The fifth data protection principle
PART 3 Law enforcement processing
(1)The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
(2)Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.
For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
Defined in s.31 · see it in the full ActSection 39 is treated as imposing a necessity and proportionality requirement alongside section 35. The court finds no material difference between the statutory requirements and the proportionality assessment under article 8. (see para [29])
The court held that continued retention was not necessary for the processing purpose and therefore breached the fifth data protection principle. (see paras [80]-[85]) The court treated the Article 8 proportionality assessment as answering whether continued retention was necessary under section 39(1). It held that retention was not necessary and therefore breached the fifth principle. (see para [85])
Cited as requiring personal data to be kept no longer than necessary. It supported the court’s conclusion that the general framework regulated AFR retention. (see paras [86]-[87], [96])
What each judgment says about section 39 is in the case-law panel in the full Act.