Department of Health, R (on the application of) v Information Commissioner

The Department of Health brings this appeal under Section 59 of the Freedom of Information Act 2000 ("FOIA") against the decision of the Information Tribunal ("the Tribunal"), which ordered the Department of Health to disclose late term abortions statistics. In summary, the Department of Health is concerned that disclosure of the statistics would create a real risk of patients being identifiable. The respondent is the Information Commissioner who has responsibility under both FOIA and the Data Protection Act of 1998 ("the DPA"). He had previously ordered that this information should be disclosed. Hence his case is that the Tribunal was right to order disclosure. By a respondent's notice, however, the Information Commissioner contends that one aspect of the Tribunal's reasoning -- that the statistics were personal data -- was erroneous.

Section 1(1) of the Abortion Act 1967 contains various permissible grounds for abortion. One of these is set out in Section 1(1)(d):

Unlike terminations generally, ground E terminations, as they are called, can be carried out after 24 weeks gestation. A person is not guilty of an offence under the law relating to abortion when a pregnancy is terminated by a registered medical practitioner. If two registered medical practitioners are of the opinion, formed in good faith, that one of various statutory conditions are satisfied the relevant opinion must be recorded. This is done on form HSA1, set out in part 1 of schedule 1 to the Abortion Regulations 1991, 1991, SI No.499, as amended ("the Abortion Regulations").

Specified information about each termination must also be provided to the Chief Medical Officer under regulation 4 of the Abortion Regulations. This is done on form HSA4, contained at schedule 2 to the regulations. The information includes the name, address and General Medical Council number of the medical practitioner terminating the pregnancy; the name and address of any other doctor who joined in giving the certificate HSA1; the patient's details, including the patient's hospital, clinic or NHS number, or full name, date of birth, post code, and marital status; the number of previous pregnancies and their outcome; details of the place and method of termination; gestation; grounds for termination; complications up to discharge; and any maternal fatalities. Regulation 5 of the Abortion Regulation provides that information furnished to the Chief Medical Officer in pursuance of these regulations should not be disclosed.

The information collected by the Chief Medical Officer has found its way into annual abortion statistics, which have been published since 1968. These statistics include figures for abortions carried out under ground E. Prior to April 2002, publication of the abortion statistics was in the hands of the Office of National Statistics ("the ONS"). For years up to and including 2002, detailed statistical information was published about ground E abortions. The information listed a number of different foetal abnormalities and provided the total number of terminations for each one, together with a figure for terminations of over 24 weeks gestation. Some individual cells or items were included with counts of zero, one or two.

In 2002, the Department of Health assumed responsibility for publishing the abortion statistics. These gave less information than in previous years. For 2003, initially, the published figures for ground E abortions were in summary form only. As a result, in February 2005, the political director of the ProLife Alliance made an FOIA request to the Department of Health in respect of the abortion statistics for calendar year 2003. It was for the same level of detail as published in previous years. Two months later the Department of Health replied, refusing to provide the information requested. It relied on the qualified exemption in Section 36 of FOIA and referred to the anticipated guidance from the ONS. It indicated that it would consider publishing more information once the guidance was available.

The ONS guidance was entitled, "Disclosure Review for Health Statistics 1st report - Guidance for Abortion Statistics". It was published in July 2005 following a review led by the National Statistician. It provided an analysis of the precise types of cell or item which posed identification risks, and expressed a view on other potentially available information which, in conjunction with the statistical information, could exacerbate identification risks. According to the guidance, the unsafe cells were counts of abortions that were zero, unless no other value was logically possible; less than five for government office regions in England, for Wales, or for any other larger geographical area; and less than 10 for any geographic area smaller than the government office regions in England or Wales; less than 10 for highly sensitive variables associated with either one or two practitioners, or associated with either one or two hospitals. The highly sensitive variables were ages of less than 15 years, gestation over 24 weeks, procedure by gestation, and medical conditions. The guidance considered that information regarding ground E abortions was highly sensitive and therefore figures for less than 10 occurrences should be suppressed.

A second ONS guidance document entitled, "Review of the Dissemination of Health Statistics: Confidentiality Guidance", was published in 2006. This document set out the process of confidentiality assessment and explained that disclosure control methods were applied when breaches of confidentiality were considered to be statistically likely. It categorised abortion statistics as high risk.

As a result of the July 2005 ONS guidance, the Department of Health published a statistical bulletin in July 2005 covering the 2003 figures. At the same time, the statistics for 2004 were published in a similar format. The introduction to the 2003 statistical bulletin stated:

Section 5 of the bulletin referred to the ONS guidance and summarised its key recommendations. The statistical bulletin included a table showing total ground E abortion figures in 2003 in respect to various types of abnormality with separate figures for late abortions, in other words, those carried out at over 24 weeks gestation. But certain categories of abnormality were combined, and where a cell had a figure of between zero and nine, that figure was suppressed. Later in 2005, the Department of Health published aggregate figures over a three year period, 2002 to 2005, in which individual cell counts which had been suppressed were aggregated over the years to provide, where applicable, a total cell count of 10 or more.

Meanwhile, in May 2005, the ProLife Alliance asked the Department of Health to conduct an internal review. In January of the following year it contacted the Information Commissioner. When the results of the internal review were finally available in April 2006, the Information Commission investigated. In the course of that investigation, the Department abandoned its reliance on Section 36 of FOIA, but continued to rely on the absolute exemption relating to personal data, Section 40, and the statutory prohibition, Section 44. In July 2008, the Information Commissioner issued his decision notice. He concluded that the disputed information was not personal data, since neither the doctors nor the patients were identifiable from the statistics. Hence Section 40 did not apply. He also concluded that there was no relevant prohibition on the disclosure of the disputed information, and thus Section 44 did not apply. As neither exemption applied, he required the Department of Health to disclose the requested information. In other words, he required it to disclose statistics from 2003 at the same level of detail as published previously by the ONS.

The general right of access to information held by public authorities is contained in Section 1 of FOIA. Section 1(1) establishes a right of access to information held by public authorities. Any person making a request is entitled to be informed in writing by the public authority whether it holds information of the description specified in the request, and if that is the case, to have that information communicated to him.

