If you found BAILII useful today, could you please make a contribution?
Your donation will help us maintain and extend our databases of legal information. No contribution is too small. If every visitor this month donates, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
England and Wales Court of Appeal (Civil Division) Decisions |
||
You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor [2009] EWCA Civ 1079 (19 October 2009) URL: http://www.bailii.org/ew/cases/EWCA/Civ/2009/1079.html Cite as: [2010] 1 WLR 1136, [2010] WLR 1136, [2009] EWCA Civ 1079 |
[New search]
[Context]
[View without highlighting]
[Printable RTF version]
[Buy ICLR report: [2010] 1 WLR 1136]
[Help]
COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE INFORMATION TRIBUNAL
John Angel, Chairman
EA/2007/0096,98,99,108,127
Strand, London, WC2A 2LL |
||
B e f o r e :
LORD JUSTICE CARNWATH
and
LORD JUSTICE HUGHES
____________________
Chief Constable of Humberside Police Chief Constable of Staffordshire Police Chief Constable of Northumbria Police Chief Constable of West Midlands Police Chief Constable of Greater Manchester Police |
Appellants |
|
- and - |
||
The Information Commissioner - and - Secretary of State for the Home Department |
Respondent Intervening Party |
____________________
Timothy Pitt-Payne (instructed by Information Commissioner's Office) for the Respondent
Jonathan Swift and Cecilia Ivimy (Treasury Solicitors) for the Intervening Party
Hearing dates : 22nd – 24th June 2009
____________________
Crown Copyright ©
Lord Justice Waller
Directives
Article 1 Object of the Directive
In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.
Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.
Article 2 Definitions
For the purposes of this Directive:
(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(d) 'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
(e) 'processor' shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;
Article 6
1. Member States shall provide that personal data must be:
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
. . .
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
Article 7
Member States shall provide that personal data may be processed only if:
. . .
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
. . .
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).
Article 8 The processing of special categories of data
. . .
5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. (my emphasis)
The Data Protection Act
(a) his name and address,
(b) if he has nominated a representative for the purposes of this Act, the name and address of the representative,
(c) a description of the personal data being or to be processed by or on behalf of the data controller and of the category or categories of data subject to which they relate,
(d) a description of the purpose or purposes for which the data are being or are to be processed,
(e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data,
. . ."
"(a) the entries in the register maintained under section 19 contain current names and addresses and describe the current practice or intentions of the data controller with respect to the processing of personal data, . .".
"(1) References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.
(2) Those principles are to be interpreted in accordance with Part II of Schedule 1.
(3) Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.
(4) Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller."
"1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2 Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3 Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4 Personal data shall be accurate and, where necessary, kept up to date.
5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6 Personal data shall be processed in accordance with the rights of data subjects under this Act.
7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data."
"Enforcement notices
(1) If the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve him with a notice (in this Act referred to as "an enforcement notice") requiring him, for complying with the principle or principles in question, to do either or both of the following—
(a) to take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified, or
(b) to refrain from processing any personal data, or any personal data of a description specified in the notice, or to refrain from processing them for a purpose so specified or in a manner so specified, after such time as may be so specified.
(2) In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress.
. . .
(6) An enforcement notice must contain—
(a) a statement of the data protection principle or principles which the Commissioner is satisfied have been or are being contravened and his reasons for reaching that conclusion, and
(b) particulars of the rights of appeal conferred by section 48.
(7) Subject to subsection (8), an enforcement notice must not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.
Rights of appeal are provided for under Section 48 and thereafter on points of law to the courts under Section 49.
"13 Compensation for failure to comply with certain requirements
(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned."
"(1) Personal data processed for any of the following purposes—
(a) the prevention or detection of crime,
(b) the apprehension or prosecution of offenders, or
(c) the assessment or collection of any tax or duty or of any imposition of a similar nature,
are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection."
What is the PNC?
The Rehabilitation of Offenders Act 1974 (the 1974 Act)
"4 Effect of rehabilitation
(1) Subject to sections 7 and 8 below, a person who has become a rehabilitated person for the purposes of this Act in respect of a conviction shall be treated for all purposes in law as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of that conviction; and, notwithstanding the provisions of any other enactment or rule of law to the contrary, but subject as aforesaid—
(a) no evidence shall be admissible in any proceedings before a judicial authority exercising its jurisdiction or functions in Great Britain to prove that any such person has committed or been charged with or prosecuted for or convicted of or sentenced for any offence which was the subject of a spent conviction; and
(b) a person shall not, in any such proceedings, be asked, and, if asked, shall not be required to answer, any question relating to his past which cannot be answered without acknowledging or referring to a spent conviction or spent convictions or any circumstances ancillary thereto.
