Many of you will have seen references recently to a Supreme Court case, R (Catt & T) v The Commissioner of Police of the Metropolis [2015] UKSC 9. In this case claims were made under the ECHR, Article 8 by a Mr Catt, who objected to the retention on a police database of records of his participation in political demonstrations going back to 2005, and by a Ms T, who objected to the retention on a police database of a record of a minor altercation with her neighbour which the latter reported to the police. The data consisted entirely of records made of the acts of Mr Catt and Ms T in public, or in the common spaces of a block of flats to which other tenants had access. It was accepted by both appellants that it was lawful for the police to make a record of these events as they occurred, the issue was whether the appellants’ Article 8 rights were breached by the police thereafter retaining the information on a searchable database.
Key Points in the Supreme Court Decision
There are a number of key points about the Supreme Court’s decision.
The Supreme Court confirmed, for the first time, that ‘the state’s systematic collection and storage in retrievable form even of public information about an individual is an interference with private life’, and therefore the Article 8 rights were engaged.
In relation to whether the retention of the data was ‘in accordance with the law’ under Article 8, the Court decided the exercise of police powers to obtain and store information was subject to an intensive regime of statutory and administrative regulation, the principal elements of this regime being the DPA and the regulatory jurisdiction of the Information Commissioner. The Court decided the law did not have to codify the answers to every possible issue that might arise, it was enough that it laid down principles which were capable of being predictably applied to any situation. Although there were discretionary elements in the statutory scheme, their ambit was limited.
The Court confirmed the case-law of the Strasbourg Court that, for this purpose, the rules need not be statutory, provided they operated within a framework of law and that there were effective means of enforcing them. The police supplemented the DPA provisions by publishing a statutory code of practice on the management of police information, and in turn the code provided for more detailed provision to be made by way of guidance, the key guidance being ‘Guidance on the Management of Police Information’ 2010. This guidance provided for an initial minimum retention period of six years for records which were ‘necessary’ for police purposes, and then for ‘triggered reviews’ when certain events occurred, and for ‘scheduled reviews’ which occurred automatically at intervals. The guidance also contained criteria for carrying out reviews, and made references to the DPA and the Human Rights Act. Lords Sumption and Neuberger concluded that the DP principles were paramount, and that the Commissioner’s discretion was limited. Whilst the infinite variety of situations in which compliance issues might arise made ‘complete codification impossible’, any person could make a subject access request and then complain about the use or retention of information to the Commissioner. In addition, the Court acknowledged that challenges to the retention of data had previously been ‘seriously inhibited’ by the decisions of the House of Lords in R (S) v The Chief Constable of the South Yorkshire Police, and, where the courts had doubted whether the Article 8 were engaged by the retention of DNA profiles and the retention of records of minor convictions respectively. Lords Sumption and Neuberger found that ‘Things have moved on since then. There is no longer any doubt about the application of Article 8 to the systematic retention of processable personal data…’ In effect, the DPA provisions and the jurisdiction of the Commissioner, together with the fact that challenges to the retention of data would no longer be inhibited now it was accepted that the Article 8 rights were engaged, were sufficient for these purposes. Lord Toulson agreed with Lords Sumption and Neuberger on this issue.
Reviewing Data Retention Policies and the Significance of Combinations
Interestingly, Lady Hale concluded that it was the ‘combination’ of the DPA requirements coupled with the guidance, which ensured that the collection and retention of the information was ‘in accordance with the law’. Local authorities, in common with most other public bodies, will have their own policies regarding the retention and destruction of data, although these will of course carry considerably less weight than a statutory code of practice or statutory guidance. However, in the event of a challenge regarding retention of data, whether via the ICO or under Article 8, authorities may well face continuing arguments about certainty and predictability. Lords Sumption and Neuberger held ‘the rules need not be statutory, provided that they operate within a framework of law and that there are effective means of enforcing them’. Therefore, it would be sensible to review retention policies to ensure that their stated purpose is to secure compliance with the DPA, and the Human Rights Act. Plainly, such policies should also provide for periodic reviews to ensure that retention is still necessary and proportionate. It is also suggested that these policies must specify criteria for retention or deletion, and these criteria should focus on the necessity of retention for a statutory purpose, and the extent of interference with the subject’s private life, particularly as the Court decided that ‘the test of justification has become more exacting’ since the decision of the Strasbourg Court in S v UK (2008), (which confirmed that the retention of DNA profiles did indeed engage the Article 8 rights).
