In May 2010, Mr Mark Irvine made a number of requests under the Freedom of Information (Scotland) Act 2002 (FOISA) for information from South Lanarkshire Council. He wanted to know how many of their employees in a particular post were placed at 10 particular points on the Council’s pay scales. His underlying purpose was to find out whether the Council’s pay gradings favoured work traditionally done by men. He did not want to know the names of the employees concerned. The Council refused his request on the ground that to comply with it would contravene the Data Protection Act 1998 (DPA). Mr Irvine complained to the Scottish Information Commissioner who investigated and decided that the information should be disclosed. The Council appealed unsuccessfully to the Inner House of the Court of Session and now appeals to this Court.

There are two issues before this Court. First and most important is the proper interpretation of condition 6 in Schedule 2 to the 1998 Act. It is common ground for the purpose of this case that the information requested is “personal data” in the hands of the Council as data controller. Personal data may only be processed if one of the conditions in Schedule 2 is met and condition 6 is the only relevant condition:

The second issue is whether the Commissioner acted in breach of natural justice by failing to disclose to the Council all of the communications passing between the Commissioner and Mr Irvine and two Members of the Scottish Parliament in the course of his investigations.

The inter-relationship between the DPA 1998 and the FOISA 2002 is uncontroversial in these proceedings. Information is absolutely exempt from disclosure under the FOISA if it constitutes personal data under the DPA and disclosure to a member of the public would contravene any of the data protection principles in that Act (FOISA, s 38(1)(b) and (3)). The first data protection principle is that “personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless - (a) at least one of the conditions in Schedule 2 is met” (DPA, Sched 1, para 1).

As Lord Rodger of Earlsferry pointed out in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, 2008 SC (HL) 184, this means that the safeguards against the disclosure of personal data which applied before the enactment of the FOISA continue to apply. He went on:

What the FOISA does, therefore, is give the person who requests the information a right to have that information disclosed to him (s 1(1)) provided that this does not contravene the DPA. This is, of course, a right which he did not have before the FOISA was passed, but it is not a right which trumps the provisions of the DPA.

The DPA is the means whereby the United Kingdom has translated Council Directive 95/46/EC (1995) on the protection of individuals with regard to the processing of personal data and on the free movement of such data into UK law and must therefore be interpreted in conformity with that Directive. Article 1(1) requires that Member States “shall protect the fundamental rights and freedoms of natural persons and in particular their right to privacy with respect to the processing of personal data”. Article 7 requires Member States to provide that personal data may be processed only if one or more of six paragraphs applies. It is worth setting out those paragraphs in full, because they correspond (although not always in exactly the same terms) with conditions 1 to 6 in Schedule 2 to the DPA:

Several points are worth noticing. First, these paragraphs apply to all kinds of processing, not just to disclosure under the FOISA, which in practice may mean disclosure to the whole wide world. Processing means any kind of operation performed on the data, such as collecting, recording, organising, storing, adapting or altering, retrieving, consulting, using, disclosing or otherwise making available, aligning or combining, blocking, erasing or destroying (article 2(b); see DPA s 1(1) and (2)). Second, therefore, any interpretation of the conditions under which processing is permitted must be capable of being applied to all those many different ways in which data may be processed. Third, it would be surprising if the word “necessary”, which appears in all the conditions except the first, were to have a different meaning in different conditions. Mrs Wolffe QC, who appears for the Council, correctly points out that article 7 is derived from the first part of Recital (30), which lists the substance of paragraphs (b) to (f) after a single “necessary”. Fourth, therefore, any interpretation given to the word “necessary” must be capable of applying equally well to each of those situations, some of which involve compliance with legal obligations. Fifth, the only paragraph which contains a built-in balance between the rights of the data subject and the need to process the data is paragraph (f) and condition 6.

On 10 May 2010, Mr Irvine wrote to the Council making the following request for information under the FOISA:

On 11 October, Mr Irvine wrote to the Scottish Information Commissioner asking for a decision. He stated:

On 21 October, the Commissioner notified the Council that he was investigating the application and provided the Council with a copy of it (as required by FOISA, s 49(3)). On 18 November, he wrote asking the Council to explain why it considered that the information was exempt from disclosure under the FOISA (as also required by s 49(3)). The Council replied on 1 December, arguing that Mr Irvine had no legitimate interest in disclosure of the information and that disclosure was not necessary for the purpose of his legitimate interests. Thus the Council was fully aware that the relevant condition was condition 6.

