YZ v The Chief Constable of South Wales Police

For law-enforcement data, the data controller retains responsibility for deciding whether retention remains strictly necessary, lawful, fair and proportionate. A deletion policy may ask an applicant to provide evidence supporting deletion without transferring that legal burden to the applicant. An acquittal does not, by itself, establish that the allegation was false, that no crime occurred, or that retained police information is no longer relevant to future risk. The court must decide strict necessity for itself. Retention may be justified by the overall intelligence picture, including safeguarding risks, relevant associations and mental-health information, subject to lawful policies and periodic review. Where retention complies with the Data Protection Act 2018, the resulting interference with article 8 rights will ordinarily be proportionate where it serves law-enforcement and safeguarding purposes.

YZ was unanimously acquitted in 2012 of three rape charges. The police retained the record of the charges and acquittal on the police national computer, while other intelligence was held on local police systems. His application for deletion was refused under the National Police Chiefs’ Council record-deletion Guidance, and an internal appeal was also rejected.

The Administrative Court dismissed his judicial-review claim in [2021] EWHC 1060 (Admin). The appeal challenged the alleged reversal of the burden of proof, the legal test applied to sensitive data, strict necessity and proportionality under the Data Protection Act 2018, and article 8 of the European Convention on Human Rights. The central issues were whether retention remained the controller’s responsibility to justify, whether the statutory strict-necessity test had been applied, and whether the retention policies lawfully supported the decision.

1. Appeal dismissed on all four grounds. The court proceeded on the basis that the applicable police-records policies were lawful and compatible with article 8. That assumption defeated the challenge to retention of the wider local-record information, which had been retained under the MoPI APP and had not itself been the subject of a specific deletion decision.
2. The Guidance did not place the legal burden of demonstrating compliance with the Data Protection Act 2018 on the applicant. The decision whether retention remained strictly necessary was for the data controller. Asking an applicant to provide information and evidence was an evidential and practical means of ensuring that the controller considered all relevant material, including information not previously known to the police. An acquittal alone did not establish that retention was no longer necessary.
3. The court itself had to determine whether strict necessity was established; the issue was not confined to rationality or Wednesbury reasonableness. Retention also had to be lawful, fair and proportionate, and serve a law-enforcement purpose under sections 31, 34, 35 and 39. Those requirements were satisfied. The MoPI APP constituted, or operated with the Guidance as, an appropriate policy document for sensitive data, addressing risk, proportionality, retention and periodic review.
4. The information was assessed as a whole. It included the serious nature of the allegations, a pattern of domestic-abuse allegations, safeguarding concerns concerning YZ’s former wife and child, and intelligence concerning extremist views, associations and mental health. Taken together, the material established a genuine safeguarding and public-safety risk and made retention strictly necessary for law-enforcement purposes. The record of the rape charges and acquittal remained an important part of that overall picture.
5. The reference in the lower judgment to the decision being rational and fair did not show that the wrong test had been applied. Read in context, the Judge had correctly applied strict necessity. Since retention complied with the statutory requirements, it was also compatible with article 8: the interference with private life was limited and proportionate to law-enforcement and safeguarding objectives.

• Court of Appeal (Civil Division) — Appeal dismissed on all four grounds. The court upheld the dismissal of the judicial-review claim.
• High Court of Justice, Queen’s Bench Division, Administrative Court — HH Judge Jarman QC dismissed the claim for judicial review in [2021] EWHC 1060 (Admin).