Section 1(1), is subject to subsection (2), which sets out the effect of the exemptions in part 2 of FOIA. The exemptions contained in part 2 fall into two classes: absolute exemptions and qualified exemptions. Absolute exemptions exempt all information of a specified description. With an absolute exemption, the only question is whether the information falls within the description. Qualified exemptions are subject to a public interest test. Among the exemptions in part 2 are Section 36 information, the disclosure of which would prejudice the effective conduct of public affairs; Section 40, personal information; and Section 44, information the disclosure of which is prohibited by, inter alia, legislation.

The exemption for personal information in Section 40 is an absolute exemption, so does not depend on whether the balance of the public interest favours disclosure. If the request is for an individual's own personal data, the request is then governed by Section 7 of the DPA, which gives a person a right of access to personal information about themselves. Where the requester is asking for personal data about third parties, Section 40(2) applies. Its effect is that there is an absolute exemption if disclosure of the information to a member of the public otherwise than under FOIA would breach any of the data protection principles. It is necessary to set out the precise statutory language of Section 40(2).

Section 40(3) sets out the first condition:

The application of Section 40 thus demands consideration of a number of concepts, concepts drawn from the DPA. In broad outline, the thrust of the DPA is that data controllers, those who determine how personal data is held and used, must comply with the eight data protection principles. Disclosure of personal data is in breach of the DPA unless those principles are satisfied. Among the exemptions in the DPA is Section 33, which applies to the publication of statistics.

The DPA was enacted to implement European Council Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. In accordance with established principles the DPA must be interpreted insofar as possible in a manner consistent with the directive, including its recitals. Recital 26 reads in part:

The first concept in Section 40 of relevance is that of personal data. By Section 40(7) of FOIA, personal data has the same meaning as in Section 1(1) of the DPA. Section 1(1) of the DPA provides that:

That definition does not track precisely the definition of personal data in the directive, which defines it as:

"Data" is also defined in subsection (1) of the DPA, although information is not defined.

The concept of personal data in Directive 95/46/EC was considered at length by an advisory working party to the Commission, constituted under Article 29 of the directive ("the Article 29 working party"). Its Opinion 4/2007 on the concept of personal data was adopted in June of 2007. It states that the objective was to reach a common understanding on the concept of personal data. It noted that the proposal of the European Commission for a directive had been amended to meet the wishes of the European Parliament, that the definition of personal data should be as general as possible so as to include all information concerning an identifiable individual. It also noted the objective of the rules in the directive as being to protect individuals. The working party stated that the better option was not to restrict unduly the interpretation of the definition of personal data, but rather to note that there was considerable flexibility in the application of the rules to the data. National authorities should endorse a definition which was wide enough so that it would catch all "shadow zones" within its scope, while making legitimate uses of the flexibility contained in the directive. The text of the directive invited a development of policy which combined a wide interpretation of the notion of personal data and an appropriate balance in the application of the directive's rules.

The working party report continued that, in general terms, information could be considered to relate to an individual when it was about that individual. To determine whether a person was identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify that person. The report concluded that anonymous data in the sense used when applying the directive could be defined as any information relating to a natural person, where the person could not be identified, whether by the data controller or by any other person, taking account of all means likely reasonably to be used to identify that individual.

Next is the concept of the data protection principles. The eight principles are addressed in schedule 1 to the DPA. The first protection principle states:

Thirdly, there is the concept of processing personal data. Processing is defined widely in Section 1(1) of the DPA to include the holding and use of personal data and its disclosure, or otherwise making it available. In that regard, Schedule 2 sets out the conditions necessary for the processing of personal data for the purposes of the first data protection principle. Paragraph 6(1) of that schedule reads:

In Corporate Officer of the House of Commons v Information Commissioner & Brooke [2008] EWHC 1084 [2009], 3 All ER 403, it was held that "necessary" within schedule 2 of paragraph (6) of the DPA reflected the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely, that there should be a pressing social need, and that the interference was both proportionate as to means and fairly balanced as to ends: paragraph [43]. The same considerations would apply in relation to Schedule 3, paragraph (7), for sensitive personal data.

The Department of Health appealed the Information Commissioner's decision to the Information Tribunal. The ProLife Alliance was joined as an additional party. Before the Tribunal, the Department of Health argued that the requested information was exempt from disclosure under FOIA, first because its disclosure was in breach of the data protection principles since it constituted personal data of doctors and patients, and secondly, because its disclosure would contravene regulation 5 of the Abortion Regulations. The Tribunal heard the appeal over four days in late May and early June of 2009. There were a number of witness statements and witnesses gave live evidence. The Tribunal promulgated its decision in mid-October 2009. It issued a substituted decision notice, in broad terms as follows:

After outlining the background to the case, the Tribunal summarised the evidence it had heard, including the evidence about the so-called Jepson and Nine Year Old Girl cases, which the Department of Health said had caused concern about the publication of the abortion statistics. The Jepson case arose when the Reverend Joanna Jepson asked the Metropolitan Police to investigate a late abortion for cleft lip and/or palate recorded in the 2001 statistics, published in 2002. The Metropolitan Police, which had access to the HSA4 form from the Department of Health, responded that they were the wrong force and issued a press release that the West Mercia police would investigate. A local newspaper in that area published an article that the hospital concerned was in Hereford, and since there is only one NHS hospital there began speculating as to which doctor had performed the abortion. Eventually a doctor was named. He was door-stepped by journalists and subjected to a campaign of abuse. Eventually he confirmed his identity and gave a press interview. In evidence to the Tribunal, the Department of Health witnesses accepted that no one knew how Hereford or the doctor had been identified, by elimination or by a leak. A second doctor and the patient herself were never publicly named.

The Nine Year Old Girl case began when the Department of Health received a telephone call from a journalist who believed that she had managed to identify a nine year old girl having had an abortion. The journalist had been told the girl's name by that girl's friend and had checked the information against the 2000 statistics, which recorded one termination for a nine year old girl. A data check by the Department of Health uncovered that the data subject was, in fact, 19 years old.