Meanwhile, the Commissioner had received a letter from Alex Neil MSP, supporting Mr Irvine’s request. On 19 November the Commissioner emailed Mr Irvine drawing attention to condition 6 as being the only condition which he thought might apply and requesting Mr Irvine’s submissions upon it. On 26 November, Mr Irvine replied stating, inter alia:

None of the correspondence referred to in the previous paragraph was disclosed to the Council, nor was the Council asked to provide any further comments or representations to the Commissioner.

The Commissioner issued his decision on 17 March 2011: Decision 056/2011. He considered it arguable that the data requested were not personal data, but went on to consider whether disclosure would breach the data protection principles (para 27). He directed himself (para 34) that there were three tests to be satisfied before condition 6 could be met:

The Commissioner concluded (para 44) that Mr Irvine did have a legitimate interest in obtaining the information requested. He has a “serious, ongoing interest in equal pay matters”. These were also matters of legitimate wider interest, both to employees of the Council and the wider public:

Before the Inner House, as in this Court, the principal argument focussed on the meaning of “necessary” in condition 6. As is clear from paragraph 34 of his Decision (quoted at para 14 above), the Commissioner had adopted a proportionality approach. Counsel for the Commissioner argued that this was correct in the light of the decision of the Information Tribunal and the Divisional Court in the English case of Corporate Officer of the House of Commons v The Information Commissioner [2008] EWHC 1084 (Admin), [2009] 3 All ER 403 (the House of Commons case). Mrs Wolffe, for the Council, submitted that it should be given its natural and ordinary meaning. The Inner House saw the force of that and, “but for the authority just cited, we would have had little hesitation in giving effect to it”. But they found it unnecessary to form a concluded view as to the correct approach, because they were satisfied that “even applying the stricter test the Commissioner could only have concluded that necessity was made out” (para 10).

The Inner House also held that there was no breach of natural justice in failing to disclose the matters referred to in para 12 above, because many, if not all, were previously within the knowledge of the Council and, insofar as relevant, they could be made the subject of legal submissions to the court (para 5).

It is obvious that condition 6 requires three questions to be answered:

It is not obvious why any further exegesis of those questions is required. However, in the House of Commons case, the Information Tribunal (unreported) 26 February 2008 accepted that “ ‘necessary’ carries with it connotations from the European Convention on Human Rights, including the proposition that a pressing social need is involved and that the measure employed is proportionate to a legitimate aim being pursued” (para 59). By the time the case reached the Divisional Court, “It was common ground that ‘necessary’ within para 6 of Sched 2 to the DPA should reflect the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely that there should be a pressing social need and that the interference was both proportionate as to means and fairly balanced as to ends” (para 43).

That this was common ground is not surprising, in view of the decision of the European Court of Justice in Rechnungshof v Ősterreichischer Rundfunk (Joined Cases C-465/00, C-138/01 and C-139/01) [2003] 3 CMLR 265 (the Austrian Radio case). Austrian law required public bodies subject to control by the Court of Auditors to report to it the names, salaries and pensions above a certain level paid to their employees and pensioners. The Court of Auditors would then make a report to Parliament which would be made public, the object being to exert pressure on public bodies to keep remuneration within reasonable limits. The Court of Auditors brought proceedings against Austrian radio and other bodies who refused to provide the information and some of the individuals involved brought proceedings contesting the compatibility of the legislation with their fundamental rights and with the Directive. A principal issue was whether publishing these data fell within article 7(c) or (e) (see para 7 above).

The European Court of Justice stated that “the provisions of Directive 95/46, in so far as they govern the processing of personal data likely to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of fundamental rights, which, according to settled case law, form an integral part of the general principles of law whose observance the Court ensures” (para 68). It went on to hold that for an employer to publish the names and incomes of employees to a third party was an interference with the right to respect for private life, protected by article 8 of the European Convention on Human Rights (para 74), but that it might be justified if it was both necessary for and appropriate to the aim of keeping salaries within reasonable limits, that being for the national courts to determine (para 90). But if the national legislation was incompatible with article 8, then it was also incapable of satisfying the requirements of proportionality in article 7(c) or (e) of Directive 95/46.

In Huber v Bundesrepublik Deutschland (Case C-524/06) [2009] 1 CMLR 1360, an Austrian businessman who had moved to Germany complained that storing data relating to him in a central register of foreign nationals discriminated against him as there was no such database for German nationals. Advocate General Poiares Maduro pointed out that

The Court did not, however, supply its own definition of “necessary”, nor has it done so in later cases (such as Volker und Marcus Schecke GbR v Land Hessen; Eifert v Land Hessen (Joined Cases C-92/09 and 93/09, [2012] All ER (EC) 127). Nevertheless, Mrs Wolffe contends that Huber imports a stricter test of necessity into article 7 and that while proportionality may come into other aspects of the conditions it does not come into “necessary”. She points out that the Court in Huber did not adopt the Advocate General’s formulation and although it referred to the Austrian Radio case it did not refer to the passages cited above. She does, however, stop short of arguing that “necessary” means “absolutely necessary” or even “strictly necessary”. She has also to accept that something may be necessary if it makes furthering the purposes of a legitimate interest more effective.

