R (Strain) v Chief Constable of Greater Manchester
[2023] EWCA Civ 240
Case details
Case summary
The Court of Appeal dismissed an appeal against the refusal of permission to apply for judicial review of Greater Manchester Police’s decision not to delete an intelligence report. The court held that the amended intelligence report was lawfully processed for policing purposes and satisfied data protection requirements of fairness, relevance, adequacy, accuracy and being up to date under the GDPR and the Data Protection Act 2018. The court also held that an adequate alternative statutory remedy existed under section 167 of the Data Protection Act 2018 (and related provisions) so that judicial review was not the appropriate route in this case.
Case abstract
Background and facts:
- The intelligence report arose from a welfare visit by Greater Manchester Police on 5 April 2019 after the appellant told a third party she intended to set fire to herself outside a police station. Video footage of the visit existed. An intelligence report was created on 6 April 2019 recording the visit and the appellant’s behaviour and history with Nottinghamshire Police.
- On 13 July 2021 the appellant made a data subject access request and subsequently asked for erasure of the intelligence report on 21 October 2021, identifying four points of dispute about its content.
- The respondent refused erasure on 11 November 2021, relying on policing purposes and retention guidance (including MOPI). Nottinghamshire Police accepted a record should show the appellant as an alleged perpetrator rather than a perpetrator and amendments were proposed.
Procedural posture:
- The appellant issued judicial review proceedings seeking deletion, injunctions and damages. Permission to apply for judicial review was refused initially by HHJ Pearce (14/17 June 2022) and, after a renewal oral hearing (5 August 2022 before the High Court judge who refused permission), permission remained refused. Warby LJ later gave permission to appeal to the Court of Appeal on one limited ground concerning arguability that the respondent breached GDPR/DPA duties (fairness, adequacy, relevance, accuracy, up to date) and should have erased the report; other grounds were refused.
- The Court of Appeal heard the appeal and limited issues to the matters identified in the grant of permission and the question whether an adequate alternative remedy existed.
Issues framed by the court:
- Whether there was an adequate alternative remedy to judicial review (notably under section 167 of the Data Protection Act 2018).
- Whether the High Court judge was wrong to refuse permission to apply for judicial review by failing to consider sufficiently whether the respondent’s processing of the appellant’s personal data in the intelligence report breached the GDPR and/or the Data Protection Act 2018 (in that the report was unfair, inadequate, irrelevant, inaccurate or not up to date) and whether erasure was required.
Court’s reasoning and outcome:
- The court held that the statutory remedy under section 167 (compliance orders and damages) was the appropriate and adequate alternative to judicial review for enforcement of data protection rights and that judicial review should generally be refused where Parliament has provided a specific statutory enforcement procedure.
- On the substantive point, the Court of Appeal endorsed the High Court judge’s assessment that the amended intelligence report accurately recorded the relevant facts and the appellant’s statements and behaviour in context. The report was properly retained for legitimate policing purposes, including protection of life and the discharge of common law and statutory policing duties, and met the GDPR/DPA standards of fairness, relevance, adequacy, accuracy and being up to date.
- The appeal was dismissed for those reasons.
Held
Appellate history
Cited cases
- O'Hara v Chief Constable of the Royal Ulster Constabulary, [1997] AC 286 positive
- R (Hussain) v Secretary of State for Justice, [2016] EWCA Civ 1111 positive
Legislation cited
- Data Protection Act 2018: Part 3
- Data Protection Act 2018: Section 162-164 – sections 162 to 164
- Data Protection Act 2018: Section 167
- Data Protection Act 2018: Section 168-169 – sections 168 and 169
- United Kingdom General Data Protection Regulations: Article 82