Disclosure of Employment Equality Data “Necessary” Under UK Data Protection Act

Mark Irvine, a freelance journalist working in association with Action4Equality Scotland, made a number of requests to South Lanarkshire Council under the Freedom of Information (Scotland) Act 2002. He wanted to know how many of the Council’s employees in particular posts were placed at particular points on the council’s pay scales. This was with a view to learning whether the Council’s pay ladder favoured jobs traditionally done by men, such as rubbish collectors, gravediggers and gardeners, over “female” jobs like home carers and classroom assistants. He did not request the names of employees.

The Council refused the requests on the grounds that compliance would contravene the Data Protection Act 1998. The Scottish Information Commissioner ordered disclosure and the authority appealed, first to the Inner House, and then to the Supreme Court.

The basis of the appeal was twofold: first that the Commissioner had misinterpreted the relevant condition for the processing of personal data in Schedule 2 Paragraph 6 of the Data Protection Act 1998 and, secondly, that the Commissioner had breached the rules of natural justice by failing to share with the authority correspondence sent by Members of the Scottish Parliament in support of Mr Irvine’s requests.

South Lanarkshire’s main challenge was that the Commissioner had misapplied the conditions for processing of personal data under the Data Protection Act 1998. Under s38 of the Freedom of Information (Scotland) Act 2002, information is exempt from disclosure if it is personal data under the Data Protection Act 1998 and if disclosure would contravene any of the data protection principles of that act. It was accepted by both parties that the information involved personal data in the hands of the Council. The only potentially relevant condition that would permit disclosure was that in schedule 2, paragraph 6. This allows disclosure if, “the processing is necessary for the purposes of legitimate interests… except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”

Both the Commissioner and the Supreme Court considered it was necessary to consider three questions:

(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

The Commissioner found that the first and third questions were answered, on the basis that equal pay was a legitimate interest and that, as it would not be possible to identify individuals, there could be no real prejudice to rights and freedoms or legitimate interests.

The challenge therefore rested upon the interpretation of “necessary”, with the Council objecting to the Commissioner’s interpretation of the term as importing a proportionality test consistent with that applied as a matter of European law. The Commissioner had therefore considered whether disclosure was “proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means that interfere less with the privacy of the data subject.” The Commissioner found that disclosure could be proportionate on this basis. The Council argued that a stricter test of necessity should apply, taking into account the nature of the processing, and that proportionality was irrelevant. It did not, however, contend that “necessary” means “absolutely necessary” or even “strictly necessary.”

The Supreme Court agreed with the Council to the extent that the necessity of the data processing must be considered in relation to the processing to be undertaken, but disagreed that a stricter test of “necessary” was required. The Supreme Court considered that there was established case law at European level that necessary meant “reasonably necessary” and that although Article 8 was not relevant in this case it should be considered whether the legitimate aims could be achieved by less restrictive means. The Supreme Court concluded that the Commissioner was “quite entitled” to reach the conclusion it did, having in fact adopted a test more favourable to the Council than required.

As regards the Council’s “natural justice” arguments, the Supreme Court held that there was no breach of duty by the Commissioner. The Commissioner was recognised as being under a duty to act fairly, not least because in Scotland, unlike in England and Wales, the Commissioner is the sole finder of fact and appeals may be on a point of law only. However, this did not mean that all communication passing between the Commissioner and the applicant/third parties needed to be disclosed. In the present case, the authority was aware of the principal issues and the correspondence added nothing to the arguments.

Another interesting aspect of the case is that the Council initially refused the requests on the ground that it considered them vexatious, principally because of Mr Irvine’s blog for Action4Equality Scotland and his connections with the solicitor representing equal pay claimants against the Council. The Council later withdrew its reliance on that ground for refusal and it has already received some local media criticism over the public cost of resisting these information requests.

The key feature of this case is clearly the Supreme Court’s consideration of the requirement of necessity in the Data Protection Act. That requirement features in all of the conditions in schedule 2, at least one of which must be satisfied if personal data (that is not sensitive personal data) is to be processed fairly and lawfully. The Court emphasised that it would be strange if “necessary” meant different things in different conditions and therefore some form of proportionality assessment will be necessary wherever “necessity” is considered under the Data Protection Act and section 40 of the Freedom of Information Act 2000.

Authored by Jamie Potter