Decision 148/2013 Mr Rob Edwards and the Scottish Ministers Agricultural subsidy beneficiaries Reference No: 201202204 Decision Date: 23 July 2013

Summary

On 26 July 2012, Mr Edwards, Environment Editor of the Sunday Herald, asked the Scottish Ministers (the Ministers) for the names of every farmer in Scotland in receipt of agricultural subsidies during 2011. The Ministers withheld the information on the basis that disclosure would breach the data protection principles.

Following an investigation, the Commissioner found that the Ministers were entitled to withhold the information on this basis.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (definitions (a) and (c) of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 11(2), (3)(a)(i) and (b) (Personal data)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles: - Part 1: The Principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)

Charter of Fundamental Rights of the European Union (the Charter) Articles 7 (Respect for private and family life); 8 (Protection of personal data); 52(1) and (3) (Scope of guaranteed rights); 53 (Level of protection)

European Convention for the Protection of Human Rights and Fundamental Freedoms (the Convention) Article 8 (Right to respect for private and family life)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Joined cases C-92/09 and C-93/09, Volker und Markus Schecke GbR and Hartmut Eifert, judgment of the Court of Justice of the European Union (Grand Chamber) of 9 November 2010 (the Schecke judgment)

C28-08 Commission v The Bavarian Lager Co. Ltd., judgment of the Court of Justice of the European Union (Grand Chamber) of 29 June 2010

Background

1. On 26 July 2012, Mr Edwards emailed the Ministers requesting the following information:

"?the names of every farmer in Scotland in receipt of agricultural subsidies in financial year 2011, along with their location and the amount and type of subsidy they received. I am aware that the information on farmers defined as "legal persons" is already available, as explained here:

http://www.scotland.gov.uk/Topics/farmingrural/Agriculture/grants/LatestPayments

I note, however that this relates only to a minority of those in receipt of subsidy. I wish to see the names of all the farmers in receipt of public subsidy, whether legal persons or not."

2. The Ministers responded on 24 August 2012. The Ministers informed Mr Edwards that they considered the information to be environmental and that they had dealt with the request under the EIRs. The Ministers stated that they considered the information to be personal data, the disclosure of which would breach the data protection principles in the DPA, and they were therefore withholding it in accordance with the provisions of regulation 11(2) of the EIRs.

3. On 3 September 2012, Mr Edwards emailed the Ministers requesting a review of their decision. Mr Edwards did not accept that the names of all of the individual recipients of subsidies who were defined as natural persons should be kept secret. Mr Edwards noted that this information had been disclosed in previous years.

4. The Ministers notified Mr Edwards of the outcome of their review on 19 October 2012. The Ministers upheld their previous decision that disclosure of the information would breach the data protection principles in the DPA and, consequently, regulation 11 of the EIRs.

5. On 30 October 2012, Mr Edwards wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to certain specified modifications.

6. The application was validated by establishing that Mr Edwards had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7. On 16 November 2012, the Ministers were notified in writing that an application had been received from Mr Edwards and were asked to provide the Commissioner with any information withheld from him. The Ministers responded with the information requested and the case was then allocated to an investigating officer.

8. The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. The Ministers were asked to justify their reliance on any provisions of the EIRs they considered applicable to the information requested. The Ministers were also asked to comment on the significance of the Schecke judgment[1] to the information request under consideration.

9. The Ministers responded on 23 January 2013. They provided submissions on their application of regulation 11(2) of the EIRs, explaining why they considered disclosure of the information would breach the data protection principles in the DPA and giving their views on the Schecke judgment.

10. During the investigation, Mr Edwards also made additional submissions explaining why he considered the requested information should be disclosed.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Edwards and the Ministers and is satisfied that no matter of relevance has been overlooked.

Section 39(2) of FOISA - environmental information

12. The Ministers dealt with Mr Edwards' request under the EIRs. They considered that the information covered by his request was environmental information as defined in regulation 2(1). The information concerns agricultural support payments made to farmers. The Commissioner is satisfied that the information falls within the definition of paragraph (c) of regulation 2(1), being measures and activities affecting, or likely to affect, the state of the elements of the environment defined in paragraph (a) of regulation 2(1). The relevant definitions are reproduced in full in the Appendix.

13. In its response of 24 August 2012, the Ministers informed Mr Edwards that they were applying the exemption in section 39(2) of FOISA, which provides, in effect, that such environmental information is exempt from disclosure under FOISA, thereby allowing Mr Edwards' request to be considered solely in terms of the EIRs.

14. The Commissioner accepts that the Ministers were entitled to apply the exemption in section 39(2) of FOISA to the withheld information, given her conclusion that it was properly classified as environmental information.

