|
Notes:
|
Reported as [2013] AACR 14.
Data protection – the meaning of “personal data” – when does disclosure contravene the Data Protection principles
In 2008 a journalist asked the Council for details of all the disciplinary action it had taken against any of its employees during the previous three years. The Council’s reply confirmed the numbers involved, including those who were dismissed, but omitted details of the actual disciplinary action and the reasons for the dismissals, stating that it had done so in accordance with section 40 of the Freedom of Information Act 2000 (FOIA). Following a request for an internal review, the Council upheld its decision as being in accordance with section 38, as well as section 40(2), of the FOIA. The journalist complained to the Information Commissioner (IC). The Council provided the IC with two schedules, both of which contained details of the disciplinary action which had been taken, but the second, or summary, schedule omitted the date of the disciplinary action and details of the employees (their gender, job title and department). The Council initially intended to send the summary schedule to the journalist but, following legal advice, it decided not to do so. The IC issued a decision notice and among other things he decided that the original schedule would contravene the First Data Protection principle and therefore was exempt from disclosure under the FOIA, but he ordered the Council to send the summary schedule to the applicant, as he believed any personal data it contained were fully anonymous. The Council appealed to the First-tier Tribunal (F-tT) which upheld its appeal, deciding, as well as other matters, that the summary schedule constituted personal data under the Data Protection Act 1998 (DPA) and so was exempt from disclosure. The IC was granted permission to appeal to the Upper Tribunal. Among the issues before the Upper Tribunal was whether the second schedule contained “personal data” and, if so, whether its disclosure would contravene any of the Data Protection principles.
Held, dismissing the appeal, that:
1. the interpretation given by Cranston J in R (on the application of the Department of Health) v Information Commissioner [2011] EWHC 1430 to the decision of the House of Lords in Common Services Agency v Scottish IC [2008] UKHL 47; [2008] 1 WLR 1550 was definitive and the proper approach to the question of whether anonymised information was personal data within section 1(1)(b) of the Data Protection Act 1998, for the purposes of a disclosure request, was to consider whether an individual or individuals could be identified from it, and other information which was in the possession of, or likely to come into the possession of, the recipient after it had been disclosed (paragraphs 49 to 53);
2. the precise definition of personal data in section 1(1)(b) of the DPA 1998 concerns data in relation to a living individual who could be identified from it and any other information which is in the possession of, or likely to come into the possession of, the data controller. But despite the apparent restriction of the wording in section 1(1)(b) it was possible for the definition to be satisfied on the basis that a living individual could be identified from data linked to other information which was in the possession of (or likely to come into the possession of) persons other than the data controller. It was appropriate to interpret section 1(1)(b) in harmony with the principles set out in Recital 26 of the preamble to Directive 95/46/EC, even if that has the effect of widening the ambit of that definition. The remarks of Lord Hope supported this conclusion, see [25] and [26] of Common Services Agency (paragraphs 56 to 68);
3. the F-tT correctly decided that the second schedule should not be released even though it failed to address the question as to whether, for the purposes of section 1(1)(b) of the Data Protection Act 1998, living individuals could be identified from the information contained within it together with other information which was in the possession of, or was likely to come into the possession of persons other than the data controller after disclosure (paragraph 92).
|
