraoh 26, that applying article 7(f) and condition 6 in their own terms was sufficient.
Delivering a final blow to the Council, Lady Hale conculded that the Scottish Information Commissioner “had applied a test that was probably more favourable to the Council than was required and certainly no less favourable.” (Paragraph 28).
So, while it was not really necessray to consider Article 8 of the European Convention on Human Rights and Fundamental Freedoms in this case due to the data subjects not being identifiable from the information requested, it is clear from the ECJ case law in lady Hale’s judgment that Article 8 is a consideration that must be taken into consideration when considering disclosing information under the Freedom of Information (Scotland) Act 2002 which is the personal information of an identifiable data subject.
prout de jure 