As a result of these cases the Department of Health had a number of concerns. The Tribunal enunciated them: the considerable length to which journalists would go to track down cases with an unusual element; the increased risks because of the use of social networking sites such as Facebook; the greater sharing of data across government departments; and the changes in technology. The Tribunal then outlined the ONS guidance and statistical techniques of perturbation to reduce the risk of identification when statistics are published.

After outlining the statutory provisions, the Tribunal addressed the question of whether the requested data was personal data within the meaning of the DPA, Section 1(1). In doing so it made extensive reference to the House of Lords decision in Common Services Agency v Scottish Information Commissioner [2008] UKHL47, [2008] 1 WLR 1550. The Information Commissioner argued that if the statistics were anonymous to a third party there was nothing in "those data" to lead to identification in accordance with Section 1(a) of the DPA. It was the "other information" which would do so, and thus the statistical information was not personal data by virtue of Section 1(1)(b) of the DPA. The Tribunal rejected this and held that statistical information ceases to be personal data only where it can no longer be cross-referenced to other information by the data controller. The Department of Health held both the disputed information and the HSA4 forms. With the assistance of the forms, it would be able to identify the individuals to whom the disputed information related.

The Tribunal next considered whether disclosure of the disputed information publicly would contravene the data protection principles, in particular the first data protection principle, paragraph (6). As far as whether disclosure would be fair, the Tribunal was satisfied that patients were not misled as to the use of form HSA4, although they would have the expectation that they would not be identifiable from the publicly available statistics. In relation to doctors, the Tribunal was satisfied that they would have a lesser expectation of confidentiality, but would nevertheless not expect their treatment of a particular patient to be made public in the ordinary course of events.

The Tribunal held that the question of the likelihood of identifiability of individuals from the statistics was integral to the question of fairness. It referred to the Article 29 Working Party Report which had said that a mere hypothetical possibility was not enough to consider a person as identifiable. It referred to the ONS guidance, and the expert evidence that the risk fell into three categories: self identification, disclosure by difference, and disclosure by a motivated intruder. The Tribunal said it was satisfied that the ONS guidance was heavily influenced by the Department of Health's fears following the Jepson case, and to a lesser extent the Nine Year Old Girl case. It was also satisfied, it said, that the figure of 10 for a safe cell contained in the ONS guidance reflected the Department of Health's comfort threshold and was not a statistical consideration. The Tribunal continued that no witness was able to point to any methods or information in the public domain that would facilitate or assist in the process of elimination. The Tribunal rejected the Department of Health's assertion that the Jepson case was an example of an individual being identified from statistics. After further discussion of the evidence, the Tribunal concluded that the possibility of identification by a third party from these statistics was extremely remote.

The Tribunal turned to the second aspect of the first data protection principle, whether the disclosure of the disputed information would be lawful. The Department of Health had contended that disclosure of cell counts below 10 would breach Article 8 of the ECHR and thus disclosure would be unlawful. The Tribunal concluded that Article 8 was not engaged since a risk of identification had not been demonstrated. Even if it were wrong, and a minimal risk of identification existed, the Tribunal was satisfied that any such identification was in accordance with the law and was proportionate and necessary.

Thirdly, the Tribunal considered whether disclosure was necessary under paragraph 6(1) of schedule 2, having balanced the legitimate interests of the third party to whom the data would be disclosed – in other words the public – and the prejudice to the rights and freedoms or legitimate interests of the data subject. Here the Tribunal canvassed the evidence as to the legitimate uses to which small cell statistical data could be put. Seven heads of legitimate use were identified: checking compliance with the Abortion Act; enabling public scrutiny of the way abortion law was applied; ensuring accountability in relation to medical practitioners; providing external checks and balances to Department of Health scrutiny; identifying trends; planning healthcare services, including monitoring the rates of foetal abnormalities; and informing public debate. As against those legitimate purposes in disclosure, the Tribunal considered whether disclosure would have an excessive or disproportionate adverse effect on the legitimate interests of the data subject. It recognised that identification of the patient by the public would be devastating, because the patient might be subject to public vilification and stigma, and might wish to keep the matter confidential. However, those consequences were all dependent on the patient being identified:

Regarding the perceived risk of identification, there was evidence that doctors were being asked by patients if they could invoke a false name and address, but the Tribunal was satisfied that patients were not usually focused on the statistics. The perceived risk of identification could equally affect a data subject in a cell of 10 whose information was disclosed. The fact that there had been no patient identified from the statistics suggested that the fear of identification was unrealistic. As for a self identification, none of the witnesses were able to point to a single case of a woman who had experienced anxiety as a result. The Tribunal then laid out the different consequences for doctors. There were groups with extremist views, and in other countries anti-abortion campaigners had inflicted fatal violence against doctors. However, the Tribunal concluded that the risk of identification of individual doctors was remote.

The Tribunal concluded that the likelihood of identification from these statistics was so remote that disclosure of the disputed information was justified. The disclosure would be proportionate, the legitimate aims were important, and the disclosure of the disputed information directly furthered the legitimate aims. The Tribunal also concluded that the factors of necessity considered in relation to schedule 2 of the DPA were material and applied equally to schedule 3. The Tribunal also considered the application of Section 44 of FOIA, but found that the exemption did not apply since disclosure would not breach the Abortion Regulations. The Department of Health does not appeal against that finding and there is no need to say anything more about it.

By its respondent's notice, the Information Commissioner contends that the requested information is not personal data. It will be recalled that for the purposes of FOIA the definition of personal data is that in Section 1(1) of the DPA, data which relates to a living individual who can be identified "(a) from those data, or (b) from those data, and other information which is in the possession of or is likely to come into possession of the data controller". In this judgment I refer to these as limb A and limb B of the definition. If the requested information is not personal data, as the Information Commissioner submits, it must be disclosed since the exemption of Section 40 of FOIA does not apply. The Tribunal have erred in concluding that the disputed information was personal data.

By contrast, the Department of Health contends that the statistics constitute personal data within limb B of the definition in relation to the patients and doctors involved. That is because they can be identified from the statistics taken together with the other information in the Department of Health's possession, in other words, the HSA4 forms from which these statistics are compiled. The Department of Health submits that the Tribunal was correct in its approach. Since the appeal must be dismissed, if the Information Commissioner is correct, it seems to me that this issue is the logical starting point in the case.