15. As there is a separate statutory right of access to environmental information available to Mr Edwards in this case, the Commissioner also accepts that the public interest in maintaining this exemption and in dealing with the request in line with the requirements of the EIRs outweighs any public interest in disclosing the information under FOISA.

Regulation 11 - Personal data

16. Regulation 10(3) of the EIRs requires that any personal data included in environmental information shall not be made available otherwise than in accordance with regulation 11. Regulation 11(2) prohibits the disclosure of personal data of which the applicant is not the data subject, where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies to the information.

17. In order to rely on the provisions of regulation 11(2), the Ministers must show firstly that the information which has been requested is personal data for the purposes of the DPA and, secondly, that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

18. In this case, the Ministers submitted that the information comprised personal data, the disclosure of which would contravene the first data protection principle.

19. In considering the application of regulation 11(2), the Commissioner will firstly consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether its disclosure would breach the first data protection principle.

Is the information under consideration personal data?

20. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is the possession of, or is likely to come into the possession of, the data controller ..." (the full definition is set out in the Appendix).

21. As the Commissioner has noted in previous decisions, the (UK) Court of Appeal ruling in Durant v Financial Services Authority [2003] EWCA Civ 1746[2] ("the Durant ruling") provides further guidance when considering the definition of personal data. According to the Durant ruling, for information to be viewed as personal data, that information must be "biographical in a significant sense". It has to go beyond simply recording an individual's involvement in a matter or event that has no personal connotations, and should feature the individual as the focus of the information. The Court of Appeal summarised personal data as information which "affects [a person's] privacy, whether in his personal or family life, business or professional capacity.

22. The Commissioner has considered the withheld information and is satisfied that it comprises personal data. Individual beneficiaries of agricultural subsidies can be identified from the information. The information is biographical in relation to those individuals and focuses on them. The Commissioner is therefore satisfied that the information relates to those individuals.

Would disclosure of the personal data contravene the first data protection principle?

23. The Ministers referred to the Schecke judgment. They noted that the decision in that case found that EU legislation on the publication of information relating to the beneficiaries of agricultural subsidies was partially invalid. In the Ministers' view, the ruling in the Schecke judgment - that disclosure would interfere with individuals' fundamental rights - meant that disclosure of the personal data would breach the first data protection principle.

24. The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, that it shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Edwards' information request.

25. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

26. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

27. When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[3] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject. Whilst that case concerned a request that had been dealt with under FOISA, the Commissioner believes the considerations regarding personal data would be identical in a case handled under the EIRs.

28. Having considered all the conditions in Schedule 2 to the DPA, the Commissioner considers that only condition 6 might be applicable in the circumstances of this case.

29. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s) (i.e. the individual(s) to whom the data relate).

30. There are a number of different tests which must therefore be satisfied before condition 6 can be met. These are:

Does Mr Edwards have a legitimate interest in obtaining the personal data?

If yes, is disclosure necessary to achieve these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced as to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

Even if processing is necessary for Mr Edwards' legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects

31. There is no presumption in favour of the release of personal data under the general obligation laid down in the EIRs. Accordingly, the legitimate interests of Mr Edwards must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Edwards.

Does Mr Edwards have a legitimate interest?

32. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on regulation 11 of the EIRs[4] states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

33. In this case, Mr Edwards submitted that there was a significant public interest in terms of ensuring that the public are informed of how the Scottish Government distributes public funds, in order to determine that monies are being spent correctly.

34. In this case, the Commissioner accepts that that Mr Edwards, as both an individual and journalist, has a legitimate interest in knowing the amount paid in publicly-funded subsidies to individual farmers. Additionally, the Commissioner considers that a wider legitimate interest in this information is shared by the general public; the sums paid in agricultural subsidies are significant, with around ?500 million being paid to agricultural and rural businesses in Scotland in 2011.

Is disclosure necessary to achieve those legitimate interests?

35. The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so she must consider whether these interests might reasonably be met by any alternative means.

36. In this case, Mr Edwards has made a very specific request seeking the names of each farmer in Scotland who received an agricultural subsidy in a specific financial year. In his application to the Commissioner, Mr Edwards has referred to the Schecke judgment and has commented that it effectively prevents the public from knowing most of the recipients of subsidies. In Mr Edwards' view, there was an overwhelming public interest in disclosure of the information so that people could see how their taxes were spent.

37. Given the specific nature of the request, the Commissioner is unable to identify any other viable means of meeting Mr Edwards' legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the specific withheld personal data. In the circumstances, she is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

38. The Commissioner must next go on to consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individuals whose personal data it is.