(2) Subject to the provisions of any order made under subsection (4) below, where a question seeking information with respect to a person's previous convictions, offences, conduct or circumstances is put to him or to any other person otherwise than in proceedings before a judicial authority—
(a) the question shall be treated as not relating to spent convictions or to any circumstances ancillary to spent convictions, and the answer thereto may be framed accordingly; and
(b) the person questioned shall not be subjected to any liability or otherwise prejudiced in law by reason of any failure to acknowledge or disclose a spent conviction or any circumstances ancillary to a spent conviction in his answer to the question.
(3) Subject to the provisions of any order made under subsection (4) below,—
(a) any obligation imposed on any person by any rule of law or by the provisions of any agreement or arrangement to disclose any matters to any other person shall not extend to requiring him to disclose a spent conviction or any circumstances ancillary to a spent conviction (whether the conviction is his own or another's); and
(b) a conviction which has become spent or any circumstances ancillary thereto, or any failure to disclose a spent conviction or any such circumstances, shall not be a proper ground for dismissing or excluding a person from any office, profession, occupation or employment, or for prejudicing him in any way in any occupation or employment.
(4) The Secretary of State may by order—
(a) make such provision as seems to him appropriate for excluding or modifying the application of either or both of paragraphs (a) and (b) of subsection (2) above in relation to questions put in such circumstances as may be specified in the order;
(b) provide for such exceptions from the provisions of subsection (3) above as seem to him appropriate, in such cases or classes of case, and in relation to convictions of such a description, as may be specified in the order."
"Nothing in section 4(1) above shall affect the determination of any issue or prevent the admission or requirement of any evidence relating to a person's previous convictions or to circumstances ancillary thereto -
(a) in any criminal proceedings before a court in Great Britain (including any appeal or reference in a criminal matter);
(b) in any service disciplinary proceedings or in any proceedings on appeal from any service disciplinary proceedings;
[bb] in any proceedings under Part 2 of the Sexual Offences Act 2003, or on appeal from any such proceedings;]
[(c) in any proceedings relating to adoption, the marriage of any minor, [or the formation of a civil partnership by any minor,] the exercise of the inherent jurisdiction of the High Court with respect to minors or the provision by any person of accommodation, care or schooling for minors;
(cc) in any proceedings brought under the Children Act 1989;]
[(d) in any proceedings relating to the variation or discharge of a supervision order under [the Powers of Criminal Courts (Sentencing) Act 2000], or on appeal from any such proceedings;]
[(d) in any proceedings relating to the variation or discharge of a youth rehabilitation order under Part 1 of the Criminal Justice and Immigration Act 2008, or on appeal from any such proceedings;]
(e) . . .
(f) in any proceedings in which he is a party or a witness, provided that, on the occasion when the issue or the admission or requirement of the evidence falls to be determined, he consents to the determination of the issue or, as the case may be, the admission or requirement of the evidence notwithstanding the provisions of section 4(1)."
What use do the Police in fact make of the data retained on the PNC?
a. Police operational use. There was before the Tribunal evidence from various officers as to the value of convictions however old and however minor to police operational activities. I refer for example to the statements of (a) Detective Superintendent Gary Linton of the Hampshire Constabulary who dealt with old convictions generally and explained why the particular five convictions might be of value; (b) Superintendent Lay of the Greater Manchester Police whose final paragraph reads:-
"24. My concern is the potential for apparently minor or insignificant offences not being shown on the PNC. Over a period of time these may develop into an indication as to the level of behaviour which would give grounds for concern or when linked with information from other agencies. Equally, a single offence committed some years ago may well be significant dependent upon given circumstances such as access to children or when linked with information sharing with other agencies."
And (c) Detective Sergeant Watson of the Humberside Police whose final paragraphs read:-
"42. I have reviewed the five PNC records which are subject of this tribunal. These convictions must be retained and available for future reference.
43. The benefits of old convictions are not easily quantified. In a historical rape or child abuse case sometimes the only evidence placing an offender in a certain geographical area is their previous convictions. The nature of this conviction is immaterial. Shoplifting of a chocolate bar or murder makes little difference when attempting to prove an offender was in a certain area at a certain time, it is the actual conviction itself that assists.
44. With the advances of DNA evidence 'cold case' examination such as in the case of Snowden show the need for details of previous convictions from many years before to be available."