Both parties are agreed that the leading authority on the issue is Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, [2008] 1 WLR 155 ("the CSA case"). There, a researcher for a member of the Scottish Parliament made the following request of the Common Services Agency, the agency which is responsible for epidemiological information in Scotland (the request is set out in the report of the Inner House at [2007] SC 231, 232).

In the event, the agency refused the request on the grounds that insofar as it had figures, there was a significant risk of the indirect identification of a living individual due to the low numbers resulting from a combination of a rare diagnosis, the specified age group and the small geographical area. Legally, the agency said, they were personal data within the meaning of Section 1(1) of the DPA. The Scottish Information Commissioner ordered the agency to release the figures after perturbating it using a process known as barnardisation, after its inventor. That would hide the precise figures but reveal the general pattern of the instances of childhood leukemia. The Commissioner's decision was upheld by the Inner House of the Court of Session (Lords Hamilton, Nimmo Smith and Marnoch). The House of Lords allowed the appeal and remitted the matter to the Scottish Information Commissioner for him to decide certain questions of fact which he had not already done.

Subsequently, in Decision 021 of 2005, dated 26 May 2010, the Scottish Information Commissioner considered the manner in which the barnardised information would be provided, but came to the view that the barnardised data by themselves could lead to identification. Given that finding, the Commissioner did not have to consider limb B. The Commissioner then held that the requested information was sensitive personal data relating to physical health and thus was exempt under the equivalent provision to Section 40 FOIA in the Scottish Freedom of Information Act of 2002. The Commissioner went on to decide that disclosure would breach the first data protection principle. However, he decided that in failing to disclose the information in a form which was not exempt when such form was available, the Agency had failed to comply with its duty under the legislation. He therefore required the Agency to disclose to the MSP'S researcher aggregated statistics for the whole of the Dumfries and Galloway Health Board area for each of the years 1990 to 2001.

In the House of Lords, the leading speech was delivered by Lord Hope. Lord Hoffmann agreed with Lord Hope. Lord Rodger and Baroness Hale gave separate speeches with different reasoning. Unlike Lord Hope, who focused on limb B of the definition of personal data, Lord Rodger used the careful distinction Parliament had drawn between data and information to conclude that limb A was applicable. However, Lord Rodger said that if limb B did apply he would agree with Lord Hope's approach. Lord Mance said that the only significant difference in reasoning was between Lord Hope and Lord Rodger as regards limb B of the definition. It was unnecessary to decide between the rival views, but he had a preference for Lord Hope's. In all other respects, he agreed with Lord Hope's reasoning.

For the Information Commissioner, Mr Pitt-Payne QC advances as his primary submission that, given that divergence of reasoning in the House of Lords, I am free to adopt the approach of Baroness Hale. That was recently the course adopted by the Upper Tribunal (Mr Justice Blake, Mr Bartlett QC, Rosalind Tatum) in All Parliamentary Group on Extraordinary Rendition v Information Commissioner [2011] UKUT 153 AAC:

In short, Baroness Hale recognised difficulties with the statutory definition of personal data, but concluded that if the data could be anonymised in such a way that third parties could not identify the individuals to whom it related, it did not matter that the agency had the key which linked it back to the individual patients. The Agency could identify the individuals and would remain bound by the data protection principles when processing the data internally, but the recipient of the information would not be able to identify the individuals, either from the data themselves or from the data plus any other information held by the Agency, because he would not have access to that other information: [92].

Despite the attractions of such reasoning, I do not believe that adoption of it is open to me. The fact is that in the CSA case Lord Hope gave the leading speech; Lord Hoffmann agreed with it; Lord Rodger said that he would have agreed with it if he had thought limb B applicable; and Lord Mance, without deciding, expressed a preference for Lord Hope's reasoning on limb B. While strictly speaking there may be no binding majority in the case on the issue, our system of precedent demands that the High Court treat Lord Hope's speech as determinative. Given the position of this court in the curial hierarchy, it is simply not open to me to adopt the approach of Baroness Hale or, it might be added, the attractive course chartered by Lord Rodger, who reasoned from the obviously correct basis that Parliament had distinguished between data and information in the statutory language.

Lord Hope's reasoning began by pointing out that disclosure is only one of the ways in which a data controller can process information. The data controller must comply generally with data protection principles. It could exclude personal data from the duty to comply with the data protection principles simply by editing the data so that a third party would not find it possible from that part alone, without the assistance of other information, to identify a living individual: [22]. If the definition of personal data could be read in a way that excluded information that had been rendered fully anonymous, putting it into that form would take it outside the scope of the agency's duty as data controller: [23]. Lord Hope continued that the relevant part of the definition was limb B, since a living individual could not be identified from those data, ie the barnardised statistics themselves (limb A). Data would not be personal data if the other information was incapable of adding anything, and the data itself could not lead to identification, or if the data had been put into a form from which individuals to whom they related could not be identified at all, even with the assistance of the "other information" from which they were derived: [24]. In the latter situation, a person who had access to anonymised data and "other information" held by the data controller would find nothing in the anonymised data that would enable identification. It would be the "other information" only, and not anything in the anonymised data, which would result in the identification: [24].

Lord Hope then referred to the wording of recital 26 of the preamble to Directive 95/46/EC, noting that the definition of personal data contained in Section 1(1) of the DPA gives effect to it. The first two parts of the recital refer to situations set out expressly in Section 1(1), the third part casting further light on what member states were expected to achieve when implementing the directive: [25]. Lord Hope's analysis is then completed at paragraphs 26 to 27, which deserve quoting in extensio.

