The interaction between Freedom of Information legislation (FOI) and data protection is a difficult one. One regime seeks to foster openness whilst the other is aimed at protecting personal privacy.
The interaction between the two regimes is highlighted when dealing with release of statistical information. On the face of it anonymised statistics would not be personal data as there are no identifying factors. However personal data is defined in the Data Protection Act 1998 as "data which relate to a living individual who can be identified (a) from those data, or (b) from those data, and other information which is in the possession of … the data controller". It is the second arm of this definition that has caused difficulty for public bodies when dealing with statistics.
An early 2005 decision highlighted this issue. Mr Michael Collie asked the Common Services Agency (CSA) for certain childhood leukaemia statistics broken down by postcode sector. The Scottish Information Commissioner (SIC) upheld the decision of the CSA to withhold the information on the grounds that it was covered by the personal data exemption, even although it was statistical information. The reasoning for this was that in some cases the geographical area was so small that it would be obvious who the data referred to, as there were only a few people in that postcode of the right age. However the SIC did order that the information be disclosed in a manipulated format that supposedly removed the possibility of it being personal data. The CSA disagreed with this approach and ultimately appealed it to the House of Lords.
The House of Lords held that the SIC had not fully considered whether or not the manipulated data could still be personal data and ordered the SIC to reconsider. The SIC's revised Collie decision was published in late May. The SIC is of the view that the manipulated information is personal data but has held that the CSA must provide the information in a way that does not contravene the data protection principles. Here the SIC has ordered the CSA to provide the total information for the whole of the health board area on the basis that no individuals could be identified even with the assistance of the original information.
This decision reflects the view of Lord Hope in the House of Lords who was of the view that the manipulated information would be personal data if, on its own, or together with other information held by the CSA they enable a living individual(s), to whom the data relates, to be identified. The SIC felt this applied equally in looking at any aggregation of these statistics to the whole of the Dumfries and Galloway Health Board area. For the aggregated statistics to be personal data then the other information held by the CSA would allow the individuals to be identified. Here the level of aggregation meant that specific individuals could not be identified even with the assistance of the original information.
More recently three housing associations had requested information about the numbers of sex offenders in certain postcodes. The Chief Constable of Strathclyde Police had withheld the information on the basis that it was personal data. The SIC upheld the decision to withhold disclosure and focused upon the fact that although the information did not identify specific sex offenders it could, when linked with other information in the public domain, lead to identification. The housing associations did not agree with this view and appealed to the Court of Session. The Court's judgement was also published in May.
Here the main issue was with the SIC decision that this statistical information was personal data. The Court was of the view that it was "not clear from the decision letter why the disclosure of a statistic that in a particular district the number of resident RSOs was four or fourteen or fifty would lead to the identification of the individuals in question or what other information when taken with these statistics would reasonably allow for identification." The Court has ordered the SIC to reconsider his reasons for deciding that this was personal data. In light of the new Collie decision it will be interesting to see if the SIC's view changes.
The UK Information Commissioner ("ICO") has also had to deal with these issues in a case on abortion statistics. This is obviously an important issue and we are likely to see the case law, and views of both the SIC and ICO, develop.