39. As noted above, this test involves a balancing exercise between the legitimate interests of Mr Edwards and those of the individuals in question. Only if the legitimate interests of Mr Edwards outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

40. In the Commissioner's briefing on regulation 11 of the EIRs, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

the potential harm or distress that may be caused by the disclosure;

whether the individual objected to the disclosure;

the reasonable expectations of the individuals as to whether the information should be disclosed.

41. In his submissions, Mr Edwards argued that there was a significant legitimate interest in understanding how significant sums of public funding were spent. In his view, it was a fundamental democratic principle that those in receipt of public subsidies should be publicly known. He noted that agricultural subsidies can amount to more than ?1 million per head, and are the subject of heated public debate.

42. The Ministers argued that disclosure would be unwarranted. They referred to the Schecke judgment which they considered had given a clear opinion that the rights of individuals were infringed by unrestricted publication of beneficiary data. They noted that the Schecke judgment had found that disclosure of information regarding agricultural subsidies meant there had been a disproportionate interference with the individuals' fundamental rights.

43. In this case, the Commissioner notes that the information sought by Mr Edwards are the names and location of approximately 20,000 individuals who have received agricultural subsidies. The Commissioner is required to consider whether disclosure of the information would cause unwarranted prejudice to the rights and freedoms or legitimate interests of each of those data subjects.

44. The Commissioner has previously considered similar requests including Decision 142/2007 Charles Clover of the Daily Telegraph and the Scottish Executive[5]. In that case (a request for details of all Common Agricultural Policy payments made to all farmers in Scotland), the Commissioner required the authority to disclose the names and locations of all recipients and the amounts they received. The Commissioner concluded that the disclosure of the information would not breach the first data protection principle. In the Commissioner's view, the wider legitimate interests of the public outweighed the competing interests of the recipients.

45. However, in the present case, the Commissioner must also have regard to the decision of the Court of Justice of the European Union (CJEU) in the Schecke judgment.

46. The Schecke judgment considered the legality of certain Council and Commission Regulations which provided that member states of the EU should proactively publish information on the beneficiaries of agricultural subsidies (Council Regulation 1290/2005[6], Council Regulation 1437/2007[7] and Commission Regulation 259/2008[8] (the Regulations)).

47. The CJEU took the view that the validity of the Regulations must be assessed in the light of the provisions of the Charter[9]. The CJEU noted that Article 8(1) of the Charter states that "everyone has the right to the protection of personal data concerning him or her". The CJEU went on to note that this right is not, however, an absolute right; Article 8(2) of the Charter authorises the processing of personal data if certain conditions are satisfied. It provides that personal data "must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law".

48. The CJEU also noted that Article 52(3) of the Charter states that, insofar as the Charter contains rights which correspond to rights guaranteed by the Convention[10], the meaning and scope of the Charter are to be the same as those laid down by the Convention. Additionally, Article 53 of the Charter states that nothing in the Charter is to be interpreted as restricting or adversely affecting the rights recognised by the Convention.

49. The CJEU decided that the Regulations which required member states to publish the names of beneficiaries of aid and the amounts paid constituted an interference with the rights recognised by Articles 7 and 8 of the Charter. As such, the CJEU found it necessary to examine whether the interference was justified having regard to Article 52(1) of the Charter.

50. Article 52(1) of the Charter provides that limitations may be imposed on the exercise of rights (such as those in Articles 7 and 8). However, these limitations could only be imposed in certain circumstances. As the CJEU noted, in order to be justified, such interference must be provided for by law and must respect the essence of those rights. Additionally, it must be necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others.

51. The CJEU noted that the Regulations were intended to enhance transparency regarding the use of EU funds, improve the financial management of them and reinforce public control of the money used. In the CJEU's view, by aiming to increase the transparency of the use of funds in the context of agricultural subsidies, the Regulations pursued an objective of general interest recognised by the EU.

52. The CJEU then went on to consider whether the limitation imposed on the rights conferred by Articles 7 and 8 of the Charter was proportionate to the legitimate aim pursued. The CJEU considered whether the Regulations balanced the EU's interest in guaranteeing the transparency of its acts against the interference with the rights of the beneficiaries to respect for their private life in general and to the protection of their personal data.

53. In the CJEU's view, no consideration had been taken of alternative methods of publishing information that would be consistent with the objectives of publication, while at the same time causing less interference with the beneficiaries' right to respect for their private life and protection of their personal data. The CJEU referred to its judgment in C-28/08 Commission v Bavarian Lager[11]. In that case, it held that no automatic priority can be conferred on the objective of transparency over the right to protection of personal data, even if important economic interests are at stake.