For the Secretary of State, Mr Eadie QC invokes the protective intent of the DPA in relation to personal data. That, in his submission, suggests a wide gateway to begin, but with the possibility of entering narrower paths with justification. The DPA has its own regime for the publication of statistics in Section 33. That protective approach, he submitted, is supported by the Article 29 Working Party opinion, and Article 8 of the ECHR. Against that background, Mr Eadie's submission is that the effect of the CSA case is that anonymised statistical information continues to be personal data in the hands of the data controller if the data controller possesses other information which could be used to identify the individuals who have featured in the statistics. The statistical information is not, in those circumstances, truly anonymised in the hands the data controller. Here was a question of fact to be resolved by the Scottish Information Commissioner in the CSA case as to whether the barnardised data were truly anonymous in that they could not be reconstituted by the Agency.

It would be wrong to pretend that the interpretation of the CSA case is an easy matter. In my view, the starting point to a solution lies in the order Lord Hope proposed. That was that the matter be remitted to the Commissioner

Mr Eadie QC submits that the key factual issue in CSA was whether barnardisation would render data fully anonymous even to the data controller, and that that was the issue that Lord Hope ordered referred back to the Scottish Information Commissioner. He invokes in support the reasons given by the First Tier Tribunal in Magherafelt District Council v Information Commissioner EA/2009/0047, paragraphs 33 to 34. That, to my mind, cannot be correct. In the Inner House, the Lord President described barnardisation as the random modification of small numbers, and continued ([2007] SC 231, 233)

In my view, the only interpretation open of Lord Hope's order is that it recognised that although the Agency held the information as to the identities of the children to whom the requested information related, it did not follow from that that the information, sufficiently anonymised, would still be personal data when publicly disclosed. All members of the House of Lords agreed with Lord Hope's order demonstrating, in my view, their shared understanding that anonymised data which does not lead to the identification of a living individual does not constitute personal data.

In my judgment, this conclusion maintains faith with Lord Hope's reasoning. The status of information in the data controller's hands did not arise for decision in the CSA case. It was concerned with the implications of disclosure by the data controller, and hence Lord Hope's order. The relevant part of Lord Hope's speech, the background to the order, is paragraph 27, which I quoted earlier. The opening sentence of paragraph 27 acknowledges that the Agency holds the key to identifying the children, but continues that, in his Lordship's opinion, the fact that the Agency had access to this information did not disable it from processing it in such a way consistent with recital 26 of the Directive, "that it becomes data from which a living individual can no longer be identified". That must relate to whether any living individuals can be identified by the public following the disclosure of the information. It cannot relate to whether any living individuals can be identified by the Agency, since that is addressed in the first sentence of the paragraph. Thus the order made by the House of Lords in the CSA case was concerned with the question of fact, whether barnardisation could preclude identification of the relevant individuals by the public.

Secondly, the conclusion reflects the legal backdrop to the definition of personal data in the DPA, which is recital 26 of Directive, with the ambit of protection drawn in the third part of the recital so as not to apply to data rendered anonymous in such a way that the data subject is no longer identifiable. Mr Eadie QC relies heavily on the Article 29 Working Party opinion. Even if the passages he cited, summarised earlier in the judgment, can be interpreted in the manner he contends, the juridical status of this type of advisory report is lower, in my view, than that of the Directive itself.

Finally, any other conclusion seems to me to be divorced from reality. The Department of Health's interpretation is that any statistical information derived from reporting forms or patient records constitutes personal data. If that were the case, any publication would amount to the processing of sensitive personal data. That would be so notwithstanding the statistical exemption in Section 33, since that exemption does not exclude the requirement to satisfy Schedule 3 of the DPA. Thus, the statistic that 100,000 women had an abortion in a particular year would constitute personal data about each of those women, provided that the body that publishes this statistic has access to information which would enable it to identify each of them. That is not a sensible result and would seriously inhibit the ability of healthcare organisations and other bodies to publish medical statistics.

Thus, on this issue, the Tribunal was wrong in its interpretation of the law. As I shall explain shortly, however, it was entitled to arrive at the conclusion that it was extremely remote that the public to whom the statistical data was disclosed would be able to identify individuals from it. In other words: the requested statistics were fully anonymised. It follows that the Tribunal ought to have held that the disclosure of the information to the public did not constitute the processing of personal data.

My conclusion on the personal data issue disposes of the appeal. Since the matter could go further, however, I turn to the grounds of appeal taken by the Department of Health. These are sixfold. In essence, the Department contends that if it succeeds in establishing any one of these grounds – and if I am wrong on the personal data point – the court should hold that the disclosure of the disputed statistics would breach the first data protection principle and that the exemption under Section 40 applies, or at least that the decision should be remitted for a rehearing by the Tribunal.

As a backdrop to the specific grounds of appeal against the Tribunal's analysis and findings, Mr Eadie QC for the Department of Health painted a scene where information about late abortions is of the highest sensitivity. In his submission, the consequences of identification are of the most serious kind – "ghastly", as he characterised it – particularly for the patient concerned, possibly less so for doctors. For that reason, this is an area where no risk whatsoever should be taken of identification, or at least no risk whatsoever without requiring justification of the most compelling kind.

In his submission, the Department of Health has considered the matter with the greatest care, has taken expert advice, and has judged that the previous system of publication carried some risk of identification. That is a judgment which should be respected and cannot be overturned. In Mr Eadie's submission the various heads of justification which the Tribunal advanced in favour of publication are flawed. Thus, there is a plain and serious imbalance. No serious case for publication is available to be set against the possible ghastly consequences. The sensitivity of the issue and the consequences of identification for patients and doctors are patent.

To be set against these obvious sensitivities, Mr Pitt-Payne QC for the Information Commissioner submitted that the other side of the coin is that the subject is one of profound disagreement and considerable debate. He submitted that the Tribunal paid proper regard to both aspects of the issue. He accepted that at the various points when an assessment of risk needs to be made, the greater the risk of identification, the harder it will be to justify disclosure. But in his submission the approach of the Department of Health erroneously seeks to impose a bright-line legal rule of no risk in a context which involves the balancing of competing considerations.

While this backdrop to the appeal cannot be ignored, my approach must be to address the issue strictly in accordance with legal principle. It is clear that the court has no jurisdiction to interfere with the decision of this specialist tribunal unless it is legally flawed: Officer of the House of Commons v Information Commission [2008] EWHC 1084 Admin, [2009] 3 All ER 3, at [6]. What is required is a consideration of each of the grounds of appeal to check whether the Tribunal was on this occasion in error, while not ignoring completely the role of context.

