Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
49.
On the first issue, the Divisional Court concluded (at [132] and [133]) that AFR Locate
does entail sensitive processing within section 35(8) insofar as it involves processing
biometric data of members of the public “for the purpose of uniquely identifying an
individual” within section 35(8)(b).
50.
On the second issue, the Divisional Court found that AFR Locate meets the first
requirement of section 35(5). They held (at [136]) that, for all the reasons given by them
in relation to proportionality in the context of Article 8, the first of the requirements at
section 35(5), namely “the processing is strictly necessary for the law enforcement
purpose”, was satisfied. The Divisional Court held (at [137]) that the second
requirement of section 35(5), that the processing must meet at least one of the
conditions in Schedule 8 to the DPA 2018, was satisfied because of compliance with
paragraph 1 of Schedule 8, the processing being necessary for the reasons given by the
Divisional Court in the context of proportionality and Article 8, and the relevant rule of
law being the common law duty to prevent and detect crime. As to the third
requirement, that the controller has an appropriate policy document in place in relation
to the sensitive processing in accordance with section 42, the Divisional Court said (at
[139]) that they thought it was open to question whether the policy document relied
upon by SWP, entitled “Policy on Sensitive Processing for Law Enforcement Purposes”
dated November 2018 (“the November 2018 Policy Document”), fully met the standard
required by section 42(2). They added the following at [141]:
“For the moment, we confine ourselves to the above
observations. Given the role of the Information Commissioner
and the prospect of further guidance, we do not think it is
necessary or desirable for this Court to interfere at the present
juncture and decide whether the SWP’s current November 2018
Policy Document meets the requirements of section 42(2) of the
DPA 2018. In our view, the development and specific content
of that document is, for now, better left for reconsideration by
the SWP in the light of further guidance from the Information
Commissioner.”
51.
The Divisional Court turned finally, in respect of the Appellant’s data protection claims,
to his claim that SWP had failed to comply with the obligation to undertake an impact
assessment complying with section 64 of the DPA 2018. The Divisional Court rejected
that claim on the grounds that at all material times the processing by SWP was
supported by a relevant data protection impact assessment (“DPIA”) and that,
approaching the matter on the footing that SWP had brought to bear a conscientious
assessment, the impact assessment prepared by SWP did meet the requirements of
section 64.
The PSED claim
52.
The Divisional Court rejected the Appellant’s claim that SWP had failed to comply
with its obligation under section 149 of the Equality Act 2010 because it did not, in its
assessment, consider the possibility that AFR Locate might produce results that were
indirectly discriminatory on grounds of sex and/or race because it produces a higher
rate of positive matches for female faces and/or for black and minority ethnic faces.
The Divisional Court said (at [153]) that there was no suggestion that, as at April 2017