The ruling confirms that the Scottish Information Commissioner
was correct to order the release of information from the NHS's
Common Services Agency (CSA).
Michael Collie made a request on behalf of Chris Ballance, a
member of the Scottish Parliament, for information about the number
of cases of child leukaemia in Dumfries and Galloway broken down by
census ward.
The CSA refused the information on the basis that the numbers
involved were so small that providing it would risk indirect
identification of the individuals involved.
Collie referred the case to Scottish Information Commissioner
Kevin Dunion who ruled that the information could be released as
the information requested was not personal data under the Data
Protection Act.
The CSA uses a method called 'Barnardisation', which is designed
to allow the release of data in a way that does not identify
individuals. This is a system of random modification which adds
zero, plus one or minus one to the numbers two, three and four and
zero or one to the number one when they appear in a database. Named
after George Barnard, founding Professor of Statistics at Essex
University, Barnardisation is designed to disguise people's
identities when information consists of such low numbers.
The CSA appealed the Commissioner's ruling to the Court of
Session where the Lord President presided. That court ruled that
the Commissioner's judgment was correct.
"I have come to the view that a table setting out the census
ward data for 1990-2001 for the Dumfries and Galloway postal area,
barnardised in the manner described, would not constitute personal
data of any of the children resident in Dumfries and Galloway who
had in a relevant year been diagnosed with leukaemia," said the
judgment.
"Although the underlying information concerns important
biographical events of the children involved, by the stage of the
compilation of the barnardised table that information has become
not only statistical but perturbed to minimise the risk of
identification of any individual child. It is no longer, in respect
of any child, 'biographical in a significant sense'," it said. "The
rights to privacy of the individual children are not infringed by
the disclosure of the barnardised data."
The case involved the seemingly competing demands of freedom of
information legislation and data protection laws. It is thought
that a major proportion of cases going to the Scottish Information
Commissioner relate to the interaction between FOI and data
protection legislation.
Daradjeet Jagpal, a lawyer specialising in data protection at
Pinsent Masons, the law firm behind OUT-LAW, said this was the
first application in Scotland of a principle established in Michael
Durant's case against the Financial Services Authority.
"Public authorities need to be conscious of the crucial
interface between Data Protection and Freedom of Information,
balancing the public's right to know with the individual's right to
privacy," said Jagpal. "This case may well mark the first of
many."
“I am pleased at this landmark decision," said Dunion. "The
Court has confirmed that authorities should not take a narrow view
of what information should be provided and has concluded that I
have a wide discretion to specify the form in which information
should be released."
"In this case I accepted that raw data should not be released,
but I concluded that the authority could and should provide
information in a modified form," he said. "This would at least give
some indication of the incidence of childhood leukaemia without any
risk to patient confidentiality.”
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
