Whether the information is devolved, reserved or transferred from devolved to reserved—in other words, kept south of the border—as long as the person can trigger a privacy right, a fair hearing right, or any other convention right, the test will remain that of proportionality.