NHS agency the Common Services Agency (CSA) refused, saying that the small numbers meant data could identify patients. It said that the vast majority of wards contained no case of leukemia, whilst other wards were associated with one case, or very occasionally two cases. The CSA argued that publication of such data linked to a precise geographical area would create a significant risk of indirect identification of live individuals.

The Scottish Information Commissioner (SIC) accepted this but determined  the information could be released if the data were 'barnardised' (a method designed by a statistician, Professor George Barnard, to disguise identities when cells of information contain low numbers).

The CSA challenged the SIC's view in the Edinburgh Court of Session but the court supported the Commissioner's stance. It stated that the barnardised data were not personal data and should be released. The CSA then appealed to the House of Lords.

There it was determined  that the barnardised data were personal data and that the CSA's arguments  prevailed as it transpires that the barnardisation technique was imperfect when most of the cells contain zero and where, in some cases,  barnardised data were exactly the same as the raw data.

Barnardisation simply adds in a random way zero, plus one, or minus one to the numbers two, three and four; and adds zero or one to the number one, when they appear in a database. Zeros are left at zero.

At the end of the second day, lawyers for both sides recommended the House of Lords should remit the FOI request back to the Scottish Information Commissioner, to reconsider the data protection elements of the original request.

In coming to this conclusion, the House of Lords indicated that a key data protection ruling of 2003, (Michael Durant against the Financial Services Authority) did not need to be reviewed for the purposes of deciding the current case. If confirmed in the final judgment, that could dash the hopes of those in the data protection community who see Durant as a flawed judgment.

Lord Hoffman, one of the five Law Lords who heard the case, noted that in the CSA case, the key factor appeared to be whether an individual could be identified from the barnardised data and other information in the possession of the CSA. If that individual could be identified then the barnardised data had to be health personal data. It then followed that any data that revealed the status of an individual's health must "relate to" that individual in a biographical way. Lord Hoffman thus suggested that it was therefore not relevant to consider whether the barnardised data "related to" an individual, the key element explored by the Durant judgment.

The second important element debated at the hearing concerned the assumption that the purpose behind an FOI request is not relevant to deciding whether the information should be provided to the requestor. The Law Lords acknowledged that the publishing of personal data via an FOI request required a balance of interests to be considered. The public interest of accessing information through an FOI request had to be balanced against the interests of the individual in preserving the privacy of his personal data.

In arguments, their Lordships asked whether, in order to assess this balance of interests, it was justifiable to inquire why the FOI requestor would want the personal data. The response from the barrister for the UK Information Commissioner was that, in many cases, a public authority would be able to identify the requestor's purpose without asking, but conceded that in some cases, this step might be necessary. The UK Information Commissioner became involved because the outcome of the case will affect data protection and freedom of information law across the UK.

Dr. Chris Pounder, information law specialist at Pinsent Masons, the  OUT-LAW.COM law firm, and editor of Data Protection Quarterly, said: "If this conclusion is reached in the final judgment then it is likely to upset the assumption that all FOI requests are purpose blind. The problem is that if this conclusion is reached, it cannot be challenged. It becomes the law of the land as the conclusion has been made by the highest court in the UK."

The judgment from the House of Lords is expected before August.

The case of Common Services Agency v Scottish Information Commissioner will be discussed in detail at Pinsent Masons' data protection update sessions this month.

Source: http://www.out-law.com/roundup/20080403.html