If concerns are raised that a person might be vulnerable to radicalisation, how long can a police force hold data about that person? This was the question facing the High Court in the case of R (II) v Commissioner of Police for the Metropolis [2020] EWHC 2528 (Admin), which held that the police’s continued retention of data a sixteen year old was contrary to the Data Protection Act 2018 and Article 8. In finding this, the court held that a force’s retention of data must be proportionate, what is proportionate in any given situation is fact-specific and that when the police cease to be able to identify a policing purpose for continued retention of personal data, it should be deleted.