Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
that the use of AFR Locate on 21 December 2017 (Queen Street) and 27 March 2018
(Motorpoint Arena) struck a fair balance and was not disproportionate. The Divisional
Court further said (at 108]), regarding any future use of AFR Locate, that, on the
evidence before them as to the manner in which AFR Locate was currently deployed
by SWP, they were satisfied that there is no systemic “proportionality deficit” such that
it can be said that future use of AFR Locate by SWP would be inevitably
disproportionate.
Data Protection claims
45.
The Divisional Court recorded (at [109]) that, although none of the deployments by
SWP of AFR in issue in the proceedings took place after the commencement of the
DPA 2018 (25 May 2018), all parties had requested that the legality of the deployments
of AFR Locate be considered as if they had taken place after 25 May 2018 and the
Divisional Court were content to do so. The Divisional Court addressed the data
protection claims under three headings: (1) the claim under the DPA 1998, (2) the claim
under section 35 of the DPA 2018, and (3) the claim under section 64 of the DPA 2018.
46.
The primary point of dispute before the Divisional Court under the DPA 1998 was the
extent to which using AFR Locate entails processing personal data, SWP contending
that the only personal data processed is the data of persons on the watchlist on the
ground that it is only those persons that SWP can identify by name. Having referred to
the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ
311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad
[2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of
the Appellant’s image by the AFR Locate equipment was processing his personal data
because the information recorded by AFR Locate individuated him from all others, that
is to say it singled him out and distinguished him from all others.
47.
The Divisional Court rejected, however, the Appellant’s case that SWP acted
unlawfully under section 4(4) of the DPA 1998 by failing to comply with the first data
protection principle, in particular that personal data must be processed lawfully and
fairly. Given their conclusion on the Appellant’s Article 8 claim, the Divisional Court
were satisfied that the use of AFR Locate in December 2017 and March 2018 satisfied
that condition of lawfulness and fairness.
48.
Turning to the requirement in section 34 of the DPA 2018 that SWP, as a “competent
authority”, had to be able to demonstrate compliance with the provisions of Chapter 2
of Part 3 of the DPA 2018 concerning law enforcement processing, the Divisional Court
identified the issues in dispute as being: (1) whether (as the Appellant contended but
SWP contested) the processing of the biometric data of members of the public whose
faces are captured by the CCTV cameras entails “sensitive processing” as described in
section 35(8) of the DPA 2018, and (2) whether (as the Appellant contended but SWP
contested) AFR Locate failed to meet the requirements of section 35(5). Those
requirements are that: (a) the processing is strictly necessary for a law enforcement
purpose; (b) the processing meets at least one of the conditions in Schedule 8; and (c)
at the time when the processing is carried out, the controller has an appropriate policy
document in place. The Appellant contended that none of those requirements was
satisfied.