Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor

Factual and Procedural Background

The appeal concerns whether, under the principles (DPP) of the Data Protection Act 1998, the Police are obliged to delete certain old convictions from the Police National Computer (PNC). The case involves five individuals whose convictions were disclosed following requests by the Criminal Records Bureau (CRB) or a subject access request by one individual. The Information Tribunal (IT) upheld the Information Commissioner's (IC) view that these convictions should be deleted. This ruling, if applied consistently, could lead to the deletion of approximately one million convictions. The Police previously operated a "weeding policy" endorsed by the IC, allowing old convictions to be removed after a period without further offences. However, following inquiries and legislative changes, the Association of Chief Police Officers (ACPO) revised this policy, limiting deletion to exceptional circumstances, primarily wrongful convictions. The Police introduced a "step down" model, which reduces access to certain convictions but does not prevent disclosure in all circumstances, including to the CRB.

Following complaints from the five individuals, the IC issued enforcement notices requiring deletion of their old minor convictions. The five Chief Constables appealed to the IT, which ruled that retention infringed the Data Protection Act principles and ordered deletion. The Chief Constables then appealed to the Administrative Court, which referred the matter to the Court of Appeal.

Legal Issues Presented

1. Whether the Police are bound under the Data Protection Act 1998 principles (DPP3 and DPP5) to delete certain old convictions from the Police National Computer.
2. Whether the purposes for retention of data should be confined to "core" police purposes or include broader registered purposes such as provision of data to other agencies.
3. The appropriate interpretation and application of the data protection principles, particularly adequacy, relevance, excessiveness, and retention periods of personal data.
4. The fairness of retaining data in circumstances where prior assurances were given to a data subject (DPP1).
5. The compatibility of retention with Article 8 of the European Convention on Human Rights.

Arguments of the Parties

Appellants' Arguments (Chief Constables and Police)

• The data controller (Police) determines the lawful purposes for processing data, which include not only core police operational purposes but also providing information to other bodies such as the CPS, courts, and employers.
• Retention of conviction data, however old or minor, is rationally justified by the Police for operational needs and public safety.
• The Information Commissioner's imposition of a "core purposes" limitation is unsupported by the Data Protection Act and the relevant European Directive.
• The Information Tribunal erred in substituting its judgment for that of experienced police officers regarding the value of old convictions.
• "Step down" of convictions does not prevent disclosure under the Police Act 1997, so deletion is not justified solely on that basis.
• The retention is lawful, necessary, and proportionate, and the Police's judgment should be given considerable latitude.

Respondent's Arguments (Information Commissioner)

• Retention of old minor convictions constitutes excessive data retention contrary to DPP3 and DPP5.
• The purposes for retention should be confined to "core" police purposes, excluding broader data sharing purposes.
• Statistical evidence indicates that old minor convictions have little value for police operational purposes, undermining the justification for retention.
• Retention causes damage and distress to data subjects and is disproportionate given the limited utility of the data.
• In the case of one data subject (SP), retention was unfair under DPP1 due to prior assurances that the record would be expunged.

Table of Precedents Cited

Court's Reasoning and Analysis

The court examined the Data Protection Act 1998 and the underlying European Data Protection Directive (95/46/EC), focusing on the principles of data adequacy, relevance, non-excessiveness (DPP3), and retention period (DPP5). It emphasized that the data controller—in this case, the Police—has the authority to determine the lawful purposes for processing personal data, provided these purposes are registered and lawful.

The court rejected the Information Commissioner's and Information Tribunal's narrow "core police purposes" approach, holding that the Police's registered purposes legitimately include assisting other public bodies such as the CPS, courts, and employers. The court found no statutory or legislative basis to confine purposes solely to police operational needs.

Regarding the statistical evidence presented to demonstrate the limited value of old minor convictions, the court held that such evidence was irrelevant to the overall rational and reasonable judgment of the Police about the utility of retaining conviction data. The Police's professional judgment, supported by the Bichard Inquiry and case law, was entitled to considerable deference.

The court noted that the Rehabilitation of Offenders Act 1974 and its exceptions allow for disclosure of spent convictions in certain circumstances, which Parliament has legislated for. The Data Protection Act should not be construed to override these legislative provisions by requiring deletion of data contrary to Parliament's intent.

On the issue of fairness (DPP1) raised by one data subject (SP), the court diverged. It found that the Information Tribunal was entitled to conclude that retention was unfair in SP's specific circumstances due to a prior assurance. However, the majority held that this did not affect the general principle that retention was lawful and fair for others.

The court also considered Article 8 of the European Convention on Human Rights, concluding that retention of conviction data under official authority with appropriate safeguards does not violate privacy rights. The case of S and Marper v UK was distinguished as involving different types of data and circumstances.

Finally, the court recognized the practical importance of the Police National Computer as a comprehensive record essential for criminal justice, multi-agency cooperation, and employment vetting. It acknowledged policy concerns about the breadth of access but emphasized that legislative reform, not data protection enforcement, is the appropriate avenue for addressing such issues.

Holding and Implications

The court allowed the appeals of the five Chief Constables and quashed the enforcement notices issued by the Information Commissioner regarding the retention of the five individuals' old convictions on the Police National Computer.

This holding confirms that the Police, as data controllers, lawfully retain conviction data for a broad range of registered purposes, including assisting other public bodies, and that such retention does not breach the Data Protection Act principles 3 and 5. The court emphasized deference to police operational judgment and rejected the imposition of a narrow "core purposes" test.

Regarding the fairness principle (DPP1), the court upheld the Information Tribunal's decision only in the specific case of one data subject where a prior assurance was given, but dismissed it generally.

The decision maintains the status quo of comprehensive retention of conviction data on the PNC, recognizing its importance for the criminal justice system and public safety. It does not establish new precedent limiting data retention but clarifies the scope of lawful purposes under data protection law and the appropriate role of supervisory authorities vis-à-vis operational police judgments.