The evidence is very much, I accept, that the information might be of value in certain circumstances and of value when taken together with other information. Detective Superintendent Linton also emphasised another point in his evidence, which is that the police wish to operate the system fairly and thus if the five convictions were removed many others would also have to be and that would increase the risk of information not being available when it might have been useful.
b. Employment vetting and disclosure to the CRB. The effect of Part V Sections 113 to 114 of the Police Act 1997 is that standard and enhanced certificates have to be provided by the Home Office, who obtain the information through the CRB from the police – pursuant to Section 119. The CRB is an executive agency of the Home Office, which in practice carries out the Secretary of State's functions under Part V. The certificates will contain details of spent convictions if and insofar as the employer requesting the same falls within the exceptions to the 1974 Act. This provides an important protection to employers who may ask a would-be employee or indeed an employee whether they have ever been convicted of dishonesty, where that employee is not protected by section 4 of the 1974 Act from revealing spent convictions. While the CRB can obtain the information from the PNC, the employee cannot conceal the fact from the employer. Indeed it might be important to an employer to know that the employee had attempted to do so by lying. A recruit to the police force is one of the categories of persons to which section 4 does not apply and in their own interests the police wish to have the information relating to any potential recruit to the police service. I should also mention that it is intended that the Independent Safeguarding Agency (ISA), created by the Safeguarding Vulnerable Groups Act 2006, will be likely to make use of the information when it comes into operation, as explained in paragraphs 49 to 64 of the IT judgment. Some emphasis is placed by Mr Pitt-Payne that no statutory obligation is placed on the police to retain data under the Police Act 1997, but on any view Part V of the Act seems to recognise that the data will be there to be provided.
c. Disclosure to the CPS and the courts. As already indicated a full record of a person's convictions is required to be supplied to the CPS for the purpose of disclosure if that person is a witness, and to the court for the purpose of sentencing. The PNC is the place where that information is stored comprehensively and the police wish to be able to continue to disclose the data to the CPS and the courts. As the Tribunal correctly record there is no statutory obligation to store the information for that purpose, but there is certainly an assumption that the information will be available; thus The Consolidated Practice Direction referring to "Spent Convictions" states at 1.6.5:-
"After a verdict of guilty the court must be provided with a statement of the defendant's record for the purposes of sentence. The record supplied should contain all previous convictions, but those which are spent should, so far as is practicable, be marked as such."
d. Multi-agency work. The police wish to co-operate with other agencies such as the probation service, social services departments, health authorities and other agencies.
Meaning of purposes
"Notification is the process by which a data controller informs the Information Commissioner of certain details about their processing of personal information. These details are used by the Information Commissioner to make an entry describing the processing in the register of data controllers that is available to the public for inspection.
The principal purpose of having notification and the public register is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is carrying out the processing of personal information as well as other details about the processing (such as for what reason it is being carried out).
Notification, therefore, serves the interests of individuals in assisting them to understand how personal information is being processed by data controllers.
It is not, however, intended (nor is it practicable) that the register should contain very detailed information about a data controller's processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing. More detail is only necessary to satisfy specific statutory requirements or where there is particular sensitivity."
The purposes as registered
"91 . . .Therefore we find that we agree with the Commissioner that we must concentrate on the obvious or core police purposes which are easily understood. We would comment that one of the principal reasons behind the registration process is so that it is transparent and clear as to what purposes are being pursued by a data controller in order for it to be seen that there is compliance with the DPPs.
92. It is clear from the evidence before the Tribunal, particularly that given by Mike McMullen, that a considerable number of other bodies use information held on the PNC for various purposes, although they do not necessarily have direct access. The 2006 Guidelines recognise this: hence the provision for certain convictions to be stepped down, and thereby protected from access by non-police users.
93. The Commissioner contends that the fact that such organisations are permitted to access the PNC and that the Chief Constables may work in partnership with other organisations does not mean that the purposes for which it does so are to be treated as policing purposes. This does not mean that all of the purposes pursued by the partner organisation should be treated as being police purposes.
. . .
96. We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police's core purposes. During the course of holding such data the police are under statutory obligations to allow access to or disclosure of such data to other bodies for their purposes. However we do not consider that Chief Constables are required under their statutory obligations to hold data they no longer require for core purposes. They are only required to provide data that they do hold at the time of the request for access. We heard evidence that Chief Constables in accordance with good management practice and/or other statutory requirements, like their data protection obligations, as envisaged by the 2005 Code and the criteria used in MOPI, delete conviction data or other intelligence from time to time, then in the Tribunal's view there is no counter or overriding obligation on them not to delete that data."
What if the principles must be judged by a narrower approach to police purposes?
"135. The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that is it extremely unlikely either: (i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or (ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5."
and then also said in paragraph 136:-
"136. The general considerations in paragraphs 134 and 135 are also applicable to the analysis of the other data subjects."
"4.45. Data protection concerns are relevant but should not dominate the Code or any supporting manual. That said, some important messages for those drafting the Code emerged from the Information Commissioner's evidence. He clearly and helpfully said that:
4.45.1 The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner's role is a reviewing or supervisory one.
4.45.2 Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office 'cannot and should not substitute [their] judgement for that of experienced practitioners'. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, 'that should be the end of the story'.
