Supreme Court ruling on staff pay disclosures offers 'clear guide' to all Scottish public bodies, says watchdog

Rosemary Agnew said the Court's judgment backed the watchdog's own "carefully considered conclusions" in a case relating to South Lanarkshire Council's (SLC's) handling of a freedom of information (FOI) request. (15-page / 100KB PDF)

Mark Irvine, an equal pay campaigner, had asked SLC to disclose the number of employees in a 'land service operative' post who receive salaries commensurate with 10 particular points on the Council's pay scales. In a blog, Irvine said he was seeking information about "the pay of traditional male council jobs" in order to "expose whether male council workers have been more favourably treated in recent years" compared to female colleagues. Irvine is building a legal case against SLC on behalf of around 2,500 council workers who he said may have equal pay claims.

SLC had blocked disclosure on the grounds that it would breach the principles of the Data Protection Act. It said that Irvine did not have a lawful basis for his processing of the information as he did not have a "legitimate interest in disclosure of the information and that disclosure was not necessary for the purpose of his legitimate interests", according to the ruling.

However, the Scottish Information Commissioner's Office determined that Irvine "did have a legitimate interest in obtaining the information requested" because he has a "serious, ongoing interest in equal pay matters” and it considered that disclosure of the details was "necessary" and justified to enable Irvine's legitimate interests to be met. The watchdog further determined that the information sought was a matter of "legitimate wider interest, both to employees of the Council and the wider public".

The Scottish Information Commissioner's findings were upheld by the Court of Session and now the Supreme Court has rejected a further appeal by SLC.

"While the relationship between FOI and data protection law can be complex, the Supreme Court’s ruling confirms the robustness of our approach and is a clear guide to how similar cases should be handled by Scottish public authorities," Agnew said in a statement.

Under the Freedom of Information (Scotland) Act (FOISA), information that constitutes personal data is exempt from disclosure by public authorities if disclosure would contravene data protection principles. The principles of the Data Protection Act require, among other things, the processing of personal data to be both fair and lawful and not processed unless legitimised by meeting one of a number of conditions.

The only relevant  condition under which the disclosure to Irvine could be legitimised is if it was "necessary for the purposes of the legitimate interests" pursued by organisations responsible for personal data or by a third party "except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject", under the terms of the Act.

The Scottish Information Commissioner was "entitled to reach the conclusion" that they did in the case, Lady Hale said in the Supreme Court's judgment. Disclosure would not interfere with individuals' right to privacy in relation to their salaries, she said.

Lady Hale and the four other judges sitting in the Supreme Court had reviewed the meaning of 'necessary' under the 'legitimate interests' condition of the Data Protection Act before forming their view on the case. The judges ruled that the meaning of the term can alter depending on the context of personal data processing and trigger different legal tests for determining whether that processing activity can be justified as being proportionate.

"The word 'necessary' has to be considered in relation to the processing to which it relates," Lady Hale said.

In some cases the term 'necessary' should be applied strictly in the context of its meaning under the European Convention on Human Rights (ECHR), the Court said. In other cases, so long as the provisions of the ECHR are conformed to, public authorities have an element of freedom in determining its practical meaning.

In cases where "processing would involve an interference with the data subject’s right to respect for his private life" then public authorities will generally be prohibited from interfering with this right unless doing so is "in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others", under article 8 of the ECHR, the Supreme Court said.

However, in cases where there is no interference with rights under Article 8 but an "express counterbalancing of the necessary processing against the rights and interests of the data subject" is to be considered – such as by weighing the 'legitimate interests' of FOI requesters in terms of the Data Protection Act against the rights and freedoms of individuals – then the meaning of 'necessary' does not have to be read strictly in accordance with the ECHR so long as the "the overall result is compliant" with the article 8 rules, the Court said. In those cases, if disclosure is 'reasonably' necessary, rather than 'absolutely' or 'strictly' necessary, then disclosure will be justified, it ruled.

In the case of assessing the 'necessity' of disclosing the statistical information Irvine sought, the Supreme Court said that because no one would be able to discover the identity of the staff whose pay details were being sought, it was "quite difficult to see why there is any interference with their right to respect for their private lives".

"A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim," Lady Hale said in the judgment. "Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if Mr Irvine had asked for the names and addresses of the employees concerned, not only would article 8 have clearly been engaged, but the Commissioner would have had to ask himself whether his legitimate interests could have been served by a lesser degree of disclosure."