(615) FoI WINS OUT OVER DATA PROTECTION
The first Court of Session case on the Freedom of Information (Scotland) Act 2002 ended in victory for the Scottish Information Commissioner, Kevin Dunion, on 1 December 2006. The case is Common Services Agency v Scottish Information Commissioner [2006] CSIH 58. The Agency had been requested to provide information on recorded incidence of childhood leukemia in Dumfries and Galloway from 1990 to 2003, but had declined to provide the material it held on the ground that the data included material from which individuals might be identified, and so, being covered by the Data Protection Act 1998, was exempt from the FoI requirement. The total number of childhood leukemia incidents in the period in question was 15 and this, combined with information about the location of each incident within Dumfries and Galloway, meant that each victim might be identifiable with a little more investigation by the inquirer (an MSP’s assistant). The principal question came to be the data protection one, whether data modified to protect individual confidentiality could nonetheless itself be personal data which should not be disclosed. The First Division followed Durant v Financial Services Authority [2003] EWCA Civ 1746 and held that the modified information was not personal data of any individual child, since it contained no biographical detail; their privacy would not be infringed by FoI disclosure. While this means that the court took a narrow approach to the data protection requirements, it also took a significantly broad approach to the FoI ones, Lord Marnoch saying, I am of opinion that the statute