4.45.3 There is, at present, considerable latitude extending both to decisions about how long to retain records and about when to disclose information (under the Enhanced Disclosure regime, for example, in the employment-vetting context).
4.45.4 It could be presumed to be reasonable if, after discussions with the Information Commission, certain categories of information were retained for specified periods, while still allowing the right of challenge in individual cases.
4.45.5 In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify."
"165. The basis of the Appellants' argument is that the 2006 Guidelines should be followed despite the representation made to SP because of the benefits the conviction data will provide to the wider public. As will be appreciated from our findings so far we are not convinced that will be so in SP's case and certainly the 2006 Guidelines do not in our view provide that proportionate approach which leads us to accept the Appellant's argument.
166. Janet Turner for Staffordshire Police in evidence was very unclear as to whether the question of fairness to SP had been considered when reaching the decision to retain the information. This leads us to the view that the personal data was processed unfairly."
Article 8
Lord Justice Carnwath :
Overview
DPP3: "Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed."
DPP5: "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes."
Crucial to both principles was the identification of the "purposes" by reference to which the criteria were to be applied.
"… given its importance to intelligence-led policing and to the criminal justice system as a whole".
"This approach is misconceived and wrong in principle. There is nothing in the scheme of the DPA, nor the EC Directive it implements, to support the proposition that only the 'core' purposes of a data controller should be taken into account in assessing whether a given act of processing infringes DPP3 and DPP5. Moreover, the DPA contains no framework by which the Commissioner or the Tribunal could properly assess what is a 'core' and what is not a 'core' purpose of a given data controller. Fundamentally, it is not for the Commissioner or the Tribunal to specify for what purposes in considers a public body, acting lawfully, should or should not process data."
"… by reference to the question whether other processing (such as the disclosure of the data to third parties, such as the CRB, the Courts social services etc) infringes DPP3 and 5… But the question whether any given act of processing breaches DPP3 or DPP5 must be determined separately, having regard to the purposes and particular circumstances of that processing. Retention of data cannot in principle be held unlawful under DPP3 and 5 on the basis, for example, that it might give rise in future to disclosure contrary to those principles."
"It is in principle legitimate for the police to retain conviction data on the PNC not only for the 'core' purposes identified by the Tribunal, but for all their registered purposes. The Tribunal should have analysed the need for retention of the conviction data on the PNC on that basis. In practice, therefore, holding that information for the purpose of assisting other public bodies who share common public policy objectives to perform their functions is lawful under the DPA."
"Core purposes"
"… the prevention and detection of crime, the investigation and apprehension of offenders, and the maintenance of law and order." (decision para 90)
It was these "core" police purposes which, it was said, had to be taken into account in applying DPP3 and DPP5. This approach was contrasted with the position of the Police and the Home Office -
"The Appellants and Home Office take a different view and contend that all the notified purposes must be taken into account in applying DPP3 and DPP5. These purposes should be interpreted widely and require providing criminal intelligence to other bodies…" (para 91)
"(1) providing assistance to the Crown Prosecution Service (CPS) (or any other prosecuting agency) in the prosecution of an offence, and the courts in the administration of justice;
(2) assisting organisations such as social services departments and probation services in multi-agency work to protect the public, in particular young and vulnerable persons;
(3) disclosure of information in the context of employment vetting to the CRB; and
(4) public safety and protection of life and property, for example assisting members of the public in discovering the whereabouts of missing persons."
(I will refer to these in this judgment as "the additional purposes".)
"95. The Appellants maintain that they process information about the criminal records of individuals for each of these four purposes, and that each of these purposes should be taken into account in the present case in relation to both DPP3 and DPP5.
"96. We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police's core purposes…
97. This reflects the position, in our view, that Chief Constables cannot be expected to incorporate other bodies' purposes as part of their own even though there may be some common objectives, like the prevention of crime." (emphasis added)
"This is rather remote from the police's main activities in relation to this purpose, but even if encompassed in the purpose it is difficult to accept that the police would then be required to provide more data to such a body than is required for their core needs…" (para 91)
"The Commissioner accepts that where the police hold conviction information for their own purposes then it is proper for them to provide that information for use by the CPS or the Courts; but it does not follow, the Commissioner argues, that information that no longer has a policing purpose can properly be retained by the police, solely to ensure that a fuller record of conviction information is available for use by the CPS or by the Courts…
The Commissioner maintained that if the police forces are to be required to retain information that is no longer needed for their own purposes - because the CPS or the Court Service need it, or may need it, then there needs to be specific legal provision for this with proper safeguards as to who may use that information and for what purposes. We agree with the Commissioner's contentions." (para 102-4)
"It seems to us that the PNC has evolved over the years and it is now regarded as the main source of criminal intelligence for a variety of organisations. However it has no proper statutory framework. It is not regarded as an entity in its own right with its own purposes serving a number of bodies and this is apparent from the fact that neither the PNC nor its various administrators, ACPO, NIS, NPIA, are registered as data controllers with the Commissioner. If the government wishes the PNC to have that role then it needs to legislate accordingly. This would provide the opportunity for Parliamentary debate as to how best to provide an appropriate and proper legislative framework so that there is a clear understanding of data ownership and obligations with proper safeguards." (para 99)
Three questions
i) Was the maintenance of the Police National Computer for (inter alia) the purposes relied on by the Police in principle permissible under the European and domestic legislation?
