Original URL: http://www.theregister.co.uk/2009/10/21/police_data_protection/

Police make a mockery of data protection

Court judgment 'forgets privacy rights of millions'

By Jane Fae Ozimek

Posted in Law, 21st October 2009 10:01 GMT

Comment While the police are very keen to retain as much data on the average citizen as they can "just in case" it becomes useful, they are markedly less happy when the data being collected relates to them.

That is the conclusion from two otherwise unrelated stories hitting the headlines this week, as a landmark ruling by the Court of Appeal may set new and dangerous precedents in the area of data protection and civil liberties.

First up is the Court of Appeal ruling. Back in July 2008 the Information Tribunal, which rules on more complex Data Protection issues, announced to the general approval of various civil liberties groups that the Police should delete records of minor criminal convictions that were "spent" in terms of the Rehabilitation of Offenders Act 1974 (pdf).

The Chief Constables of five police forces – Humberside, Staffordshire, Northumberland, West Midlands and Greater Manchester – objected. Yesterday, three judges sitting in the Court of Appeal ruled that their objections had merit, and that the police could continue to hold on to conviction data for as long as they wished: in fact, for up to 100 years.

At the heart of the ruling are several serious weakenings of what the public may have otherwise considered to be rights conferred under Data Protection Law.

The court observed that in the past, the Association of Chief Police Officers (ACPO) had put together a code of practice that had been readily accepted by the Information Commissioner. This involved the removal of large numbers of records after they were deemed to be no longer relevant.

However, following the Bichard Review, which looked into events surrounding the Soham murders, the police and the Information Commissioner took different positions on data retention. The police argued that they had statutory duties to retain data in order to pass it on to several external bodies, such as the ISA, CRB and CPS – and that instead of "weeding out" old data, they would now "step down" old data (ie make it available only to police officers or on request).

There was some argument before the Court of Appeal as to whether this "purpose" was outside what might be deemed to be police "core purposes". Lord Justice Waller accepted that "the evidence was very much... that the information might be of value in certain circumstances and of value when taken together with other information".

However, he was also clear on two further points. First, that the Information Commissionershould not focus only on "core purposes" (ie police operational matters), but that other purposes, as outlined above, would also be relevant.

In an extraordinary passage (s31), which appears to rip the guts out of the Data Protection Act, Lord Justice Waller stated "the data controller must specify the purpose for which data is retained. There is no statutory constraint on any individual or company as to the purposes for which he or it is entitled to retain data. I would accept that the purposes must be lawful in order to comply with DPP 1 but, that apart, a data controller can process data for any purpose."

In respect of police judgement on retention of data for operational purposes, he added (s43): "If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter."

He went on: "The fact that the statistics actually showed that the risk was greater than with non-offenders is not something I would pray in aid. It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police."

Or in other words, it does not matter whether data is relevant to the purposes for which an organisation has registered – so long as they believe it is.

In what was almost an anti-climax, following those pronouncements, Waller LJ then argued that the fact that individuals had convictions revealed through CRB or employment legislation was not the fault of the police retaining the data – but the fault of legislation allowing employers to view data requested by individuals.

As Liberty lawyer Anna Fairclough, a specialist in privacy litigation, put it: "Exceptions to the Rehabilitation of Offenders Act and the net of employment vetting are being cast so wide that people will be forever haunted by the minor indiscretions of their youth.

"The benefit to the police of retaining the samples is minimal. The cost to the individuals can be huge - and often potentially life-ruining.

"This judgment forgets the privacy rights of millions of people and we hope it is appealed."

While the Police were busy overturning individual rights to privacy in one court, ACPO and the Met were elsewhere digging their heels in over what they claimed to be "excessive" data collection. Their objections follow Home Office plans to set up an online "data hub" that will be accessed by selected civil servants for research purposes.

The new data hub would contain details about every crime, rather than summaries by area. However, it would include data at individual crime level, including crime reference number, date, exact location, crime type, aggravating factors and details of the victim and offender, excluding their names. Some details of arresting officers would be included, but no persoanlly identifying details.

According to the Home Office, this database is no more than a statistical tool, to be used to generate crime statistics centrally, reduce the burden on local forces and improve the monitoring of how effective policy is.

According to the Met, Commissioner Sir Paul Stephenson has received legal advice to the effect that the Data Protection Act may stop some details being handed over. This seems unlikely, since the DPA is relevant only where the processing of personal information takes place – and in the light of recent police moves to undermine it, seems less likely still. ®