Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor

A data controller determines the lawful purposes for which personal data are processed. When applying the third and fifth data protection principles, the Information Commissioner must assess retention against all specified purposes. He cannot confine the inquiry to purposes which he characterises as the controller’s core functions.

Police purposes may include maintaining a comprehensive record of significant convictions and supplying information to courts, prosecutors and other bodies with a legitimate need. The Commissioner’s role is supervisory. A rational professional assessment of operational need should receive substantial weight. Retention must be assessed separately from any future disclosure.

Applying a rationally adopted general retention policy is not rendered unfair merely because an individual was previously told that an earlier deletion policy would apply, absent detrimental inducement or other individual circumstances.

Five chief constables retained old convictions or reprimands on the Police National Computer under guidelines which permitted deletion only in exceptional circumstances. Following complaints prompted principally by disclosure through criminal-record certificates, the Information Commissioner issued enforcement notices requiring deletion. He considered retention contrary to the first, third or fifth data protection principles in the Data Protection Act 1998.

The Information Tribunal dismissed the chief constables’ consolidated appeals and upheld deletion. Appeals on points of law were lodged under section 49 and transferred to the Court of Appeal under CPR 52.14.

The central questions were whether retention had to be assessed only against “core” operational police purposes; what degree of deference was due to professional police judgments about the utility of old convictions; and whether retention of SP’s reprimand was unfair because she had been told that it would be removed when she reached 18.

1. All five appeals were allowed and the enforcement notices quashed. The court was unanimous that the Tribunal erred in its treatment of the third and fifth data protection principles. By a majority, Waller and Hughes LJJ also allowed the appeal concerning the first principle in SP’s case; Carnwath LJ dissented on that issue.

2. The data controller determines the lawful purposes for which data are processed and must specify them through notification. Neither the Commissioner nor the Tribunal may replace those purposes with a narrower category of “core police purposes”. The registered purposes, properly understood, included maintaining conviction records for police operations and providing accurate information to prosecutors, courts, the Criminal Records Bureau and other legitimate recipients.

3. Retention therefore had to be tested against all those purposes. A comprehensive record of significant convictions, including spent convictions, was necessary for criminal investigations, sentencing, disclosure concerning witnesses, safeguarding work and statutory criminal-record certificates. Article 8(5) of Directive 95/46/EC expressly contemplated a complete register of convictions under official control. The absence of a statutory duty to retain every record did not make that purpose impermissible.

4. The Commissioner’s function was supervisory. Where experienced police officers rationally and reasonably judged that old or minor convictions could retain operational value, the Commissioner and Tribunal should not substitute their assessment. Statistics limited to the probability of reoffending did not address other potential uses, including location, associations and the combination of a conviction with other intelligence.

5. Retention was distinct from disclosure. A possible future disclosure could not make retention excessive or unnecessarily prolonged under the third or fifth principles. Questions about the breadth of access to the Police National Computer, the exceptions for spent convictions and any step-down scheme were matters for Parliament and could not be resolved by reconstructing the data protection principles.

6. On SP’s reprimand, the majority held that applying the current policy equally was not objectively unfair merely because she had been informed of the earlier weeding policy. The Tribunal had not found that the assurance induced her admission. Hughes LJ further considered that section 29(1) exempted retention from the fairness requirement because deletion from a comprehensive record would be likely to prejudice crime prevention, detection or prosecution. Carnwath LJ would have upheld the Tribunal’s conclusion because the police had not addressed the representation or established its wider consequences.

1. Court of Appeal (Civil Division): By [2009] EWCA Civ 1079, allowed all five appeals and quashed the enforcement notices.
2. Administrative Court: The appeals on points of law were lodged under section 49 of the Data Protection Act 1998. King J directed under CPR 52.14 that they be considered by the Court of Appeal.
3. Information Tribunal: By a decision promulgated on 21 July 2008, dismissed the consolidated appeals and upheld enforcement notices requiring deletion of the five conviction records.
4. Information Commissioner: Issued five enforcement notices requiring the chief constables to erase the relevant conviction or reprimand data from the Police National Computer.