ii) If so, were those purposes within the scope of their specified purposes?
iii) If so, was the retention of the data in the five cases justifiable by reference to those purposes in accordance in particular with principles DDP 3 and 5?
(i) Permissible purposes
"(28) Whereas any processing of personal data must be lawful and fair to the individuals concerned; whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; whereas such purposes must be explicit and legitimate and must be determined at the time of collection of the data; whereas the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified." (emphasis added)
"necessary… for the exercise of any other functions of a public nature exercised in the public interest by any person" (condition 5(d))
and under schedule 3 that it is -
"necessary for the exercise of any functions conferred on any person by or under an enactment" (condition 7(1)(b))
No issue arises before us in respect of compliance with either of those schedules.
"…even if all recordable offences were recorded and retained indefinitely, the PNC would not be a comprehensive record of all criminal convictions." (para 19)
"The fact that D was acquitted of the rape is not of itself private information the publication of which would be incompatible with his right to privacy. This has nothing to do with his private life. The trial was held in public, and the media were at liberty to publish D's name along with other details of the case other than the identity of the complainant…." (A-G's Ref No 3 of 1999: Application by BBC [2009] UKHL 34 [30])
He went on to explain that the BBC's concern in the particular case was not confined to his acquittal, but related also to a DNA profile taken at the time of his arrest, which undoubtedly did engage Article 8. If one may apply the same reasoning in the present context, the bare fact of conviction should not be regarded as "private information" such as to engage article 8.
Specified purposes
"(the data controller)… is continuing to process the Conviction Data relating to X and that such data are irrelevant, excessive and no longer required for policing purposes and are being kept for longer than is necessary for such purposes." (emphasis added)
"Policing purposes" were not further defined in the notice, but as will appear this expression seems to be derived from that used by the Police themselves in the registration.
"(d) a description of the purpose or purposes for which the data are being or are to be processed.
(e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data."
Waller LJ has referred to the Notification Guidebook, which explains that
"It is not… intended (nor is it practicable) that the register should contain very detailed information about a data controller's processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing… "
Accordingly, the obvious starting-point for considering the application of principles DPP3 and 5 would naturally be the identification of the specified purposes in the register. In this case that is not as easy as might be expected.
"Under section 16 DPA, the five Appellants as data controllers registered their purpose as 'policing' and the purpose description as
'The prevention and detection of crimes; apprehension and prosecution of offenders, protection of life and properties; maintenance of law and order; also rendering assistance to the public in accordance with force policies and procedures'
And the further description of purpose as
'protection and detection of crime apprehension and prosecution of offenders maintenance of law and order, protection of life and property vetting and licensing public safety rendering assistance to members of the public in accordance with Force policy'"
"If one looks at the above, it seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. "Rendering assistance to the public in accordance with force policies" clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include "Employers" "the courts" and "law enforcement agencies"."
Justification
"The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner's role is a reviewing or supervisory one."
"Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office 'cannot and should not substitute [their] judgement for that of experienced practitioners'. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, 'that should be the end of the story'."
"In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify."
"Both under the Convention and as a matter of English administrative law, the police are entitled to use information when they reasonably conclude this is what is required (after taking into account the interests of the applicants), in order to protect the public and in particular children…. where the use in question is decided upon as a result of the exercise of an honest judgment of professional police officers, that will of itself, go a long way to establish its reasonableness." (emphasis added)
"The briefing document recognised that disclosure could lead to the Claimant losing his job. ACC Vant took this into account, but considered that disclosure was proportionate and that the public interest outweighed the Claimant's individual rights. In Thorpe Lord Woolf said that the exercise of an honest judgment of professional police officers would go a long way to satisfying the test of reasonableness for the purposes of English administrative law and the Convention. It may be that the Convention requires a rather more exacting standard of review than Wednesbury reasonableness. Nonetheless, the Courts will still acknowledge the expertise which the police have in assessing risk and their professional judgment is still entitled to be given due weight. For similar reasons, it was relevant that the Social Services department endorsed the proposal for disclosure." (para 59)
"None of these witnesses identified any features specific to the individual data subjects that justified the retention of their conviction information… Rather than relying on considerations that are specific to any of the individual data subjects, the Appellants appear to have relied on a general principle: conviction information, once recorded by the police, ought to be retained for life… In order to justify this principle the Appellants called a number of experienced police officers who gave evidence as to how past convictions had led to the apprehension of offenders. Although in no way wishing to substitute our judgment for that of experienced practitioners we would observe that it seemed to us that few if any of these examples seemed to relate to the sorts of offences committed by the data subjects in this case." (para 122-3)
"The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that it is extremely unlikely either: (i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or (ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5."
