“The central issue in your letter is whether a condition exists under Schedule 3 to the Data Protection Act 1998 (DPA) which could provide for disclosure of sensitive personal data by the Scottish Criminal Cases Review Commission (SCCRC) in the case of Abdelbaset al Megrahi. My officials have considered the matter in detail with the SCCRC, the Scottish Government and the Information Commissioner’s Office. Following these discussions, there is a general agreement that disclosure of sensitive personal data by the SCCRC could satisfy the existing Schedule 3 condition that provides for processing where it is necessary for the administration of justice. To that extent, the DPA does not appear to be a barrier to disclosure of this information by the SCCRC.
“However, I would stress that this is a matter for the SCCRC itself to decide, based on the facts of the case and subject to any other legal obligations or restrictions which may apply (for example, its legal vires and the Convention Rights).”