• Abstract and Figures
• Public Full-text

PAGE 12 PRIVACY & DATA PROTECTION VOLUME 10, ISSUE 3 he UK’s data protection The police forces involved appealed authority, the Information against the enforcement notices Under the Commissioner’s to the Information Tribunal (‘the T Office (‘ICO’), recently Tribunal’) in 2008. The police argued announced that it has applied that the indefinite retention of the spotlight: to the Supreme Court of England information was necessary and and Wales for leave to appeal added value to their core purposes, against the Court of Appeal’s which include police operational police decision in Chief Constable of purposes (such as disclosure of Humberside Police, Chief Constable information to the Criminal Records of Staffordshire Police, Chief Consta- Bureau, the Crown Prosecution Ser- retention of ble of Northumbria Police and Chief vice and to the courts). The Tribunal Constable of Greater Manchester upheld the Commissioner’s actions, Police v The Information Commis- ruling that the police forces were not conviction data sioner and the Secretary of State for required to retain old criminal con- the Home Department, [2009] EWCA viction records indefinitely and that Civ 1079 (‘the judgment’). such retention breached the Third and Fifth Data Protection Principles. According to the judgment, the police could retain criminal In October 2009, the Court of conviction records, including records Appeal overturned the Tribunal’s of spent, minor or old convictions, ruling on the basis that the indefinite indefinitely. It raises important retention of information for police Bridget Treacy, Partner, issues concerning the interpretation operational purposes (i.e. in order of the Data Protection Act 1998 to combat crime) was lawful and and Anthea Terlegas, (‘the DPA’) and the application of justified and did not infringe the Associate, of Hunton & Article 8 of the Convention for the Data Protection Principles. The Protection of Human Rights and Court of Appeal also emphasised Williams, explain the Fundamental Freedoms (‘the that the Commissioner’s focus on, Human Rights Convention’) and assessment of, the police’s ‘core wider data protection to the retention of criminal purposes’ was misconceived, and implications of a recent convictions information. that it was not for the Commissioner to substitute his own judgment as decision on the police The significance of the judgment to what was appropriate to meet is heightened further by the fact that the police’s operational purposes. retention of criminal if leave to appeal is granted, this will conviction data in the UK represent the first occasion on which According to Lord Justice Waller, the Supreme Court considers data “if the police said rationally and protection issues. reasonably that convictions, however old or minor, had a value in the work they did that should, in effect, be Background to the the end of the matter”. judgment In 2007, the Information Wider data protection Commissioner (‘Commissioner’) implications: issued enforcement notices requiring determining ‘purpose’ certain police forces in England to delete from the Police National The approach of the Court of Computer criminal conviction Appeal to determining the purposes records (or, in the case of one, for which data may be processed the record of a formal reprimand) may have ramifications for all data on the grounds that the retention processing activities. According to of the information contravened Lord Justice Waller, “there is no the Third and Fifth Data Protection statutory constraint on any individ- Principles in the DPA. These ual or company as to the purposes Principles require, respectively, for which he or it is entitled to retain that personal data are adequate, data [provided that the data are relevant and not excessive in relation held for lawful purposes which to the purposes for which they are are identified and specified by the processed, and that the personal controller at the time of collection data should not be kept for longer in accordance with the DPA]”. than is necessary for such purposes. In the UK, data processing purposes may be specified either by giving PAGE 13 PRIVACY & DATA PROTECTION VOLUME 10, ISSUE 3 notice to the data subject, or by Wider data protection will watch the progress of the notification (i.e. registration) to the Commissioner’s application for Commissioner. Unlike the practice implications: human leave with great interest. in other EU Member States, the rights issues notification of data processing pur- poses to the Commissioner provides The Court of Appeal also considered individuals with very little guidance the relevance of Article 8 of the as to the purposes for which their Human Rights Convention, which data may be processed or (as here) provides that “everyone has the retained and subsequently disclosed. right to respect for his private Rather, the notified purposes are and family life, his home and his generally selected from a list of correspondence”. standard purposes, which are couched in very broad terms (e.g. The Commissioner argued, citing S. Bridget Treacy and ‘crime prevention and prosecution and Marper v. The United Kingdom Anthea Terlegas of offenders’). For this reason, it is (Application nos. 30562/04 and Hunton & Williams difficult to assess objectively whether 30566/04), 4th December 2008, a given item of personal data is that the retention of personal data [email protected] actually relevant to the purpose for can engage Article 8 of the Human [email protected] which the data controller purports Rights Convention. In that case, to process it. Consequently, a wide all 17 judges of the European Court range of processing activity may of Human Rights (‘ECHR’) agreed be undertaken, sometimes with that “the mere storing of data relat- only marginal relevance to the ing to the private life of an individual broadly stated purpose. amounts to an interference within the meaning of Article 8”. Thus, the limitation on data processing activity proposed by The Court of Appeal sought to Lord Justice Waller — that data distinguish Marper on the basis are held for lawful purposes which that the nature of the information are identified and specified at the in that case was very different to time of collection or by notification criminal conviction information, — may provide only a limited check and that the ECHR’s concern was on the scope of data processing for individuals who had not been activities. convicted of an offence. The Court of Appeal conceded that the disclosure The Court of Appeal did not (as opposed to the mere retention) comment on whether the police of criminal conviction information had issued privacy notices or made may engage Article 8, but rejected other general statements about the proposition that a mere record the purposes for which personal of the fact that an individual has data would be processed. However, been convicted invokes Article 8 in most other contexts organisations of the Convention. do make such statements and individuals expect to be told at The approach of the Court of Appeal the point of collection how their raises serious issues concerning the data will be used. Typically, such applicability of Article 8 to conviction statements contain a more detailed data held by the police. This was description of data processing pur- recognised by Deputy Commissioner poses than the purposes notified to at the ICO, David Smith, at the time the Commissioner, and these notices the ICO’s decision to appeal was may increase privacy protection for announced. individuals. Since then, the government Finally, Lord Justice Carnwath has announced proposals for the appears to suggest that any indefinite retention of DNA profiles inadequacies in a notification to of convicted adults. Early indications the Commissioner can be rectified are that the database will include simply by updating the notification. records of individuals convicted of This approach overlooks the fact that minor offences, as well as more the updated notice would not apply serious offences. retrospectively to data already held. The application of Article 8 to the retention of criminal record data is clearly a significant issue, and many .

Load more

  2

Copy Link