Summary of Judgment — Judge Barr (delivered 30 April 2026)

Factual and Procedural Background

The Applicants (two serving members of the national police service, referred to individually as "Applicant A" and "Applicant B") participated in the arrest of a juvenile in November 2018. A complaint was made about the level of force used. Company A (the Ombudsman-type body) investigated, prepared reports and, in May–June 2024, referred its investigation file to Company E (the Director of Public Prosecutions) and notified Company B (the National Vetting Bureau) of a "bona fide concern" under s.19 of the National Vetting Bureau (Children and Vulnerable Persons) Act 2012 (the "2012 Act"). The Applicants were informed of Company A's intention to notify Company B but were not provided with the content of the specified information held on Company B's register. Company E later directed that there be no prosecution and Company A decided not to pursue further disciplinary investigation under the disciplinary provision in the policing Act. Company B (through Officer A) declined to remove or amend the specified information and declined to disclose its content to the Applicants outside the statutory vetting/disclosure process. The Applicants sought judicial review; leave was granted on 7 April 2025. Judge Barr delivered the judgment challenged here.

Legal Issues Presented

1. Whether the Applicants were time‑barred from challenging Company A's June 2024 notification to Company B.
2. Whether Company A's notification to Company B in June 2024 was premature (i.e. made before the conclusion of Company A's investigatory process).
3. Whether Officer A or any officer of Company B was required to assess (act as a "gatekeeper" for) specified information on receipt before placing it on the register.
4. Whether the respondents acted unlawfully or unreasonably in failing to correct, amend or remove specified information in light of subsequent events (no prosecution by Company E; discontinuation of disciplinary investigation).
5. Whether the Applicants should have exhausted an alternative remedy under the Data Protection Act 2018 before seeking judicial review.
6. Whether ss.10, 15 and 19 of the 2012 Act are repugnant to the Constitution (fair procedures, good name, right to be heard) and/or incompatible with Article 8 ECHR (right to private life).

Arguments of the Parties

Applicants' Arguments (summarised)

• The June 2024 notification was premature because it was made before Company A's investigation had concluded; it should be set aside.
• Officer A/Company B failed to perform any initial assessment of the notified specified information (failed gatekeeper role) before placing it on the register.
• The respondents acted unreasonably and unlawfully by failing to amend or revoke the specified information after Company E directed no prosecution and Company A discontinued disciplinary investigation.
• The statutory regime is procedurally unfair because the Applicants do not know the content of the specified information unless and until a third party requests vetting disclosure; this indefinite secret retention infringes constitutional fair procedures, good name and employment rights, and Article 8 ECHR.

Respondents' Arguments (summarised)

• Company A acted lawfully and in time pursuant to s.19: the notification followed conclusion (for the criminal-investigatory aspect) and was made "as soon as may be". Failure to notify would be an offence under s.19(8).
• The statutory scheme places the assessment obligation on Officer A under s.15 at the disclosure stage; there is no obligation on Company B to assess specified information upon receipt or to act as a gatekeeper before placing it on the register.
• A decision not to prosecute or not to pursue disciplinary proceedings does not necessarily render the prior bona fide concern incorrect or require correction under s.19(4); there may be legitimate reasons for those later decisions unrelated to accuracy of the earlier concern.
• The Applicants had an alternative remedy under the Data Protection Act 2018 (complaint to the Data Protection Commission and appeal to the High Court) which they had not exhausted.
• The 2012 Act strikes a proportionate balance between protection of children/vulnerable persons and data-subject rights; rights to fair procedures are engaged at the disclosure stage under s.15, which affords summaries, submissions and appeal rights.