Two errors of law are said to be evident in the Tribunal's handling of evidence. The first is the failure to acknowledge or accord any real weight to the expert evidence; the second, that the Tribunal's conclusion with regard to the degree of risk of identification as a result of publication was not reasonably open to it on the evidence.

Mr Eadie QC began by acknowledging that the Tribunal correctly summarised the main features of the expert evidence. In his submission, however, it then went wrong in its interpretation and application of that evidence. There was what he submitted was a crucial error in the Tribunal's treatment of the evidence about the safety threshold. Behind the figure of 10 for a safe cell was a very considerable body of statistical expertise, including the expert judgement of the Office of National Statistics. However, the Tribunal concluded that the figure of 10 for a safe cell reflected the Department's comfort threshold and was not a statistical consideration. To the extent that that threshold reflected a judgement about risk, rather than a statistical calculation, it was one, submitted Mr Eadie, backed by significant expertise; there was no expert evidence to the contrary to back the Tribunal's conclusion.

Moreover, the Tribunal was in error in considering the evidence about identification. The Department of Health had never suggested that identification was probable. Rather its case had been that if there was some meaningful possibility of identification the disputed information should not be released, given that the circumstances were of an unparalleled sensitivity and the consequences ghastly. The expert evidence clearly supported such a real possibility of identification and produced no grounds for a finding that the risk was extremely remote. The Jepson case illustrated the ever present danger, given the interest that the media had in the issue, and the unpredictable behaviour of some data controllers; in that case, the Metropolitan Police's press release that it was the wrong force and that West Mercia police were responsible for investigating. None of the reasons given by the Tribunal for declining to attach weight to the ONS guidance – for example that it was mere guidance – constituted a relevant or adequate reason for failing to accord due weight to the expert statistical evidence which it represented on what is pre-eminently a statistical question. A similar error affected the Tribunal's treatment of the evidence of experienced civil servants as regards their expert evidence on the risks of identification.

Mr Eadie QC was especially critical of the Tribunal's central conclusion that the risk of identification was extremely remote. At one level, that was contrary to the expert evidence that the risk was a meaningful possibility. At another level, it was a misunderstanding of the Department of Health's case, which was not that individuals could be identified from the statistics alone, but rather that there was a risk of identification by way of the statistics being coupled together with other information. There were also errors, Mr Eadie QC submitted, in the Tribunal's failure to consider whether cell values below five were safe (it only addressed values below 10); the conclusion that self identification was not a relevant risk; and the Tribunal's dismissal of the significance of the Jepson and Nine Year Old Girl cases, which was that the published statistics significantly contributed to the chain of events. Finally Mr Eadie QC was critical of the concept of the "motivated defender", that doctors and NHS bodies were motivated to protect the identity of women undergoing abortions and the doctors performing them, a concept which arose in cross-examination and for which there was no evidence.

In my view, neither of these grounds of appeal can succeed. The Tribunal summarised the expert evidence accurately, as Mr Eadie QC conceded; it cannot be that they were bound to accept it. Moreover the question of weight to be attached to that evidence was one for this expert tribunal, the Information Tribunal.

To begin, the issue before the Tribunal was one of assessment: the likelihood that a living individual could be identified from the statistics. That was in my judgment only partly a question of statistical expertise, as regards matters such as the sensitivity of the data. Partly, also, it was a matter of assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search. These are factors which the Tribunal was in as good a position to evaluate as the statistical experts, a point which one of the Department of Health's experts conceded. The analysis also applies to the evidence of senior civil servants.

Clearly, the ONS guidance had an important bearing on the Tribunal's tasks, and some of the reasons it gave for deciding that it was not determinative do not pass muster. However, the Tribunal explained at some length why it did not accept the scenarios the ONS posited as to how identification would take place. The Tribunal was also critical of the guidance because, in its view, it was heavily influenced by the Jepson and Nine Year Old Girl incidents, but it explained why it did not consider that either case was an example of an individual being identified from statistics. In my view, the Tribunal cannot be said to be in error in concluding that these two cases offered no support to the argument that publication of these statistics would lead to identification of patients.

It was on the basis of a critical evaluation of the expert and departmental evidence, and after a consideration of ONS guidance, that the Tribunal reached its criticised conclusion that the figure of 10 for a safe cell reflected a comfort threshold, and was not a statistical consideration. The Tribunal explained its reasoning for departing from the expert view. Applying its own expertise, it also reached the conclusion – which in my view was open to it – that the possibility of identification by a third party from these statistics was extremely remote. There is no appealable basis in relation to the first ground of appeal.

Nor can I detect error in the conclusions the Tribunal drew from the evidence, or the manner it applied the evidence. It carefully considered the witness statements before it and heard oral evidence over three days. It then weighed that evidence before it reached the findings it did on identifiability. There is no basis on which this court can characterise the Tribunal's approach to the evidence as incorrect. It is evident to me that the Tribunal understood the Department of Health's case that there was a risk of identification by way of statistics being put together with other information. The transcript reveals that the matter was explored in the evidence. The fact is that the statistics are at a national level and reflect a large pool of data subjects, 14.1 million females of child bearing age.

Moreover, there was no example within the past of identification from published statistical information, nor was there any evidence of information in the public domain that could be used in conjunction with these statistics so as to identify individual patients and doctors. The Tribunal evaluated the Department's argument that published statistics could make a significant contribution to the chain of events, but rejected it in relation to both the Jepson and Nine Year Old Girl cases. It did not misinterpret the figure of 10 for a safe cell, or fail to consider the safety of values of five and below, but took the view that the safety threshold was not dependent on statistical expertise alone. It concluded that the possibility of identification by a third party from these statistics was extremely remote, regardless of the frequency of cell numbers, whether the value was zero to five, or 90 to 100. In summary, there is no legal flaw in its handling of the evidence.

