DATA SHARING: LEGAL GUIDANCE FOR THE SCOTTISH PUBLIC SECTOR
SECTION 5: COMMON LAW AND STATUTORY OBLIGATIONS OF CONFIDENCE
In certain circumstances, individuals may have a right to bring legal proceedings on the basis that the collection, use and disclosure of personal information amounts to a breach of a common law or statutory obligation of confidence. The law of Scotland on breach of confidence is marked by some uncertainty. However, it is clear from the case of Lord Advocate v Scotsman Publications Ltd 1989 SC (HL) 122 that the law in England and Wales and Scotland in this area is to the same effect. Accordingly, cases from England and Wales are of assistance in determining the extent to which obligations of confidence arise.
In general terms, the law of confidence protects information provided that it can be shown that:
- the information in question has the necessary 'quality of confidence'. This means that the information should not be in the public domain or readily available from another source (though the fact that the information may be known to a limited class of persons does not destroy confidentiality) and it should have a degree of sensitivity and value;
- the information in question was communicated in circumstances giving rise to an obligation of confidence. The obligation of confidence may be express or implied from the circumstances such as where there is a special relationship between professionals, for example, relationships between doctors and bankers and their clients;
- there was an unauthorised use of that material. From the authorities it is unclear whether it is always necessary to prove damage or detriment. It is not necessary to prove dishonesty.
Confidentiality is not, however, an absolute right. It has long been established that just cause or excuse and acting in the public interest are defences to an action for breach of confidence. For example, the defence extends to crimes, frauds and other forms of wrongdoing where disclosure is in the public interest. Now that the HRA is in force, it is also necessary for the courts to take into account Strasbourg case law relating to the justification of interferences with the Article 8 right to privacy. So, for example, where Article 8 rights are engaged the interference must be necessary and proportionate to the end pursued in order for it to be in the public interest. The European Court of Human rights applied these principles in the case of Campbell v UK (1993) 15 EHRR 137 when it held that the blanket opening of prisoners' mail to determine whether it contained prohibited material was not justified since the lesser measure of opening mail where there was a reasonable ground to suspect that it contained such material would have sufficed. In any event, an application of Convention principles may yield the same result as that obtained from the application of common law principles.
As regards data sharing, government departments, local authorities and other public bodies that have access to confidential information relating to citizens may owe duties of confidence. In relation to information held by public authorities the same principles apply as would apply to information held by private persons and organisations. It follows that public authorities cannot do what they like with personal information without adhering to principles arising from the common law obligation of confidence. For the purposes of the law of confidence it is clear that different government departments are treated as separate legal persons which means that information cannot be freely disclosed between government departments without taking into account of the common law of breach of confidence.
It is likely that names and addresses of individuals that are supplied to public bodies in pursuance of their functions would in some cases amount to confidential information subject to which the common law of breach of confidence would apply. For example, names and addresses of individuals supplied to the Department for Work and Pensions for the purposes of a benefit claim is not just a list of names and addresses but a list of names and addresses of those claiming benefit. This is information which is not readily available from any other source, it gives personal details which individuals would not expect to see being disclosed and used by any other body as it is given for specified purposes.
Related to common law obligations of confidence are miscellaneous statutory obligations that may prohibit the disclosure of certain types of information by imposing specific obligations of confidence. Legislation of this nature is disparate covering topics such as:
- medical confidentiality (for example the Abortion Act 1967 and the Access to Medical Reports Act 1988);
- information supplied in connection with legal proceedings (various rules of court);
- health and safety (section 27 and 28 of the Health and Safety at Work etc. Act 1974);
- information supplied to the Inland Revenue ( section 182 of the Finance Act 1989 and section 6 and Schedule 1 to the Taxes Management Act 1970);
- information supplied to the Child Support Agency ( section 50 of the Child Support Act 1991);
- information obtained under powers in the Companies Act 1985 ( section 449).
It is important to ensure that any proposed disclosure of personal data by a public body does not result in it inadvertently committing a criminal offence. As noted above, there are a number of statutory restrictions on the use and disclosure of information which preclude a public body from sharing information and provide that any disclosure of certain information will constitute a criminal offence unless that disclosure falls within one of the statutory gateways of the relevant legislation.
Some statutory prohibitions may, however, contain discretion to disclose. In any event, it is possible that statutory obligations of this type may be overridden in a similar way to common law obligations of confidence as outlined above.
As there may be uncertainty as to when it will be in the overriding public interest to disclose confidential information, legislation is sometimes enacted in this area. Some of this legislation imposes an obligation to disclose information, such as the provisions of the Child Support (Information, Evidence and Disclosure) Regulations 1992 (SI 1992/1812). These regulations provide that certain categories of people (including local authorities and Crown servants) shall furnish such information or evidence as is required by the Secretary of State to enable him to make certain decisions under the Child Support Act 1991 (regulation 2).
Other legislation provides for a power to make disclosures in certain circumstances. For example, s ection 115 of the Crime and Disorder Act 1998 expressly provides authority for any person to provide information to the police, local authorities or health authorities where the disclosure is necessary or expedient for the purposes of that Act. It does not require disclosure to be made in such circumstances. The fact that the disclosure is necessary or expedient would need to weighed against any competing obligations (such as confidence) that may pertain to the information in question, so a balancing exercise would need to be carried out.
Section 17 of the Anti-Terrorism, Crime and Security Act 2001 allows (but does not require) disclosures to be made under statutory provisions (specified in Schedule 4 to the Act) for fairly broad purposes connected with criminal investigation and prosecution. No disclosure shall be made under section 17 unless the public authority making the disclosure is satisfied that it is proportionate to the aim that is to be achieved (s17(5)). This imports the balancing exercise required by Article 8 of the Convention (see section 4 of this guidance), whereby an interference with the right to private life must be proportionate to the achievement of a legitimate aim. Where proportionality can be shown, this would provide sufficient grounds for overriding any duty of confidentiality owed in respect of the information.