DATA SHARING: LEGAL GUIDANCE FOR THE SCOTTISH PUBLIC SECTOR
SECTION 4: THE HUMAN RIGHTS ACT 1998 AND THE EUROPEAN CONVENTION ON HUMAN RIGHTS
The Human Rights Act 1998 ('the HRA') came into force on 2 October 2000 and it gives effect to the principal rights guaranteed by the European Convention on Human Rights ('the Convention'). The Convention was adopted by the Council of Europe in 1950 and ratified by the United Kingdom in 1951. It contains a number of fundamental rights and freedoms including the right to life, the right to a fair trial, freedom of thought, religion and speech and the right to respect for private and family life.
Before 2 October 2000, the rights contained in the Convention could only be enforced in the European Commission and the Court of Human Rights established in Strasbourg. The exception to this was that, from 1 July 1999 onwards, members of the Scottish Executive had no power to make subordinate legislation or do any other Act which would be incompatible with the Convention rights given effect to in the HRA. 9 Accordingly, Scottish Ministers were required to act in accordance with the Convention rights more than one year before other public bodies, and could be challenged in domestic courts for acts that were not in accordance with these rights.
Convention rights have become part of domestic law and can be enforced directly in our courts by any person who claims to be a 'victim' of an infringement. There remains a right to bring cases in the Strasbourg court after pursuing domestic remedies.
The key aspects of the HRA are that:
- all legislation must be interpreted so far as is possible to do so to be compatible with the Convention (section 3 (1));
- it is unlawful for a public body to act in a way that is incompatible with convention rights (section 6);
- all courts and tribunals are required to take account of relevant decisions of the European Court of Human Rights (section 2);
- higher courts may make a declaration of incompatibility in respect of incompatible primary legislation. Such declarations do not, however, change the law as it is still for parliament to do so (section 4).
Article 8 of the Convention is of particular importance in the context of data sharing and privacy.
Article 8 provides that:
'8.1. Everyone has the right to respect for his private and family life, his home and his correspondence.
8.2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.'
Article 8 is broad in scope and covers the collection, use and exchange of personal data as well as issues such as telephone tapping, parental access and custody of children, the right to be free from noise and environmental pollution and a person's right to express his or her identity and sexuality. In the case of R (Robertson) v City of Wakefield Metropolitan Council [2002] 2 WLR 889 Kay J sitting in the English Administrative Court held that Article 8 was engaged by the provision of a person's current name and address under statutory electoral roll obligations; Article 8 was not exclusively concerned with more obviously sensitive details than simply a name and address. In determining whether Article 8 was engaged it was necessary to take into account not simply the information that was disclosed but also the anticipated use to which it would be put. Where names and addresses were to be passed on to commercial concerns for direct marketing purposes this would amount to an interference with the right to private life.
Article 8 is not an absolute right. It is a qualified right that allows a public authority to interfere where that interference is:
- in accordance with law;
- in the pursuit of a legitimate aim; and
- necessary in a democratic society.
The first element requires a legal basis to permit data sharing that is a clear, reasonably accessible legal basis for the interference. Legislation, delegated legislation, the common law and even rules of a professional body may suffice. The second element encompasses a broad range of legitimate aims such as economic well-being, crime protection or reduction, and the protection of health or morals. Satisfaction of the third element, 'necessary in a democratic society', will probably be the key factor in the majority of cases. In determining this element courts are required to look at all the circumstances of the case and assess whether the exercise of the power was 'proportionate'. This assessment is not straightforward and will involve the court in considering whether the means chosen were necessary, whether adequate safeguards are in place and whether the aims were legitimate and sufficiently well defined. In the House of Lords case of R v Secretary of State for the Home Department, ex parte Daly [2001] UKHL 26 Lord Steyn set out a new test to be adopted by the courts in assessing the proportionality principle. In his judgment he emphasised the high level of intensity of review under the proportionality approach in that:
- the reviewing court may need to assess the balance which the decision maker has struck;
- the court may need to direct attention to the relative weight accorded to interests and considerations;
- the proportionality test may require the court to go further than the test of 'heightened scrutiny' previously adopted on judicial review. In particular, the test of heightened scrutiny was developed in R v Ministry of Defence, ex parte Smith [1996] 1 All ER 257 which was heard by the English Court of Appeal before the HRA came into force. Here it was held that the more substantial the interference with human rights, the more the court would require by way of justification before it was satisfied that the decision was reasonable. However, the court would still only interfere with an administrative decision where it was satisfied that the decision was beyond the range of reasonable responses open to a reasonable decision-maker.
The European Court of Human Rights has considered a number of cases involving the disclosure of personal data between public authorities. In the case of M.S. v Sweden, (Application number 00020837/92 dated 27 August 1997) the applicant contested the disclosure of her medical history to the Swedish Social Insurance Office following a claim for industrial injury compensation. The disclosure was made pursuant to relevant provisions in Swedish law, namely, the Secrecy Act and the Insurance Act. The court found that the disclosure was not in breach of Article 8 of the ECHR because: (a) there was a legal basis for the interference; (b) the object of the disclosure was to determine the allocation of public funds and so was in the pursuit of a legitimate aim, namely, the economic well-being of the country; and (c) the disclosure was necessary as the medical records were relevant to the applicant's compensation claim. In addition, disclosure was subject to effective and adequate safeguards as the relevant legislation provided that duties of confidentiality applied which were subject to criminal and civil penalties if breached. Accordingly, the measure was not disproportionate to the aim pursued.
Other important relevant cases have considered the compulsory provision of information to public bodies. In X v UK 30 DR 239 1982 the court found that a statutory requirement for the compulsory provision of information, backed up by criminal sanctions to be used in the event that an individual refused to comply, in connection with a national census was a justifiable interference with Article 8 privacy rights. The interference could be considered necessary in a democratic society given that individual privacy was sufficiently protected and the aim of the census was the legitimate one of the pursuit of the economic well being of the country. Similarly, in the case of X v Belgium 31 DR 231 1982 the court found that the obligatory provision of details of private expenditure to the tax authorities in connection with an income tax return could be justified in the circumstances as the authorities had a legitimate need for evidence considering the disposal of substantial assets.
The cases of X v the UK and X v Belgium also illustrate that when a failure to provide information constitutes a criminal offence the interference with Article 8 privacy rights may still satisfy the 'in accordance with the law' requirement where the obligation is enshrined in statute. But even where an obligation to provide information is enshrined in statute, it is still necessary to show that the interference is necessary in a democratic society, and that the aim of the collection of information is the legitimate one of serving the economic well-being of the country.
Despite its wide scope, the HRA does not remove the requirements of other areas of law (although there may be some overlap). For example, the requirements of the DPA still need to be satisfied.
The Court of Appeal stated in its judgement in Douglas and others v Hello! and others [2003] EWHC 786 Ch, at para 229, that no general, free-standing right to privacy existed under the UK law. Among other things, the breadth of the subject of privacy makes it such that it is better left to Parliament to make any such law in this area.