As I have indicated, Mr Eadie QC began with the unparalleled sensitivity of the issue of late term abortions. In his submission, the Tribunal was correct in its assessment of the devastating consequences of identification, in particular for patients, but then downgraded this because there had been no reported case of prosecutions or of civil actions against anti-abortion campaigners for harassment. At various points the Tribunal characterised the identification of risk as extremely remote, remote, and not likely. What, in Mr Eadie's submission, was necessary was for it to reach an unambiguous conclusion on the level of identification risk. It should then have directed itself, since the consequences of identification were potentially so devastating, that no risk, or at least negligible risk, of those consequences arising could be tolerated without compelling justification. Even if the Tribunal was correct in the risk of identification being extremely remote, Mr Eadie QC submitted that the seriousness of consequences on the other side of the balance meant that the disclosure of the disputed information was disproportionate. In proceeding as it did, the Tribunal thus failed to address an essential part of the case and thus erred in law.

In my view, this ground of appeal goes nowhere. As I have described, the Tribunal accepted the devastating consequences of identification. While it placed great weight on them, it concluded that these consequences were all dependent upon a patient being identified. The Tribunal was satisfied that this was extremely remote, that being the key conclusion at the end of the many paragraphs discussing the issue. Essentially, this was a matter of judgement for the Tribunal. It then acted entirely properly in reaching an overall assessment of the likelihood of identification arising from the publication of requested information. The Tribunal's assessment under schedule 2 of the DPA is especially telling, in my view, in refuting Mr Eadie's submission. There the Tribunal carried out the proportionality analysis, balancing the different interests. There was no error of law in its approach to sensitivity. Let me turn then to schedule 2.

Mr Eadie QC next attacked the Tribunal's analysis of the reasons justifying disclosure of the requested information and, as a matter of law, its analysis of the application of schedules 2 and 3 of the DPA. In his submission, these reasons did not match the test of necessity laid down in schedule 2, paragraph 6, or schedule 3, paragraph 7. Broadly speaking, his submission was that the Tribunal's analysis fell short of the requisite standard in that the purposes advanced for disclosure did not pursue a legitimate aim. Those purposes could be achieved by means which had less potential for the risk of the ghastly consequences of identification for patients. Even if disclosure was necessary to promote a legitimate objective, disclosure would be disproportionate.

Thus the Tribunal's reason, that the disclosure of requested information would facilitate compliance with the Abortion Act, disregarded the already rigorous mechanisms in place by which the Department of Health achieved that aim. Mr Eadie QC took me through the procedures laid down by Parliament. Two doctors are required to certify a late term abortion. The Department of Health then checks the certification and it reverts to relevant doctors if any required information is missing or incorrect. Certificates are followed up with signatory doctors each year, and the Department has referred cases to the police for investigation. Moreover, doctors' conduct is supervised and regulated by employers and professional medical associations. There is nothing in the witness evidence to suggest any weakness in this system, yet the test of necessity demanded that the Tribunal find the system was inadequate. If there were shortcomings in the system, that would be a matter for Parliament.

As to the Tribunal's reasons that disclosure would enable public scrutiny of the way abortion law is applied, Mr Eadie QC submitted first, that there were already the mechanisms described, and that there was no need for an additional level of oversight. Secondly, there was a great deal of information available in aggregate form in the statistical bulletin, and a breakdown on a year by year basis would not offer additional insight into how the law was being applied. Nor would it offer any basis for asking the Department of Health to investigate any late term abortions. A member of the public wishing for a reassurance could request the Department of Health to investigate without these statistics. The Tribunal's notion of providing external checks and balances to the Department of Health scrutiny was advanced, in Mr Eadie's submission, without any evidential basis. As to the reasons that disclosure of the disputed information would ensure accountability in relation to practitioners, the Tribunal's reasoning on the point was again speculative. There are already complex mechanisms to ensure accountability of practitioners.

The remaining aims favouring disclosure considered by the Tribunal were, in Mr Eadie's charactarisation, make-weight. Neither necessity nor proportionality was made out. The aims of planning healthcare services in identifying trends failed to acknowledge that the Department of Health itself, which had full access to the statistics, and had the capacity to undertake those responsibilities. It was difficult to see how planning could be assisted or these objectives furthered by the disclosure of the requested information, especially given the low numbers in that data. As to the aim of furthering public debate, these statistics were not pertinent. It was the possibility that certain types of abortions were possible, obvious on the face of these statistical bulletins, which was at the heart of the public debate. Even if the disclosure of statistics on a year by year basis would enhance public debate, such incremental good was plainly disproportionate given the devastating consequences of a patient being identified.

In terms of the consideration of Schedule 3, paragraph 7 Mr Eadie QC submitted that in no way could it be said that the disclosure of the information was necessary for the exercise of functions conferred on the Department of Health by or under legislation. In very short order, the Tribunal took it from one of the Department's own witnesses that the publication of statistics was a departmental function. The fact is that while the Department of Health does publish statistics, that is ancillary to its statutory function, and there is no enactment authorising it to do so. The issues under Schedule 2, paragraph 6, and Schedule 3, paragraph 7, are different, and the Tribunal was wrong in transposing its reasoning on the first to the second. Even if the Department of Health does have a function of publishing statistics, it had performed that function without publishing the particular statistics which were requested. The Tribunal suggested no reason why the omission of the publication of those particular statistics had prejudiced the Department's performance of its functions, or was otherwise necessary for their performance.

Wounding though some of Mr Eadie's points may be they are not, in my judgement, fatal to the analysis that the Tribunal brought to bear in considering that disclosure was justified under Schedule 2, paragraph 6, and Schedule 3, paragraph 7. The purpose of checking compliance with the Abortion Act had support from the Department of Health's own witnesses who explained that, while approximately 5 per cent of the certificates were followed up with doctors each year, the focus of the internal checks was on the procedural requirements and were not aimed to second guess doctors' decisions. While doctors' conduct is regulated by their employers and professional associations, neither have available to them the information on abortions held by the Department. Cases can be referred to the police, but the evidence from the Department was that it would expect to see a particular cause of concern before doing this. Enabling public scrutiny of the way abortion law applies had some support in the evidence of Professor Campbell, that it was not always possible to establish what particular abnormality underlay a termination or the gestation. The Tribunal accepted his evidence, for example that it was important that the data was available for scrutiny so that society would know how the current legislation was being interpreted.