DPP1
Conclusion
Lord Justice Hughes :
i) it is for the data controller to determine the purpose(s) for which the data is processed;
ii) it is not open to the Commissioner to impose his own determination of those purposes; the imposition of a concept of 'core police purposes' was misconceived;
iii) in any event the proper purposes of the police in managing the PNC plainly include the retention of information for provision to others who have a legitimate need for it, including (but not limited to) provision under statutory duty created by the Police Act 1997;
iv) those purposes sufficiently appear from the notification of purposes lodged, but even if they do not the notification could be amended tomorrow;
v) accordingly retention of the records in these cases for those purposes was not a breach of DPP 3 or 5; and
vi) none of the foregoing is in any sense inconsistent with the Directive, which plainly contemplates (though does not require) the maintenance by the police of a comprehensive record of convictions.
a) It is the duty of the Crown to place before any sentencing court a complete record of previous convictions of the defendant. By section 143(2) Criminal Justice Act 2003, a previous conviction is to be treated as aggravating the offence if it reasonably can be. A court may of course disregard an old conviction and often will, but it may be wrong to do so. Certainly there ought often to be a real difference between sentencing a person who has never before offended and sentencing one who has, perhaps similarly, albeit many years previously. The court must be in a position to make an informed decision.
b) There is an obligation on the Crown to reveal to the defence any convictions of any witness on whom it relies. That does not mean that the conviction can automatically be put in evidence by the defendant, but it enables the court to give proper consideration to any application under section 100 Criminal Justice Act 2003 to do so. Similarly, it will sometimes happen that it is relevant to challenge a witness called on behalf of the defendant on the basis of his record, especially for example if he has professed to a respectability which he does not enjoy.
These simple, non-exhaustive, examples demonstrate how the common coin of the criminal court depends upon access by the court, through the prosecution and thus through the PNC, to a reliable and comprehensive record of convictions and their circumstances. Such records as might be pieced together from multiple courts, or from the historical files of diverse prosecuting authorities, would be no kind of substitute, and it is in any event highly undesirable that there should be multiple databases, with the inevitable concomitant risks of duplication of effort, inconsistency and reduced security. The criminal justice system thus depends on the maintenance of the PNC. If the PNC is not complete, the court can never know of a relevant old conviction. The Secretary of State for Justice expressed the view in this case that "providing anything less than full information to the courts would potentially undermine the criminal justice process." I agree.
"Any person who holds records of convictions, cautions or other information for the use of police forces generally shall make those records available to the Secretary of State for the purpose of enabling him to carry out his functions under this Part…"
Given that statutory framework, it is plain that it is part of the necessary public purposes of the PNC that it maintain a complete record of convictions etc to enable the statutory scheme to work.
1967 HP was born.
2nd March 1984 HP was 16 years of age. With another he stole items from a display in a Marks & Spencers store in Whitefriargate, Hull at 9.25 hours (Bundle p 35).
1984 HP was convicted of the offence of theft at the Juvenile Court. He was fined £15 [Bundle pp 33-34].
31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426)
7th July 2006 The offence was disclosed on an enhanced disclosure certificate dated 7th July 2006 [Bundle p. 17]. HP had applied for a position as a care officer with the Hull City Council [Bundle pp. 12-16].
16th September 2006 HP made a complaint to the ICO. In his complaint he said he had been informed by his employer that an enhanced disclosure certificate had revealed his conviction, which he had not previously disclosed and he was informed by his manager that he may be disciplined [Bundle p. 14].
19th December 2006 to
8th August 2007 1 The ICO corresponded with the First Appellant in respect of the conviction [Bundle pp.1-11]. He asked for it to be "stepped down" or deleted from the PNC. The First Appellant agreed to step down the conviction but not to delete it.
9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 256-260]
8th August 2007 The Respondent issued an enforcement notice [Bundle p. 261-265]. The notice required the First Appellant to erase the conviction data relating to HP held on the PNC database. The Respondent said that the retention of the information contravened the third and fifth data protection principles. He said that he had taken into account whether the contravention of the principles had caused or were likely to cause HP damage or distress and had taken into account the provisions of Article 8 of the European Convention on Human Rights.
3rd September 2007 The First Appellant appealed against the enforcement notice [Bundle pp. 266-267A]. He disputed that there has been a breach of the data protection principles and further, or alternatively, submitted that the Respondent has wrongly exercised his discretion in requiring the First Appellant to erase the data.