Table of Precedents Cited

Court's Reasoning and Analysis

The court addressed each legal issue in turn and applied statutory construction, domestic precedents and European Convention jurisprudence:

1. Time-bar: under Order 84 RSC the Applicants were notified on 18 June 2024 of Company A's intention; the three‑month rule for judicial review was not complied with and no sufficient grounds for extension were provided; the Applicants were therefore out of time to challenge the June 2024 notification.
2. Prematurity of notification: applying MP, the court found Company A's criminal-investigatory process under the policing Act had effectively concluded with the designated officer's report, expert legal review and decision to refer to Company E. The notification in June 2024 was therefore not premature.
3. Gatekeeper obligation: statutory architecture places assessment obligations on Officer A under s.15 at the disclosure stage. The absence of the word "reasonable" from s.19 and its presence in s.15 indicates no obligation on Company B to assess specified information on receipt; accordingly there is no initial gatekeeper duty.
4. Failure to amend register: the court could not determine that the specified information supplied by Company A was incorrect or inaccurate because the content of that information was not before the court. The mere fact of a subsequent decision by Company E not to prosecute, or Company A not to pursue disciplinary action, does not automatically render the earlier bona fide concern inaccurate; s.19(4) obliges correction only if the scheduled organisation becomes aware information is incorrect.
5. Alternative remedy: while statutory appeal routes exist under the Data Protection Act, the court held it would not bar the present proceedings because the Applicants raised constitutional and ECHR compatibility issues which could not be resolved adequately through the Data Protection complaint mechanism; alternatively, exceptions to the rule applied.
6. Constitutional analysis: relying on the right to be heard as articulated in Dellway, the court held that retention on Company B's register of highly discreditable specified information (a concern that the person may pose a risk to children/vulnerable adults) itself engages the right to fair procedures and the right to one's good name. The statutory scheme which provides no mechanism for a data subject to see or to challenge specified information until a third party requests a vetting disclosure is inconsistent with those constitutional protections.
7. ECHR (Art.8) analysis: the court held that retention of unspecified, potentially highly discreditable material on the register without routine review or a mechanism for the data subject to access and challenge it constitutes an interference with private life. Applying Marper, Catt, MM, Vavřička and related authorities, the court found the statutory structure lacked sufficient safeguards, effective review and proportionality and therefore amounted to a violation of Art.8 in the manner in which ss.10, 15 and 19 operated in practice.

Holding and Implications

Core Rulings:

• The Applicants have not established that the respondents acted in breach of the 2012 Act in respect of the June 2024 notification.
• Sections 10, 15 and 19 of the National Vetting Bureau (Children and Vulnerable Persons) Act 2012 are repugnant to the Constitution insofar as they do not afford an affected person the right to see specified information concerning them and to make submissions on its veracity or accuracy prior to a vetting disclosure request and a preliminary decision to disclose by the Chief Bureau Officer.
• Sections 10, 15 and 19 of the 2012 Act are incompatible with the European Convention on Human Rights (Art.8) insofar as they do not afford an affected person the right to see specified information concerning them and to make submissions on its veracity or accuracy in the absence of a vetting disclosure request.

Direct consequences and orders proposed by the court (as expressed in the judgment):

• The court will make the two declarations summarised above (constitutional repugnancy and ECHR incompatibility) in relation to ss.10, 15 and 19 as specified.
• The court refused to grant several of the specific reliefs sought by the Applicants that would require the court to order disclosure or to rewrite the statutory scheme (quashing the referral, ordering disclosure of the specified information, or directing respondents to adopt new procedures), because the court lacks authority to insert provisions into the 2012 Act and because the court did not know the content of the specified information.
• Costs: the court proposed specific costs orders: the Applicants entitled to costs against the fifth and sixth respondents; the first to fourth respondents entitled to costs against the Applicants in respect of the Applicants' failure to establish breaches by those respondents; cross‑orders and adjudication by the Office of the Legal Costs Adjudicator as set out in the judgment.
• No order as to damages was made because the issue was not argued.
• The parties were given four weeks to file short submissions on the terms of final orders and costs; a directions mention was listed for 10 June 2026.

Note: This summary is based exclusively on the content of the provided judgment text and is fully anonymised: individual persons and non‑case‑name organisations referenced in the judgment have been replaced by neutral placeholders (e.g., "Applicant A/B", "Company A/B", "Officer A", "Company E"). Precedent citations are reproduced as they appear in the judgment.