Line to take - LTT144 - Personal data - anonymised statistics

From FOIwiki
Revision as of 01:23, 17 September 2010 by Alex skene (talk | contribs) (ltt144)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search
  • FOI/EIR: FOI
  • Section/Regulation: s40
  • Issue: Personal data - anonymised statistics
  • Source: Policy Team
  • Details: Department of Health (Decision Notice -28 July 2008) — APPEALED; Common Services Agency / Scottish Information Commissioner
  • Related Lines to Take: LTT71
  • Related Documents: FS50122432 (DoH), [2008] UKHL 47 (Common Services Agency), DP Technical Guidance “Determining what is personal data”
  • Contact: RM/HD
  • Date: 24/02/2009
  • Policy Reference: LTT144


Line to take

INTERIM LINE

Truly anonymised data / statistics is not personal data and thus can be disclosed without reference to the Data Protection Act.

The Commissioner does not accept that where a public authority holds information to identify living individuals from the anonymised data, that this turns the anonymised data into personal data. The Commissioner draws support for this approach from the House of Lords’ judgment in the case of the Common Services Agency v Scottish Information Commissioner [2008] UKHL 47.

However if a member of the general public could identify individuals by cross-referencing the anonymised data with information already in the public domain, then the information is personal data. Whether it is possible to identify individuals from the anonymised data is a question of fact based on the circumstances of the specific case.


Further Information

** PLEASE NOTE THAT THIS IS AN INTERIM LINE AS THE CASE ON WHICH IT IS BASED IS CURRENTLY UNDER APPEAL TO THE INFORMATION TRIBUNAL **

The Commissioner considers that truly anonymised data is not personal data and thus there is no need to consider the application of any Data Protection Act principles when considering whether or not to disclose truly anonymised data.

However, some data controllers point to the wording of s1(1) of the Data Protection Act which states that “...personal data means data which relate to a living individual who can be identified — (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of the data controller...” (emphasis added) to argue that although no living individual could be identified from the requested information on its own, that as the data controllers hold other information which would allow individuals to be identified, this must necessarily make the information, personal data.

The Commissioner does not accept this approach.

Therefore the Commissioner considers that even where the data controller holds that additional ‘identifying’ information, that this does not prevent them from anonymising that information to the extent that it would not be possible to identify any living individual from that information alone and thus would no longer be personal data.

However it is then necessary to go onto to consider the information which is available to the public. The test of whether the information is truly anonymised is whether a (or any) member of the public could identify individuals by cross-referencing the ‘anonymised’ data with information or knowledge already available to the public. Whether this ‘cross-referencing’ is possible is a question of fact based on the circumstances of the specific case.

If identification is possible the information is still personal data and the data protection principles do need to be considered when deciding whether disclosure is appropriate. However, where the anonymised data cannot be linked to an individual using the additional available information (i.e. the information had been truly anonymised) then, the information can be considered for disclosure without any reference to DPA principles.

This approach is supported by paragraphs 24 & 25 of Lord Hope’s judgment in the House of Lords’ case of the Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, where it was said:

...Rendering data anonymous in such a way that the individual to whom the in formation from which they are derived refers is no longer identifiable would enable the information to be released without having to apply the principles of [data] protection ... ” (para 25).

The approach outlined above has been taken in the following case which is currently under appeal to the Information Tribunal.

Case reference FS50122432

The complainant made a request to the Department of Health (the “DoH”) for a full statistical breakdown of the number of abortions carried out in 2003 under ground (e) — abortions where there is a substantial risk that if the child were born it would suffer from serious physical or mental abnormalities. This information is supplied to the Chief Medical Officer on Abortion Notification Forms which also include details of abortions of foetuses over 24 weeks gestation.

The complainant made the request because when the DoH took over responsibility for publishing this information in 2002, they reduced the level of detail from very detailed (including showing counts of 0, 1 or 2 cases) to redacting the numbers where the occurrences were less than 10.

The DoH withheld disclosure on the grounds of sections 40 and 44. In relation to s40, the public authority raised the argument outlined above based on the wording of s1 DPA.

At paragraphs 45 & 46, the Commissioner confirmed that he was not persuaded by this argument and said that “...the statistical information is so far removed from the information on the Abortion Notification forms that it no longer retains the attributes of personal data. In reaching this view the Commissioner has noted that the DoH accepts that an individual cannot be identified by the requested information alone...

The Commissioner is maintaining this approach at the forthcoming appeal before the Tribunal although accepts that this approach has not been adopted in previous cases, for example, FS50133250 (Caerphilly County Borough Council — pupils excluded from schools as a result of drugs finds).