Upper Tribunal Administrative Appeals Chamber

[2023] UKUT 221 (AAC)

Fecha: 03-Ago-2023

Upper Tribunal’s consideration of ground a

Upper Tribunal’s consideration of ground a.

Basic law regarding what is “personal data”

23.

Section 3 of the Data Protection Act 2018 defines personal data (including for the purposes of s40) as any information relating to an identified or identifiable living individual; and ‘identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)

an identifier such as a name, an identification number, location data or an online identifier, or

(b)

one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

24.

Recital 26 of the preamble to the General Data Protection Regulation (EU) 2016/679 states:

(26)

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

25.

In NHS Business Services Authority v IC and Spivack [2021] UKUT 192 (AAC), Upper Tribunal Judge Jacobs said as follows:

I have to decide whether any person was identifiable from the data withheld by [the public authority] when taken together with other information by someone who was motivated to identify one or more of the persons within the data using all the means reasonably likely to be used …

…

Just looking at the legislation

12.

Section 3 of the 2018 Act creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not. That is what the Act says, and it is consistent with the Regulation. There is no mention of any test of remoteness or likelihood.

13.

The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer, as in this case. That derives from Recital 26.

26.

Common Services Agency v Scottish Information Commissioner [2008] UKHL 47 concerned a process of anonymisation of data, called “barnardisation”. The House of Lords said that it was a “question of fact” (for the Scottish information commissioner, in that case) “on which he must make a finding” as to whether, through barnardisation, the information became data from which a living individual could no longer be identified. “If barnardisation can achieve this, the way will then be open for the information to be released in that form because it will no longer be personal data” within the meaning of s1(1) of the Data Protection Act 1998 (paragraph 27 of the judgement).