II, R (On the Application Of) v Commissioner of Police of the Metropolis

Retention of personal data engages Article 8 and must remain proportionate at the time of review. A policy retention period is not an automatic minimum: the question is fact-specific and turns on whether a continuing policing purpose has been demonstrated. Evidence that radicalisation may emerge over time and that historic information can form part of a wider picture deserves significant weight, but it does not displace an individual assessment. Where a child was referred at 11, the case was closed on its merits because there was no cause for concern, and no later concerns arose over several years, continued retention may be disproportionate. The same assessment determines whether retention is necessary under sections 35 and 39 of the Data Protection Act 2018.

The claimant, aged 16, challenged the Metropolitan Police Commissioner’s refusal to delete personal data arising from a Prevent referral made when he was 11. The referral followed an online tutor’s concerns about alleged statements and behaviour. Police enquiries found no evidence of radicalisation or vulnerability, and the case was closed in June 2016, but the data was retained under the police information-management framework.

The claim alleged breaches of Article 8, the first, third and fifth data protection principles in Part 3 of the Data Protection Act 2018, and the public sector equality duty under section 149 of the Equality Act 2010. The central issues were whether continued retention was proportionate and necessary, whether it amounted to sensitive processing, and whether the equality duty had been discharged.

1. Article 8. Continued retention of the claimant’s personal data was an interference with private life pursuing a legitimate aim and in accordance with the law. The court assessed the proportionality of retention at the date of judgment, giving significant weight to experienced counter-terrorism officers while retaining responsibility for the assessment. Radicalisation is a process rather than an event, and fragmentary information may acquire significance over time. That justified retaining data for a reasonable period, but did not establish that retention remained justified indefinitely.
2. The case was closed on its merits because the officers concluded that there was no cause for concern that the claimant was being radicalised or was vulnerable to radicalisation. Some allegations were found to be untrue or misinformed; others remained unsubstantiated. The source had no further contact with the claimant after November 2015, and no further concerns were raised for four years and ten months. The respondent’s case studies involved substantially shorter intervals and did not demonstrate a policing purpose for continued retention in this case.
3. The six-year period in the police policy was an ordinary retention period subject to review, not a mandatory minimum. The length of proportionate retention was fact-specific. On the evidence, no policing purpose for continuing to hold the claimant’s data had been demonstrated. Retention also had a greater privacy impact than the respondent accepted because it permitted access across ten databases and generated a non-fanciful fear of disclosure to third parties.
4. Data protection. Continued retention was disproportionate and therefore not necessary for the purposes of sections 35(2)(b) and 39(1) of the Data Protection Act 2018. It breached the first and fifth data protection principles. Some of the data was sensitive because it recorded alleged political opinions and religion, even if inaccurate. Since retention was not necessary, it was not strictly necessary for sensitive processing under section 35(5). It was unnecessary to decide whether the other conditions in section 35(5)(b) and (c), or the third principle, were satisfied.
5. Equality duty and order. The respondent had due regard to the claimant’s age and formative years when making the retention decision. The public sector equality duty was therefore not breached. The claim succeeded on the Article 8 and data-protection grounds.