ONS could be forced to share UK census data after failing to seek legal advice

The Office for National Statistics (ONS) could be forced to disclose UK census information to police or intelligence services, because it has not taken legal advice about preventing data being disclosed to third parties.

The Office for National Statistics (ONS) could be forced to disclose UK census information to police or intelligence services, because it has not taken legal advice about preventing data being disclosed to third parties under the Statistics and Registration Service Act 2007 (SRA).

In March, Computer Weekly reported on legal concerns that census information could be shared with police or intelligence services under exemptions outlined in section 39, part four of the Act (see below).

But according to a Freedom of Information (FOI) request, the ONS did not seek any formal legal advice regarding the impact of the SRA on census information.

The ONS said it never considered it necessary to call a formal meeting to discuss this particular point.

"The nearest that ONS came to seeking legal advice or formally discussing this matter with Treasury solicitors was while we were drafting the confidentiality undertakings that were incorporated into the Census Regulations. However there was no formal advice sought or specific discussion held about how Section 39 would cover the census, all of these meetings were un-minuted," said ONS in its FOI response.

The agency said it would always refuse requests to disclose information under part one of section 39 in the Act, but Douwe Korff, professor of international law at London Metropolitan University, says the ONS would have little choice in handing over information under the exemptions contained within the SRA.

"I'm sure that as statisticians they would never want to disclose clearly identifiable data, but they have no leg to stand on under section 39, part four of the Act. This goes to the centre of ethical considerations [of the census]," he said.

"I cannot believe no-one within the ONS understands this, or that no-one ever bothered to seek legal guidance on this."

A spokeswoman from the ONS said: "The ONS has never sought specific legal opinion on S39(4) of the Statistics and Registration Service Act as it considers this to be a straightforward piece of law which we understand without the need for legal opinion.

"The ONS has an internal legal team (of non-lawyers) whose knowledge of this particular piece of law is strong due to many of them working closely with the Treasury team responsible for drafting of the legislation in 2007."

Andrew Watson, campaigner for digital rights group NO2ID, said the ONS stance is at odds with the information given to the public about confidentiality of census data.

"I find it incredible they didn't take any legal advice given that the ONS launched a multimillion-pound public campaign, with the assurance that the data given would be absolutely confidential and kept under lock and key," he said.

In 2009, the Department for Education was concerned about the impact of section 39, part four regarding a request to disclose pupil data to the ONS, according to a blog post from legal privacy experts Amberhawk Training. As a consequence, the department changed the law to prevent the exemption being enforced on this data. In particular, the regulations made any national security and crime disclosure unlawful.

"If one department of state discovers it cannot stomach the broad reach of section 39(4) disclosures, I cannot see why those who complete the census forms cannot be similarly protected," said an Amberhawk blog post in March.

Section 39(4) of the Statistics and Registration Service Act 2007 states:

Subsection (1) does not apply to a disclosure which:

(a) is required or permitted by any enactment,

(b) is required by a Community obligation,

(c) is necessary for the purpose of enabling or assisting the Board to exercise any of its functions,

(d) has already lawfully been made available to the public,

(e) is made in pursuance of an order of a court,

(f) is made for the purposes of a criminal investigation or criminal proceedings (whether or not in the UK),

(g) is made, in the interests of national security, to an Intelligence Service,

(h) is made with the consent of the person to whom it relates, or

(i) is made to an approved researcher.

Read more on IT risk management

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.