54. Consequently, the CJEU held that the obligation imposed by the Regulations to proactively publish the personal data of beneficiaries was disproportionate and that, as a result, the Regulations were unlawful. In the CJEU's view, the publication of the data constituted an interference with the right to the beneficiaries to respect to their private life, in general, and to the protection of their personal data. The CJEU considered that a proper balance had not been struck between the rights of taxpayers to be kept informed of the use of public funds and the rights of the beneficiaries. As the Regulations breached Articles 7 and 8 of the Charter (and, consequently, the Convention), they were declared invalid.

55. Although the Schecke judgment concerned the proactive disclosure of information on a website by a member state, the Commissioner is mindful that the disclosure of information under the EIRs is essentially disclosure into the public domain. Once information has been placed in the public domain, access to that information cannot be limited. Consequently, the Commissioner must consider the disclosure of the information requested by Mr Edwards in this case as if it was being proactively disclosed in the same manner.

56. Given the large number of data subjects in the present case (there were around 20,000 recipients in 2011), it is impossible for the Commissioner to give consideration to the rights and freedoms or legitimate interests of each of the data subjects separately. As such, the Commissioner has considered all of the recipients as a single cohort for the purposes of the balancing exercise.

57. As noted above, there is no presumption in favour of the release of personal data under the general obligation laid down in the EIRs.

58. The Commissioner recognises that there is a general legitimate public interest in ensuring transparency, accountability and scrutiny of the use of public funds. In this case, significant sums of taxpayers' money have been paid by way of subsidy.

59. As noted at paragraph 1 above, information on farmers defined as "legal persons" is already published. However, Mr Edwards' request relates to those farmers who are not defined as "legal persons".

60. The Commissioner considers that the payments made to individuals constitute information about their work life, but she recognises that a person's income relates to an individual's private life as well. The Commissioner recognises that disclosure may cause distress to the data subjects to the extent that disclosure would involve revealing, to some degree, their personal financial and business interests.

61. The Commissioner has also considered the provisions of Article 8.2 of the Charter and Article 8.2 of the Convention. Having done so, she does not consider there is any exception therein which would permit disclosure of the information sought by Mr Edwards.

62. Having considered all the circumstances of the case, and having particular regard to the Schecke judgment, the Commissioner must therefore conclude that disclosure of the information would constitute an unjustified interference with the fundamental right to the protection of personal data. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.

63. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she regards disclosure as unlawful.

64. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was properly withheld under regulation 11(2) of the EIRs.

Comment

65. In the Commissioner's view, information of this nature concerning agricultural subsidies should generally be disclosed into the public domain. As indicated above, this was the approach taken by the Commissioner in Decision 142/2007. However, in the circumstances of this particular request, the Commissioner considers she is bound by the decision of the CJEU in Schecke.

DECISION

The Commissioner finds that the Scottish Ministers complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Edwards.

Appeal

Should either Mr Edwards or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner
23 July 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

?

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

39 Health, safety and the environment

?

(2) Information is exempt information if a Scottish public authority-

(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or

(b) would be so obliged but for any exemption contained in the regulations.

?

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

?

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

?

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

?

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

?

(b) is subject to regulations 6 to 12.

?

11 Personal data

?

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

Charter of Fundamental Rights of the European Union

?

Article 7 - Respect for private and family life

Everyone has the right to respect for his or her private and family life, home and communications.

Article 8 - Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.

1. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

?

Article 52 - Scope of guaranteed rights

1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

?

3. In so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection.

Article 53 - Level of Protection

Nothing in this Charter shall be interpreted as restricting or adversely affecting human rights and fundamental freedoms as recognised, in their respective fields of application, by Union law and international law and by international agreements to which the Union, the Community or all the Member States are party, including the European Convention for the Protection of Human Rights and Fundamental Freedoms, and by the Member States' constitutions.

?

European Convention for the Protection of Human Rights and Fundamental Freedoms

...

Article 8 - Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

?

---

[1] http://curia.europa.eu/juris/document/document.jsf;jsessionid=9ea7d2dc30db58b5f15ac0fe40ad8fa0ff0426b881f8.e34KaxiLc3qMb40Rch0SaxuLa3z0?text=&docid=79001&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=134836

[2] http://www.bailii.org/ew/cases/EWCA/Civ/2003/1746.html

[3] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[4] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.asp?lID=661&sID=133

[5] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2007/200502359.aspx

[6] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2005:209:0001:0001:EN:PDF

[7] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2007:322:0001:0005:EN:PDF

[8] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2008:076:0028:0030:EN:PDF

[9] The Charter of Fundamental Rights of the European Union (see list of statutory provisions)

[10] http://conventions.coe.int/Treaty/en/Treaties/Html/005.htm

[11] http://curia.europa.eu/juris/document/document.jsf?text=&docid=84752&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=242708