Out-Law.com

5 December 2006

The Court of Session in Edinburgh has backed the Scottish Information Commissioner in the first court ruling on the Freedom of Information (Scotland) Act. The ruling backs a man's request for information from the National Health Service (NHS).

The ruling confirms that the Scottish Information Commissioner was correct to order the release of information from the NHS's Common Services Agency (CSA).

Michael Collie made a request on behalf of Chris Ballance, a member of the Scottish Parliament, for information about the number of cases of child leukaemia in Dumfries and Galloway broken down by census ward.

The CSA refused the information on the basis that the numbers involved were so small that providing it would risk indirect identification of the individuals involved.

Collie referred the case to Scottish Information Commissioner Kevin Dunion who ruled that the information could be released as the information requested was not personal data under the Data Protection Act.

The CSA uses a method called 'Barnardisation', which is designed to allow the release of data in a way that does not identify individuals. This is a system of random modification which adds zero, plus one or minus one to the numbers two, three and four and zero or one to the number one when they appear in a database. Named after George Barnard, founding Professor of Statistics at Essex University, Barnardisation is designed to disguise people's identities when information consists of such low numbers.

The CSA appealed the Commissioner's ruling to the Court of Session where the Lord President presided. That court ruled that the Commissioner's judgment was correct.

"I have come to the view that a table setting out the census ward data for 1990-2001 for the Dumfries and Galloway postal area, barnardised in the manner described, would not constitute personal data of any of the children resident in Dumfries and Galloway who had in a relevant year been diagnosed with leukaemia," said the judgment.

"Although the underlying information concerns important biographical events of the children involved, by the stage of the compilation of the barnardised table that information has become not only statistical but perturbed to minimise the risk of identification of any individual child. It is no longer, in respect of any child, 'biographical in a significant sense'," it said. "The rights to privacy of the individual children are not infringed by the disclosure of the barnardised data."

The case involved the seemingly competing demands of freedom of information legislation and data protection laws. It is thought that a major proportion of cases going to the Scottish Information Commissioner relate to the interaction between FOI and data protection legislation.

Daradjeet Jagpal, a lawyer specialising in data protection at Pinsent Masons, the law firm behind OUT-LAW, said this was the first application in Scotland of a principle established in Michael Durant's case against the Financial Services Authority.

"Public authorities need to be conscious of the crucial interface between Data Protection and Freedom of Information, balancing the public's right to know with the individual's right to privacy," said Jagpal. "This case may well mark the first of many."

“I am pleased at this landmark decision," said Dunion. "The Court has confirmed that authorities should not take a narrow view of what information should be provided and has concluded that I have a wide discretion to specify the form in which information should be released."

"In this case I accepted that raw data should not be released, but I concluded that the authority could and should provide information in a modified form," he said. "This would at least give some indication of the incidence of childhood leukaemia without any risk to patient confidentiality.”