EHRM, 24-01-2019, nr. 43514/15

In a witness statement dated 6 June 2011 prepared in the context of the proceedings introduced by the applicant before the High Court, the then National Coordinator explained the functions of the National Public Order Intelligence Unit (NPOIU) and the position as regards retention of data relating to the applicant. In his witness statement, the National Coordinator clarified that the material which had been disclosed to the applicant following his subject access request of March 2010 was not all the material held in respect of the applicant: a considerable amount of further information had not been disclosed on the grounds that disclosure would prejudice the investigation or detection of crime and that the material was thus exempt from disclosure under section 29 of the Data Protection Act (see ‘Relevant domestic law and practice’, below).

After explaining the nature of his activities and the various units supervised by him, the National Coordinator continued:

He then provided examples of how intelligence reports had assisted in policing a Smash EDO protest in 2010 and confirmed that, in his view, the applicant's data were being processed lawfully and fairly.

A hearing in the judicial review proceedings took place on 9 February 2012. With the agreement of the parties, the Commissioner of Police of the Metropolis was joined as a defendant. The High Court handed down its judgment on 30 May 2012. The court considered that Article 8 was not engaged in the case and that, even if it were, the interference was justified under Article 8 § 2. The applicant was granted permission to appeal by the Court of Appeal on 31 October 2012.

Following a two day hearing during which legal representatives for the applicant, an NGO, the NHRI for England and Wales, ACPO and the Secretary of State presented their arguments, the Court of Appeal unanimously allowed the appeal in a judgment of 14 March 2014. It found that the inclusion of the applicant's personal data in the database constituted an interference with his Article 8 rights which was not justified. The court said that it did not doubt the importance to modern policing of detailed intelligence gathering and that it accepted the need for caution before overriding the judgment of the police about what information was likely to assist them in their task. It noted that, for present purposes, that task was to obtain a better understanding of how Smash EDO was organised in order to be able to forecast the place and nature of its next protest and to anticipate the number of people likely to attend and the tactics they were likely to adopt.

The court said that it was ‘not easy to understand how the information currently held on Mr Catt can provide any assistance in relation to any of those matters’. It referred to the comment in the statement of the National Coordinator that it was valuable to have information about the applicant's attendance at protests because he associated with those who had a propensity to violence and crime. However, it considered that the statement did not explain why that was so, given that the applicant had been attending similar protests for many years without it being suggested that he had indulged in criminal activity or actively encouraged those that did. The court continued:

The Supreme Court granted the Commissioner and ACPO leave to appeal. Following a three day hearing during which legal representatives for the applicant, an NGO, the NHRI for England and Wales, ACPO and the Secretary of State submitted arguments, it upheld the appeal in a judgment of 4 March 2015 by a majority of four justices to one. All five justices agreed that Article 8 was applicable and that retention of the data amounted to an interference with the applicant's rights under that article.

Lord Sumption delivered the leading opinion for the majority. He set out the applicable legal framework for collection and retention of data. After reviewing the requirements for ‘lawfulness’ under Article 8 of the Convention, by reference to S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 99, ECHR 2008, he concluded that the interference was in accordance with the law. He noted that the Data Protection Act laid down principles that were germane and directly applicable to police information and contained a framework for their enforcement. These principles were supplemented by a statutory Code of Practice and administrative Guidance (see ‘Relevant domestic law and practice’, below), compliance with which was mandatory. While, inevitably, there were discretionary elements in the scheme, their ambit was limited. Lord Sumption considered the applicant's argument that the Code of Practice and the Guidance did not enable him to know precisely what data would be obtained and stored or for how long to be unrealistic. He explained that the infinite variety of situations in which issues of compliance might arise and the inevitable element of judgment involved in assessing them made complete codification impossible. However, he noted, any person who thought that the police held personal information about him could seek access to it under section 7 of the Data Protection Act and, if he objected to its retention or use, could bring the matter before the Information Commissioner.

Lord Sumption then turned to consider the proportionality of the interference. He observed that political protest was a basic right recognised by the common law and protected by Articles 10 and 11 of the Convention. He summarised the facts of the applicant's case, including the nature of Smash EDO's activities and the applicant's attendance at public demonstrations, and the framework for police collection and retention of data in this context. He concluded that the retention of information, including some which related to persons such as the applicant against whom no criminality was alleged, was justified. The starting point, in his view, was the nature and extent of the invasion of privacy involved in the retention of information of this kind, which he described as minor. While the information stored was personal information because it related to individuals, it was in no sense intimate or sensitive information. Rather, it was information about the overt activities in public places of individuals whose main object in attending the events in question was to draw public attention to their support for a cause. Although the collation of the information in the form in which it appeared in police records was not publicly available, the primary facts recorded were and always had been in the public domain; no intrusive procedures had been used to discover and record them.

