If concerns are raised that a person might be vulnerable to radicalisation, how long can a police force hold data about that person? This was the question facing the High Court in the case of R (II) v Commissioner of Police for the Metropolis [2020] EWHC 2528 (Admin), which held that the police’s continued retention of data a sixteen year old was contrary to the Data Protection Act 2018 and Article 8. In finding this, the court held that a force’s retention of data must be proportionate, what is proportionate in any given situation is fact-specific and that when the police cease to be able to identify a policing purpose for continued retention of personal data, it should be deleted.
In December 2015, the Claimant was eleven years old and receiving online tuition. His tutor raised concerns that he might be vulnerable to radicalisation. In particular, it was alleged that the Claimant had:
- Talked about America being evil;
- Was obsessed with killing the Prime Minister;
- Stated that he enjoyed watching Game of Thrones because of the beheadings;
- Changed his email address to include the phrase “@ISbeards.”
The Claimant’s tutor made a referral to the Government via the “Prevent” strategy. The police were informed and opened a case file on the Claimant. Officers attended his home address and spoke with his mother. No further concerns about the Claimant were identified and the case was closed in June 2016. However, the Commissioner decided to retain the Claimant’s data on ten databases, which could be accessed by police officers, counter terrorism officers, local authorities and the Home Office – what would fall within “making available” for the purposes of the Data Protection Act 2018, which adopts the meaning of processing in the GDPR Art 4(2).
The Claimant, aged sixteen, brought a claim challenging the legality of the Commissioner’s decision to retain the data about him. His claim was threefold:
- First, that the decision to retain the data was contrary to Art 8 of the European Convention of Human Rights;
- Second, that the decision to retain the data was in breach of three principles contained in the Data Protection Act 2018;
- Third, that the decision to retain the data breached the public sector equality duty at section 149 of the Equality Act 2010.
The Commissioner’s decision to retain the data made reference to the College of Policing’s Authorised Professional Practice (APP) on the “Management of Police Information: Retention, review and disposal” (since updated) This guidance provided that Group 4 data (i.e. here, intelligence) was to be retained for a minimum of six years, provided there had not been earlier deletion following a triggered review. The Commissioner contended that it was necessary and proportionate for her to retain the data citing, in particular, the fact that radicalisation was a process that occurred over time and the authorities might need to be able to identify patterns of behaviour.
The Court rejected this. It found that the police’s decision to retain the data constituted an interference with Art 8(1). Whilst retention of the data had a legitimate aim, namely the prevention of radicalisation and terrorism, the continued retention of the Claimant’s personal data was disproportionate and unjustified in that:
- Some (but not all) aspects of the intelligence were proved to be untrue and the case was closed on its merits, the Commissioner having determined that there was no cause for concern that the Claimant was being radicalised;
- In the four years and ten months since the tutor had made her referral, there had been no further concern that the Claimant was being radicalised;
- If retention of the data was no longer required for any policing purpose, then the information fell to be deleted on either a triggered or rolling review.
Turning to the APP, the Court observed that the length of proportionate retention was a fact-specific question. In the present case, no policing purpose for the continued retention had been demonstrated and, therefore, the data fell to be deleted [76]. Furthermore, the court indicated that the potential consequences of continued retention of the Claimant’s personal data were severe. Whilst its disclosure was unlikely, it was not outside the realms of possibility and the police could not guarantee that the data would never be disclosed to third parties. As long as the data was retained, the Claimant would continue to fear that disclosure of data could wrongly suggest to the universities to which he was applying that he was, or might be, a supporter of terrorism. In those circumstances, the court found the period of retention to be disproportionate in all the circumstances of the case, even where it was less than the six years stated by the APP.
On the Data Protection Act 2018, the Court noted its being common ground that the outcome of the Art 8 proportionality assessment should provide the answer as to whether continued retention of the data was “necessary” within the meaning of s35(2)(b) and s39(1) of the DPA 2018 [85]. Section 35(2)(b), addressing the first data protection principle that processing be lawful and fair, required that the processing of data be necessary for a law enforcement purpose (defined at section 31 as being the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security). Section 39(1) stated the fifth data protection principle that data be kept for no longer than necessary.
On the Court having already found that retention was disproportionate for the purposes of Art 8, it went on to hold it was also not “necessary” for the stated law enforcement purposes and so was a breach of the first and fifth data protection principles. It made no finding on whether it was also a breach of of the third data protection principle, at DPA s37, that processing be adequate, relevant and not excessive.
Notably, the Court observed that that some of the data was sensitive or, to use the words of the DPA, special category data, in that it revealed the Claimant’s religion and, purportedly, his political opinions. Noting the latter, the Court held that inaccurately recorded data would not preclude it from being special category data and that police forces should be mindful that any data recording a person’s perceived political opinions, even if ultimately inaccurate, should be considered special category data handled accordingly.
The last segment of the judgment briefly addressed whether the police had breached the public sector equality duty. The Court paid short shrift to this, finding there to be no merit in that ground [92]. The Court held that the Commissioner did have due regard to the Claimant’s needs as a child and that the very reason the Commissioner decided to retain the data was with a view to safeguarding him from radicalisation.
Note
This case serves as a reminder that police forces cannot and should not assume that they are always permitted to retain data for six years, or that they can follow minimum retention provisions in data protection policies without applying individual judgment and considering proportionality.
In this instance, where a case against a young person had been closed and retention of the data was unlikely to advance any ongoing policing purpose, the data had to be deleted. The facts here were fairly stark, concerning data on a boy when at a particularly young age, where no crime had been committed and no ongoing issues had arisen. His data had been retained for around 3 years and 4 months and this was held to be a disproportionate interference with his Art 8 rights.
Whilst this judgment states important general principles, how they apply to each individual situation and what will be proportionate will, of course, differ.