Case Summary and Outcome

The U.K. Supreme Court upheld the decision of the Scottish Information Commissioner that information related to the pay scales of a local council must be disclosed. The Council had refused the request from a member of a Scottish gender equality group on the grounds that disclosure would infringe its employees rights to privacy. The Court agreed with the Information Commissioner that the individual had a legitimate interest in the information and that as the Commissioner’s decision to request disclosure of the information was in conformity with Data Protection Act there was no violation of privacy.

This case analysis was contributed by Right2Info.org.

Facts

In May 2010, Mark Irvine, a member of Scottish gender equality group Action 4 Equality [para. 12], made requests under the Freedom of Information (Scotland) Act 2002 (FOISA) to the South Lanarkshire Council (the Council) regarding disclosure of information about the pay scales of their employees. Irvine sought this information so as to identify “whether the Council’s pay gradings favoured work traditionally done by men” [para. 1], and so whether the Council was complying with the Single Status (Equal Pay) Agreement. The Council refused Irvine’s request on the grounds that it believed providing this information would contravene the Data Protection Act, 1998 and that Irvine had no “legitimate interest” in the disclosure of the information. [para. 11] Irvine complained to the Scottish Information Commissioner (Commissioner), who investigated and determined that the Council should disclose the information. The Commissioner found that Irvine had a legitimate interest in the information and that the information was of interest to the wider public [para. 12], and ruled that as disclosure of the information would not “be contrary to [the Council employees’] legitimate expectations or likely to cause them distress” the disclosure would be “fair and lawful”. [para. 15]

The Council appealed the Commissioner’s decision to the Inner House of the Court of Cession, which ruled in favour of Irvine and the Commissioner. The Council then appealed to the Supreme Court.

Decision Overview

Lady Hale delivered the judgment of a five-judge bench of the Supreme court. The central issue for the Court to determine was whether the legislative conditions for the disclosure of personal information had been met – and so whether the information Irvine sought should have been disclosed.

The right to access to information in Scotland stems from the Freedom of Information (Scotland) Act 2002 (FOISA), however information is exempt from disclosure if it constitutes personal data under the Data Protection Act 1998 (DPA), unless one of the conditions specified in Schedule 2 of the DPA is met.

The Court examined the interrelationship between the FOISA and the DPA and, with reference to the U.K. case of Common Services Agency v. Scottish Information Commissioner [2008] UKHL 47, 2008 SC (HL) 184, noted that the protections under the DPA continue to exist even after the adoption of the FOISA. [para. 5] The Court in the Common Services Agency case had stated that “there is, however, no reason why courts should favour the right to freedom of information over the rights of data subjects”. [para. 5] The Court explained that “[w]hat the FOISA does, therefore, is give the person who requests the information a right to have that information disclosed to him (s 1(1)) provided that this does not contravene the DPA”. [para. 6] This right was conferred by the FOISA, but the Court cautioned that it cannot trump the DPA. [para. 6]

The Court noted that the DPA introduced the European Council directive on processing of personal data into U.K. law [para. 7], and that the legislation defined processing as “any kind of operation performed on the data, such as collecting, recording, organising, storing, adapting or altering, retrieving, consulting, using, disclosing or otherwise making available, aligning or combining, blocking, erasing or destroying”. [para. 8] The Court explained that the DPA prohibits the processing of personal data unless certain conditions are met – as set out in Schedule 2. In the present case the relevant condition was condition 6, which states that personal data can be processed if “[t]he processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”. [para. 2]

The Court held that as the Council had indicated that it believed that Irvine had no legitimate interest in the information he sought, the Council was therefore aware of condition 6 in Schedule 2 of the DPA. [para. 11]

The main focus of the Court’s determination was the application of condition 6, and the Court applied a three-prong test in its determination. The three questions the Court had to answer were whether Irvine did have a legitimate interest, whether the processing of the data was necessary, and whether there was proportionality between the legitimate interest and the rights that could be infringed.

The Court referred to the argument put forward by the Council that the European Court of Justice cases, Huber v Bundesrepublik Deutschland C-524/06 (2009) and Rechnungshof v. Osterreichischer Rundfunk, C-465/00, (2003) called for a strict interpretation of “necessity” and that proportionality was not part of the “necessity” test. [para. 23] The Court held that at least within the context of justification, “necessary” implied “reasonable” rather than absolute or strict necessity criteria. [para. 27] In addition, the Court accepted that “necessity” forms part of the proportionality test within European Community law. [para. 27]

The Court emphasized that there is a distinction between processing of data which would interfere with the right to private life, under article 8(2) of the European Convention on Human Rights, and processing which does not engage privacy rights issues. [para. 26] Considering the facts of the case, the Court concluded that the information requested would not enable Irvine to discover the identity of data subjects and therefore did not interfere with the right to respect to their private lives.

Accordingly, the Court concluded that the Commissioner was correct in finding that Irvine was entitled to the information he sought from the Council. [para. 26]