8th April 2008 to
18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals.
21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed.
8th August 2008 The First Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court.
1988 SP was born.
2001 SP was 13 years of age. She punched a 15 year old girl to the ground, kicked her and caused her injury in Wolgaston Way, Penkrage, Staffordshire [Bundle pp. 85-123]. That day she was arrested and taken to the police station. SP was given a reprimand for an offence of common assault [p 90].
31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426)
1st September 2006 The reprimand was disclosed on an enhanced disclosure certificate dated 1st September 2006 to Four Seasons Health Care to whom SP had applied for a post as a care assistant [Bundle pp57-60].
14th November 2006 SP complained to the ICO [Bundle p. 51-56]. She complained that she had been informed by the police officer who reprimanded her that the record would be removed by the time she was 18 years of age.
16th January 2007 to
16th August 2007 The Respondent corresponded with the Second Appellant and requested him to step down the reprimand or delete it from the PNC database [Bundle pp. 42-51]. The Second Appellant agreed to step down the reprimand but not to delete it from the PNC database.
9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 282-286]
16th August 2007 The Respondent issued an enforcement notice against the Second Appellant [Bundle pp. 287-289]. In the enforcement notice the Respondent required the Second Appellant to erase the data of the reprimand from the PNC database on the grounds that it breached the first, third and fifth data protection principles. The Respondent believed that the first data protection principle was breached because of the representation which had been made to SP that it would be removed after 5 years. He said he had taken into account that the distress had been caused or was likely and the provisions of Article 8 of the European Convention on Human Rights.
6th September 2007 The Second Appellant appealed against the enforcement notice [Bundle pp. 292-296]. He disputed that there has been a breach of the data protection principles and further, or alternatively, submitted that the Respondent has wrongly exercised his discretion in requiring the Second Appellant to erase the data.
8th April 2008 to
18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals.
21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed.
8th August 2008 The Second Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court.
1960 NP was born. He is now 48 years of age.
26th August 1981 NP was 20 years of age. At 11.30 am at Gledsons Electrical Co, Redburn Industrial Estate, Westerhope, Newcastle upon Tyne, NP posed as a representative of a company in order to obtain goods dishonestly and by deception [Bundle pp. 160-163].
1981 NP was convicted of an offence of obtaining by deception and an offence of attempting to obtain by deception at the Magistrates Court for which he was fined £150 and £100 respectively and ordered to pay costs of £10 [Bundle pp 160-161].
31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426)
13th September 2006 The offences were disclosed in a standard disclosure certificate [Bundle pp. 153-155] to Home Group Ltd upon an application of NP for the post of Housing Maintenance Officer.
17 October 2006 NP complained to the ICO [Bundle pp. 141-145]. He complained that his conviction was still retained notwithstanding under previous weeding rules it would have been removed.
19th December 2006 to
15th August 2007 In correspondence between the Respondent and the Third Appellant the Respondent requested the Third Appellant to delete the conviction data from the PNC or step it down [Bundle pp. 129-140]. The Third Appellant agreed to step down the conviction data but not to delete it.
9th July 2007 The Respondent served a preliminary enforcement notice on the Third Appellant [Bundle pp. 312-314]
15th August 2007 The Respondent served an enforcement notice on the Third Appellant [Bundle pp. 317-219]. The Respondent required the Third Appellant to erase the conviction data in respect of NP on the grounds that it breached the third and fifth data protection principles. The Respondent said that he had taken into account whether distress had been or would be likely to be caused to NP and Article 8 of the European Convention on Human Rights. The Third Appellant agreed to step down the conviction data but not to erase it.
12th September 2007 The Third Appellant appealed against the enforcement notice [Bundle pp. 322-325]. He disputed that there has been a breach of the data protection principles and submitted that the Respondent had wrongly exercised his discretion in requiring the Third Appellant to erase the data.
8th April 2008 to
18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals.
21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed.
8th August 2008 The Third Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court.
1962 WMP was born.
2nd July 1977 WMP was 15 years of age. At 3.50 pm WMP and another individual inserted metal blanks into an amusement arcade roulette machine at Dearmouth Park, West Bromwich [Bundle pp. 194-195].
1978 At the Juvenile Court, WMP was convicted of two offences of attempted theft, in respect of which he was conditionally discharged for two years, and an offence of criminal damage, for which he was fined £25 and ordered to pay compensation of £6.60, a legal aid contribution of £30 and costs of £29.20 [Bundle pp189-191].
31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426)
23rd August 2006 The convictions were disclosed in an enhanced disclosure certificate dated 23rd August 2006 to Humber Parascending when WMP applied for a position on a Summer Scorcher Activity [Bundle p. 185].
