The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
Definitions used in section 37 1
- the law enforcement purposes
For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
Defined in s.31 · see it in the full Act
Cases considering section 37 5
Boris Karpichkov v The National Crime Agency
Applies the third data-protection principle requiring data to be adequate, relevant and not excessive. It was arguable that the address disclosure was excessive in the circumstances and the issue required trial. (see paras [67]; [86]-[90]; [137]; [161])
XGY v The Chief Constable of Sussex Police & Anor
The provision was pleaded as part of the claimant’s statutory data-protection claims. The judgment held that the claims should not have been summarily dismissed before the immunity and factual issues were properly determined (see paras [22], [134]-[136]).
O, R (on the application of) v Chief Constable of Kent Police
Identifies the third data protection principle as requiring personal data to be adequate, relevant and not excessive. The judgment lists the principle but bases the operative finding principally on unlawfulness, unfairness and inaccuracy.
- II, R (On the Application Of) v Commissioner of Police of the Metropolis
- Bridges, R (On Application of) v The Chief Constable of South Wales Police
What each judgment says about section 37 is in the case-law panel in the full Act.
Amendments and notes
1 notes from legislation.gov.uk
Commencement
- I37S. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)