He then addressed the justification for retaining the personal data for someone who has a clean record and for whom violent criminality must be a very remote prospect indeed. Referring back to the National Coordinator's statement (see paragraphs 18 to 20), he identified three reasons for the need to retain such data:

He also underlined some basic facts about intelligence-gathering commenting:

Lord Sumption further considered that the retention in a nominal record or information report of information about third persons such as the applicant did not carry any stigma of suspicion or guilt. It did not imply that all those mentioned as participating in events such as Smash EDO protests were being characterised as extremists. It was further noteworthy that the material was not usable or disclosable for any purpose other than police purposes, except as a result of an access request by the subject under the Data Protection Act. It was not used for political purposes or for any kind of victimisation of dissidents and was not available to potential employers. The material was also periodically reviewed for retention or deletion according to rational and proportionate criteria based on an assessment of danger to the public and value for policing purposes.

In conclusion, Lord Sumption was of the view that sufficient safeguards existed to ensure that personal information was not retained for longer than required for the purpose of maintaining public order and preventing or detecting crime, and that disclosure to third parties was properly restricted.

Lady Hale concurred with Lord Sumption but indicated:

Lord Toulson, dissenting, agreed that the collection and retention of the data by the police was in accordance with the law. However, he considered that retention of the data was disproportionate. He explained that he had no difficulty in accepting in general terms the explanation given in the National Coordinator's statement, but that there had to be limits, particularly in the case of a person who had never been accused of violence and had been assessed not to be a threat. The statement did not explain why it was thought necessary to maintain for many years after the event information on someone whom the police had concluded, as they had in July 2010, was not known to have acted violently and did not appear to be involved in the coordination of the relevant events. Nor did it explain why it was thought necessary and proportionate to keep details of the applicant's attendance at other political protest events such as the Labour Party conference and the TUC conference.

He agreed with the Court of Appeal that the Commissioner had not shown that the value of the information relating to the applicant was sufficient to justify its continued retention. As to the suggestion that it would place too great a burden on the police to undertake frequent reviews, Lord Toulson pointed out that there was no evidence from the police that this would be over-burdensome. On the contrary, he said, the thrust of the evidence was that they did carry out regular reviews so there was nothing to indicate that deleting their historic records of the applicant's attendances at protest events would create any real burden.

Lord Toulson accepted that, when investigating serious organised crime, it was necessary for the police to be able to collate and keep records of the details of their investigations. However, he did not agree that there was any risk of that being hampered by upholding the decision of the Court of Appeal in the applicant's case. While the court should be slow to disagree with the evaluation of the potential usefulness of evidence by the police if a clear reason for it had been advanced, on the facts of this case Lord Toulson could not see what value they had identified by keeping indefinitely a record of the applicant's attendances at events where he had done no more than exercise his democratic right of peaceful protest. He concluded:

The Data Protection Act 1998 regulated the processing of personal data. It required that the processing of data comply with the ‘data protection principles’ in Schedule 1 to the Act. For a summary of the relevant principles see M.M. v. the United Kingdom, no. 24029/07, §§ 65–71, 13 November 2012. Part 2 of the Act was titled ‘Sensitive personal data’:

The Data Protection Act 1998 was repealed and replaced by the Data Protection Act 2018 which came into force on 27 May 2018. Chapter 2 of Part 3 of the Data Protection Act 2018 sets out the principles that apply to the processing of data by law enforcement. Section 35 states that ‘sensitive processing’ means the processing of personal data revealing ‘political opinions’ or ‘trade union membership’ inter alia. Section 42 provides for further safeguards in relation to such ‘sensitive processing’.

Both the Data Protection Acts implement instruments of European Union Law all of which provided for ‘special categories’ of personal data liable to higher protection than other types of personal data (see paragraphs 67–70 below).

Under section 39A of the Police Act 1996, the Secretary of State is empowered to issue codes of practice for the purpose of promoting the efficiency and effectiveness of police forces. A Code of Practice on the management of police information (‘MoPI Code of Practice’), based on the provisions of the Data Protection Act, was issued by the Secretary of State in July 2005. Under the Code, handling of police information is limited to ‘police purposes’. These are defined at paragraph 2.2 as protecting life and property, preserving order, preventing crime, bringing offenders to justice and performing any legal duty or responsibility of the police.

The MoPI Code of Practice provides for more detailed provision to be made by way of guidance. Such guidance (the ‘MoPI Guidance’) was originally issued by ACPO in 2006 and updated by a new edition in 2010. It was later superseded by the Authorised Professional Practice: Information Management — Retention, review and disposal, published by the College of Policing in 2013. However, the 2013 Guidance appears substantially the same as the 2010 edition.

Section 2 of the 2010 MoPI Guidance addresses the processes for managing police information. It states at 2.2. that:

Section 7 deals with the review of information for retention or disposal. It requires police information to be managed in compliance with the Convention, the Human Rights Act and the Data Protection Act. Paragraph 7.1 begins:

Paragraph 7.2.1. states that the police force must act in a way that complies with the European Convention on Human Rights and the Human Rights Act 1998:

Paragraph 7.3.1 provides that the object of the review is to ensure that there is a continuing policing purpose for holding the record, that the record is adequate, up-to-date and not excessive, that the Data Protection Act is complied with, and that the assessment of the level of risk that the person presents is correct.