5th October 2006 WMP complained to the ICO on 5th October 2006 and requested that his convictions be removed as he regarded them, on today's terms, as nothing more than a juvenile prank. He said that as a professional trainer and businessman he felt the terminology used could compromise his integrity [Bundle pp. 179-184].
11th December 2006 to
15th August 2007 The Respondent corresponded with the Fourth Appellant [Bundle pp. 169-178] and requested that the Fourth Appellant should remove the conviction data or step it down. The Fourth Appellant agreed to step down the conviction but not to delete it.
9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 339-341]
16th August 2007 The Respondent served an enforcement notice on the Fourth Appellant [Bundle pp. 344-346]. The Respondent required the Fourth Appellant to delete the conviction data on the grounds that in his opinion it contravened the third and fifth data protection principles. He said that he had taken into account whether the contravention caused or was likely to cause WMP distress and Article 8 of the ECHR.
4th December 2007 The Fourth Appellant appealed against the enforcement notice [Bundle pp. 322-325]. He disputed that there had been a breach of the data protection principles and submitted that the Respondent has wrongly exercised his discretion in requiring the Fourth Appellant to erase the data.
8th April 2008 to
18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals.
21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed.
8th August 2008 The Fourth Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court.
1964 GMP was born. She is now 44 years of age.
20th April 1983 GMP used a Williams & Glynn cashline card belonging to another to obtain £100 from a bank cashpoint dispenser at Williams & Glynns Bank, Mosley Street, Manchester [Bundle pp. 247-249]. GMP was 18 years of age.
1983 GMP was convicted of an offence of theft (and two matters that were taken into consideration) at the Magistrates' Court. GMP was sentenced to a conditional discharge of 12 months and ordered to pay compensation of £185 and costs of £35 [Bundle pp 244-246]. GMP was 19 years of age at the date of the conviction.
9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 339-341]
1st June 2006 The conviction was disclosed in a response to a subject access request (pursuant to Section 7 of the Data Protection Act 1998) made by GMP on 1st June 2006 [Bundle pp. 236-239] and provided by the NIS on 6th July 2006 [Bundle p. 233]. GMP had made the request to support an application for a passport, residency and citizenship to the state of St Lucia.
5th October 2006 GMP made a complaint to the ICO [Bundle pp. 224-228]. She said that because her conviction had been disclosed this would affect her plans to emigrate to St Lucia.
3rd January 2007 to
29th October 2007 The Respondent corresponded with the Fifth Appellant and requested the Fifth Appellant to delete the conviction data in relation to GMP from the PNC or step down the data. The Fifth Appellant agreed to step down the data but not to delete it [Bundle pp. 202-223].
9th July 2007 The Respondent issued a preliminary enforcement notice on the Fifth Appellant [Bundle pp. 364-367].
15th November 2007 The Respondent served an enforcement notice on the Fifth Appellant [Bundle pp. 369-371] requiring him to delete the conviction data in relation to GMP on the grounds that its retention breached the third and fifth data protection principles. The Respondent said that he had taken into account whether retention of the data had caused or was likely to cause GMP distress, and Article 8 of the ECHR.
20th November 2007 The Fifth Appellant appealed the requirement to delete in the enforcement notice [Bundle pp. 374-379]. He disputed that there has been a breach of the data protection principles and submitted that the Respondent has wrongly exercised his discretion in requiring the Fifth Appellant to erase the data.
8th April 2008 to
18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals.
21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed.
8th August 2008 The Fifth Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court.
ACPO Association of Chief Police Officers
ACRO Criminal Records Office of ACPO - the body established in May 2006 to provide a central function for policing matters relating to criminal records and associated biometric identification, namely DNA and fingerprints.
CJ arrestee A person who has been detained at a police station having been arrested for a recordable offence.
CRB Criminal Records Bureau - the body established to discharge the functions of the Secretary of State under Part V of the Police Act 1997
ICO Information Commissioner's Office
IPLX Interim Police Local Cross Reference Data Base.
MAPPA Multi Agency Public Protection arrangements
MOPI Statutory Code of Practice and guidance on the management of police information
NIS National Identification Service
Nominal Records linked to a specific named individual containing histories Records reflecting the fact that the individual has been convicted or cautioned or reprimanded or dealt with by the issue of a penalty notice for disorder
NPIA National Police Improvement Agency
PIAP PNC Information Access Panel
PITO Police Information Technology Organisation - the body responsible for having strategic and the technical role in the development, procurement and information of information technology at a technical level
PNC Police National Computer
SOPO Sex Offender Protection Order
HP The data subject in respect of the case of the first Appellant
SP The data subject in relation to the case of the Second Appellant.
NP The data subject in relation to the case of the Third Appellant.
WMP The data subject in relation to the case of the Fourth Appellant
GMP The data subject in relation to the case of the Fifth Appellant.