To Mr Eadie's contention that the statistics are available in aggregate, and that a breakdown on a year by year basis offers no further insight, the Tribunal's answer was that waiting until publication of the aggregated statistics, and then asking for all 10 or more cases to be investigated, would be disproportionate and would be an unnecessary waste of public costs. That, to me, is not flawed reasoning. As to the public statistics leading to greater accountability of medical practitioners, the Tribunal accepted Professor Campbell's evidence that it was useful to have checks and balances to what otherwise was a self regulatory system, with no proper external scrutiny. The Tribunal was concerned that there was no mechanism for rigorous scrutiny of the forms internally to ensure compliance with the Abortion Act, describing it as a system of self regulation with no audit, spot checks, outside opinions, or quality control on the grounds for the terminations. As to ensuring that public debate was balanced and factually based, the Tribunal gave reasons as to why it did not consider that that was as well informed with aggregate instead of the detailed figures. There was evidence from the Rt Hon Ann Widdecombe MP, that she had found it difficult to obtain reliable statistics to inform Parliamentary debate and scrutiny.

In my view, in advancing each of these justifications, the Tribunal adduced evidence in support, albeit that some of the evidence was not especially strong. Secondly, even if any particular purpose might appear weak, all went into the balance enabling the Tribunal to reach the conclusion, properly in my judgement, that disclosure was proportionate. As to the Tribunal's consideration of Schedule 3 and its conclusion under paragraph 7, the Tribunal drew on the Department of Health's own evidence that the publication of statistics was one of its functions. It was open to the Tribunal to conclude that publication of the requested information was necessary for the exercise of that function. The plain fact is that the Department of Health has been publishing abortion statistics since it assumed the task from the ONS in 2002. Although it may have been preferable for the Tribunal to spell out to a greater extent the Schedule 3 analysis, in my view there is no error in its reading across reasons set out in its Schedule 2 analysis across to justify disclosure under Schedule 3.

The criticism here was that the Tribunal dealt with Article 8 in two short paragraphs and concluded that Article 8.1 was not engaged because the risk of interference could not be demonstrated. On the assumption that it was engaged the criticism was that the treatment of pressing social need and proportionality were wholly inadequate. The disclosure of the requested information, in Mr Eadie's submission, was neither necessary nor proportionate to the achievement of the aims contained in Article 8.2. Under this head, it is convenient also to mention Mr Eadie's submission that Article 8 claims in Strasbourg would put the government in great difficulty when it was asserting that disclosure was unnecessary.

In my view, the Tribunal was not flawed in concluding that the risk of individual identification is so remote that the right under Article 8.1 was not engaged. Even if it were wrong in that regard, any interference is prescribed by law under the Abortion Regulations. The reasons the Tribunal gave in relation to paragraph 6, Schedule 2, were a basis to conclude that any interference was both necessary and proportionate. Mr Eadie's Strasbourg point was, in my view, very much a jury argument.

In my view, therefore, the Tribunal was in error in holding that the requested information was personal data. If I am wrong in this, the Tribunal was entitled to reach the finding it did. In either event the result is that the appeal is dismissed and the Tribunal's decision to order the release of the abortion statistics is upheld.

MR EADIE: My Lord, can I say – I'm sure, on behalf of both of us – that we are both very grateful that my Lord has managed to grasp it so quickly and produce a judgment so quickly.

MR JUSTICE CRANSTON: I am very pleased to see you; of course, I didn't expect you to be here.

MR EADIE: Well, it was only because Mr Coppel had a serious difficulty he could not get out of. Perhaps, in the light of judgment it would have been better if I had stayed at home, but here I am. So my Lord, thanks, first of all.

Secondly, we will obviously need to consider that judgment with some care to work out what we do next, as it were, but we are all well aware that you are going away to other parts, and everyone is about to go off on holiday and there is going to be an interregnum.

What I was going to invite my Lord to do is this: first of all, on costs, both sides are agreed there is to be no order as to costs; they are both public authorities, that is obviously a sensible course, so that does not need to trouble you.

We will, I think, formally need, on any view, whatever else happens, a stay, pending the final resolution of this issue. That is also plainly sensible; no private interests are involved; when the process ends it either will or will not be disclosed, so we would ask for that formally.

We would also ask at this point, to save having to come back and do it in writing, for permission to appeal. My Lord, you will appreciate that the personal data point is a point of some importance and some broader importance, and it would be a little short of bizarre, perhaps, for that point to go up without, as it were, the practical consequence of the rest of it going up at the same time. So we would respectfully ask for permission to appeal to the Court of Appeal. My learned friend…

MS CLEMENT: My Lord, I just rise at that point to perhaps remind Mr Eadie this is a second appeal, so permission would have to be sought from the Court of Appeal itself, and your Lordship doesn't have power to grant it.

MR EADIE: I had forgotten that. In which case, we shall go to the Court of Appeal. We just need a stay. That leads to the final thing which is timings. CPR 524 has a default period, as I am sure you will recall, of 21 days.

MR JUSTICE CRANSTON: You want more than that?

MR EADIE: Can we have more than that?

MR JUSTICE CRANSTON: Yes.

MR EADIE: We obviously need to think about it and then make application, if we need to, to the Court of Appeal.

MR JUSTICE CRANSTON: Yes. I'm just enquiring about the time it would take given the Easter break to get the judgment.

MR EADIE: Hopefully it is a nice long period.

MR JUSTICE CRANSTON: No, in fact it can be done very quickly.

MR EADIE: I'm terrified.

MR JUSTICE CRANSTON: But I think the best idea might be to say you can have so many days after.

MR EADIE: Can we have 28 days from receipt of a perfected judgment.

MR JUSTICE CRANSTON: Yes, I think that's the best idea. Is there anything more?

MS CLEMENT: My Lord, no, not from this side.

MR JUSTICE CRANSTON: Thank you very much. I apologise for the length of the judgment. That was partly because it was done so quickly, and obviously I could not have done it without the assistance of both sides. The skeletons and the information bundles were splendid, and just made the judge's task so much easier. So thank you very much.