C, R (on the application of) v Northumberland County Council & Anor

Retention of personal information by a public authority engages Article 8 and must be justified. The assessment begins by identifying the purposes for which the information is processed and retained. Child-protection records may serve purposes extending beyond the defence of litigation, including protecting other children, enabling data subjects to understand their past, and supporting later investigations, inquiries or proceedings. Information may acquire significance only with hindsight, so a standard retention period is not inherently unlawful. A policy is lawful where it is carefully considered, adapted to its purposes, proportionate and sufficiently flexible. A 35-year period for child-protection records fell within the range of legitimate retention periods on the evidence.

The claimant challenged Northumberland County Council’s policy of retaining child-protection records for 35 years after case closure. Longer periods applied where the child was looked after or adopted. The original claim sought destruction of the family’s records and an order quashing the policy, but the records had been destroyed and the individual facts were no longer material.

The claimant and the Information Commissioner argued that routine retention beyond six years after the child’s eighteenth birthday was unlawful. The Council relied on the continuing importance of historic information for safeguarding, access by data subjects, investigations, inquiries and litigation. The central issue was whether the 35-year policy was justified under common law, Article 8 and the Data Protection Act 1998.

1. Retention and storage of personal information by the state constitute a prima facie interference with Article 8 rights. The common law, Article 8 and the data-protection regime materially required the same justification. The Council therefore bore the burden of justifying its policy.

2. The starting point was to identify the purposes for which the personal data was processed and retained. Those purposes extended beyond defending claims. They included protecting other children by preserving the broader historical picture, enabling data subjects to obtain information about their childhoods, and supporting later investigations, public inquiries, police work, internal reviews and litigation.

3. Historic information could acquire significance only in the light of later events. A policy requiring routine destruction after six years, followed by case-by-case predictive reviews, risked losing patterns which could be identified only retrospectively. Regular reviews would also impose a disproportionate burden on experienced social workers and divert resources from child protection.

4. The Council’s evidence demonstrated the relevance of records concerning parents, siblings and children cared for by older relatives. Confidentiality controls reduced the risk of unjustified intrusion, while the policy allowed earlier or longer retention in exceptional cases and permitted information to be deleted where appropriate.

5. The court distinguished the wholesale communications-data retention considered in Digital Rights Ireland Ltd v Communications Minister [2015] QB 127. The present policy concerned defined child-protection material retained for identified safeguarding and related purposes. The reasoning in R (Catt) v Association of Chief Police Officers and another [2015] 2 WLR 664 supported the relevance of information whose value might emerge only with hindsight.

6. The 35-year period was not the only possible lawful period, but it fell within the bracket of legitimate retention periods. The policy was in accordance with the law, carefully considered, adapted to its purposes, proportionate and flexible. The claim was dismissed.