Given that they are governed by public law principles, and that their decisions can be challenged by judicial review, it is suggested that authorities should be able to argue successfully that insofar as the DPA principles are in themselves insufficiently precise, a combination of the DPA requirements, coupled with their own detailed policies, is sufficient to make their collection and retention of information ‘in accordance with the law’.
Proportionality and a Departure from Strasbourg
Whilst things may have moved on as regards the courts accepting that the Article 8 rights are engaged in such circumstances, it is suggested that there is still a long way to go in relation to proportionality. Although the Court of Appeal had decided unanimously that the retention was disproportionate in the case of Mr Catt, all but one of the Supreme Court judges concluded that the interference with his private life was ‘minor’, and that the police had shown that retention was justified by the legitimate requirements of police intelligence-gathering in the interests of the maintenance of public order and the prevention of crime. As regards Ms T, the practice of the police was to keep a copy of harassment letters of the kind sent to Ms T on their electronic records for at least seven years, and the corresponding entry in their crime reporting information system for 12 years. Again, although the Court of Appeal had found these retention periods to be in breach of Article 8, the majority of the Supreme Court found it was not unlawful for the police to adopt a standard policy of retaining these records for these periods of time, provided the policy was also ‘flexible enough to allow for information to be deleted when retaining it would no longer serve any useful policing purpose, as in fact happened here’. The minority in the Supreme Court found it was impossible to conceive how the retention period could be justified in these particular circumstances, and held that the ‘real problem’ was that the retention period was a standard one, regardless of the nature of the incident, and regardless of any continuing value the material may have had for policing purposes. This was found to be ‘difficult to reconcile with the Data Protection Principles’, although again no violation of Ms T’s rights was found as the material was in fact retained for only two and a half years before the decision to delete it was made during the course of the litigation.
A striking feature of the majority’s reasoning in relation to Mr Catt, a 91-year-old who had a clean record and who was accepted as being a person ‘for whom violent criminality must be a very remote prospect indeed’, is the emphasis placed on the nature of the information retained, and the fact the information was not usable or disclosable for any purpose other than police purposes. It is suggested that this emphasis is plainly inconsistent with the decision in S v UK. In that case, the Strasbourg Court rejected the government’s contention that retention of DNA records created no ‘direct or significant effect’ on the applicants unless matches in the DNA database were to implicate them in the commission of offences on a future occasion. The Strasbourg Court reiterated that ‘the mere retention and storing of personal data by public authorities, however obtained, are to be regarded as having direct impact on the private-life interest of an individual concerned, irrespective of whether subsequent use is made of the data’.
In addition, as the Court in S v UK made clear, the question was not whether the retention of DNA profiles etc could in general be regarded as justified under the Convention, but rather whether the retention of the applicants’ data was justified. Here again, it is suggested that the reasoning of the majority differs from that of the Strasbourg Court. Lords Sumption and Neuberger found ‘the composition, organisation and leadership of protest groups who are persistently associated with violence and criminality at public demonstrations is a matter of proper interest to the police even if some of the individuals in question are not themselves involved in any criminality’, and that ‘one cannot look at an issue of this kind simply in relation to Mr Catt’. Similarly, Lady Hale found that ‘demonstration-based reports containing the names of the people taking part, even those who have not committed any criminal offences in the course of the protest, can assist the police with these important aims’. It is suggested that only in Lord Toulson’s minority judgment were the specific rights of Mr Catt properly considered. Lord Toulson accepted that where a protest event such as the ‘Smash EDO’ campaign became regular and long-running, there was an increased need to collect information. However, in Lord Toulson’s judgment there had to be limits ‘particularly in the case of someone who has never been accused of violence or of organising violence and who has been assessed not to be a threat’. In addition, Lord Toulson found there was no proper explanation why it was proportionate to keep a record of the fact that Mr Catt, who was not suspected of being an organiser or a coordinator of ‘Smash EDO’, had peaceably attended protest events at the Labour Party conference, the TUC conference etc.
It is particularly noteworthy that in finding retention of this information disproportionate, Lord Toulson did not consider it necessary to find that there had been created any stigma of suspicion or guilt, or that the police database was ‘secret’, but resorted to the more fundamental principle that ‘if a citizen’s activities are lawful, they should be free from the state keeping a record of them unless, and then only for so long as, such a record really needs to be kept in the public interest’.
Mark Turnbull is Head of Service, Legal Services, at Leeds City Council