Paragraph 7.4 provides:

A number of detailed criteria for carrying out this exercise are set out. Records are required to be subjected to an initial evaluation and then kept for a minimum of six years. Thereafter, they are subject to ‘triggered reviews’, when information is added about the person in question; a statutory demand for access or disclosure is received; or a request for information is made by another law enforcement agency.

Appendix 4 to the guidance sets out scheduled reviews, which are fixed for information relating to individuals who have committed serious criminal offences or are considered dangerous to the public. The timing of these reviews varies with the nature of the information and the gravity of the risk. The Appendix specifies that records should be retained until persons reach 100 years old if they have been convicted or are suspected of involvement in offences involving the highest level of danger to the public. Otherwise, where retention limits are mentioned these refer to the minimum limits of 6 years retention or the length of sentence (if longer).

Paragraph 7.7 of the MoPI Guidance explains the need to collect and retain intelligence:

Her Majesty's Inspectorate of Constabulary (HMIC) is a statutory organisation established under s.54 of the Police Act 1996 to inspect, and report to the Home Secretary and to Parliament on the efficiency and effectiveness of the police forces in England and Wales. The HMIC has a remit to report on information management by the police.

Following revelations about the use of undercover policing in unrelated, domestic litigation HMIC announced they would review the systems used by the NPOIU to authorise and control the development of intelligence. HMIC published its ‘review of national police units which provide intelligence on criminality associated with protest’ in 2012.

The report is focussed on reviewing the use of undercover policing. However, it does examine police work in this domain more widely including an analysis of ‘the NPOIU and its governance’ in section 4 of the report, which also reviewed the work of its so-called sister units the National Extremism Tactical Co-ordination Unit and the National Domestic Extremism Team (‘NDEU’). In this part of the report, it criticised the definition of ‘domestic extremism’, stating:

The review also examined the intelligence systems used commenting:

In its July 2015 report ‘Building the Picture: An inspection of police information management’ the HMIC stressing the importance of good information management stated in its national inspection findings:

In its findings for the Metropolitan Police Service, which is the service that includes Special Branch, responsible for policing ‘domestic extremism’, it commented:

Recommendation 1 to chief constables was that they should ensure:

Recommendation 7 to the College of Policing was that it:

Article 6 of the Convention titled ‘Special categories of data’ states as follows:

In relation to Article 6 the Explanatory Report to the Convention comments:

The Convention was modernised, by means of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, opened for signature on 10 October 2018 and Article 6 of the Convention, as amended by the Protocol, reads:

Principle 3.a. states that the existence of electronic databanks in the public sector (defined as any electronic data processing system which is used to handle information) must have been provided for by law or by special regulation or have been made public in a statement or document, in accordance with the legal system of each member state.

Principle 4 states:

Principle 5 states:

The appendix to the recommendation sets out the basic principles in this context. Principle 2.1 — Collection of data, states:

Principle 2.4. states:

Principle 7 — length and storage of updating of data states:

The applicant complained that the systematic collection and retention of information about him in a searchable database amounted to an interference with his right to privacy under Article 8. He argued that this interference was not justified because the database on which the data were held did not provide sufficient safeguards and so was not in accordance with the law. In particular he argued that the scope of the database may be adjusted arbitrarily by the police; data is retained for excessively long periods on the basis that the database as a whole may be useful; data is subject to automated and manual processing. He did not make arguments based on data protection legislation but submitted that the retention is unjustified given that the data retained related to his involvement in proper and lawful political protest activity and has never been useful for any police functions. The retention of such data is likely to have a chilling effect.

The applicant also argued that as records relating to him were found on the database after the Supreme Court's decision, the Supreme Court had made its decision on an incomplete factual basis. Recalling his assertion that the database had inadequate safeguards, the applicant argued that the fact records are not properly disclosed even in the context of proceedings before the Supreme Court indicates that the database is not in accordance with the law. He also alleged that there is no real system of oversight or independent review, emphasising that making a ‘subject access request’ under the DPA will only be effective if all relevant data is disclosed by the police when they receive such a request. The applicant also asserted that the margin of appreciation to be afforded in light of the decisions of the domestic courts is reduced, given that those courts did not have all the relevant information before them.

The Government accepted that the collection and retention of information about the applicant constituted an interference with his right to respect for private life. However, relying on the findings of the Supreme Court, they contended that the interference was very limited.

They also relied on the findings of the Supreme Court that the interference was in accordance with the law, being subject to the Data Protection Act 1998, and a statutory Code of Practice and Guidance.

As to the necessity of storing the applicant's information, the Government underlined that the differences of view between the Court of Appeal and the Supreme Court reflect opinions properly open to both courts on the evidence. With reference to the extensive amount of judicial scrutiny on this point at the domestic level, they contended that the question of whether it was necessary to retain the applicant's data falls within the state's margin of appreciation.

In relation to the disclosure of additional reports concerning the applicant after the domestic proceedings, the Government stated that these do not have any particular impact on the standing of the domestic judgments and that the applicant should make use of domestic remedies to bring a challenge concerning those disclosures, for example by way of judicial review.