I confess to having had some difficulty in understanding how that argument, skilfully and attractively advanced though it was, can help the Council’s case. One might have thought it to its advantage to import the requirement of a “pressing social need” from the article 8 jurisprudence into condition 6. This might be thought a stricter test than that of a legitimate interest, which may be a purely private interest, in condition 6 and thus make the related test of necessity more difficult to fulfil.

I agree with Mrs Wolffe to this extent: the word “necessary” has to be considered in relation to the processing to which it relates. If that processing would involve an interference with the data subject’s right to respect for his private life, then the Austrian Radio case is clear authority for the proposition that the requirements of article 8(2) of the European Convention on Human Rights must be fulfilled. However, that was a case about article 7(e), where there is no express counterbalancing of the necessary processing against the rights and interests of the data subject. In a case such as this, where that balance is built into article 7(f) and condition 6, it may not matter so much where the requirements of article 8(2) are considered, as long as the overall result is compliant with them.

In this particular case, however, as the processing requested would not enable Mr Irvine or anyone else to discover the identity of the data subjects, it is quite difficult to see why there is any interference with their right to respect for their private lives. It is enough to apply article 7(f) and condition 6 in their own terms.

I disagree with Mrs Wolffe, however, about the meaning of “necessary”. It might be thought that, if there is no interference with article 8 rights involved, then all that has to be asked is whether the requester is pursuing a legitimate interest in seeking the information (which is not at issue in this case) and whether he needs that information in order to pursue it. It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if Mr Irvine had asked for the names and addresses of the employees concerned, not only would article 8 have clearly been engaged, but the Commissioner would have had to ask himself whether his legitimate interests could have been served by a lesser degree of disclosure.

My conclusion is, therefore, that the Commissioner adopted a test which was probably more favourable to the Council than was required and certainly no less favourable. In any event it is quite clear that he was entitled to reach the conclusion that he did.

It is, of course, common ground that the Commissioner has a duty to act fairly. In Glasgow City Council v Scottish Information Commissioner [2009] CSIH 73, 2010 SC 125, Lord Reed, delivering the opinion of the Inner House, cited (at para 81) the well-known words of Lord Mustill in R v Secretary of State for the Home Department, Ex p Doody [1994] 1 AC 531 at 560, on the essentials of fairness involved in administrative decision-making. Lord Reed continued (para 82):

There are some important messages to be derived from that passage. The Commissioner receives applications from ordinary members of the public. They cannot be expected to have the expert knowledge of the FOISA and the DPA that he must have, nor should they be expected to instruct lawyers in order to exercise their rights. So the Commissioner must be entitled, as are ombudsmen, to formulate the case on behalf of applicants. He must also be entitled to make his own inquiries. He is required by statute to seek the public authority’s observations upon the application. The public authority are, however, much more likely to be aware of the legislation than is the applicant, so it is unlikely that the Commissioner will have to formulate their case for them. But he must, of course, give them notice of any new material which his inquiries have elicited and which is adverse to their interests.

I would add that the Commissioner is fulfilling more than an administrative function. He is adjudicating upon competing claims. And in Scotland, unlike England and Wales, there is no appeal to a tribunal which can decide questions of both fact and law. The Commissioner is the sole finder of facts, with a right of appeal to the Inner House on a point of law only. These factors clearly enhance his duty to be fair. If wrong findings of fact are made as a result of an unfair process, the Inner House will not be able to correct them.

However, it does not follow that every communication passing between the Commissioner and the applicant, or between the Commissioner and third parties such as Members of the Scottish Parliament, has to be copied to the public authority. I have set out the substance of the communications which were not copied to the Council in some detail in para 12 above. It is clear that the Council was fully aware that the principal questions were whether these were personal data and, if so, whether condition 6 was made out. It is also clear from the exchanges between Mr Irvine and the Council when Mr Irvine first made and renewed his request, that the Council was fully aware of the reasons why Mr Irvine wanted this information and the nature of his interest in it. They knew all about his connection with Action4Equality, his blog, and the equal pay litigation. They knew that this concerned the implementation of the Single Status (Equal Pay) Agreement. They knew that he was alleging that other local authorities had made this information available without question. The letters from the two MSPs added nothing to the argument.

In the circumstances, therefore, it was not a breach of the rules of natural justice for the Commissioner to refrain from copying the correspondence to the Council.

I would therefore dismiss this appeal.