Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
102.
In addition, where the processing is “sensitive processing”, it is permitted only in the
two cases set out in subsections (4) and (5). Of particular relevance in the present
context is subsection (5), which deals with the situation where (a) the processing is
“strictly necessary” for the law enforcement purpose, (b) the processing meets at least
one of the conditions in Schedule 8, and (c) at the time when the processing is carried
out, the controller has an appropriate policy document in place in accordance with
section 42.
103.
Schedule 8, which sets out conditions for sensitive processing under Part 3, provides
that the condition in paragraph 1 is met if the processing “(a) is necessary for the
exercise of a function conferred on a person by an enactment or rule of law, and (b) is
necessary for reasons of substantial public interest.”
104.
We accept, as did the Divisional Court, that the legal protections in the DPA 2018 form
an important part of the framework in determining whether the interference with the
Appellant’s Article 8 rights was in accordance with the law. That Act is not, however,
sufficient by itself, nor was it suggested that it is.
105.
Before leaving the DPA 2018 we should mention one further matter. In the skeleton
argument on behalf of the Information Commissioner it was submitted that the
Divisional Court had fallen into error by putting the cart before the horse in that it had
addressed the question of the requirement of law in Article 8(2) of the Convention
before considering whether there had been compliance with section 35 of the DPA
2018. In particular, it was submitted that the processing of the data in the present case
was not “based on law” within the meaning of section 35(2) of the DPA 2018,
interpreted in accordance with the EU’s Law Enforcement Directive and the
Convention, because there was no legal basis for the processing that was clear, precise
and foreseeable in its application. It was also submitted that the processing was not
“strictly necessary” for the law enforcement purposes as required by section 35(5)(a)
of the DPA 2018.
106.
Since, it was submitted, there was a breach of section 35(2), there could not be
“accordance with the law” for the purpose of Article 8(2). Detailed submissions were
made as to the requirements of strict necessity, citing authority from both the Court of
Justice of the European Union and the Supreme Court of the UK.
107.
At the hearing before us we made it clear that we did not regard these submissions as
properly falling within the scope of the present appeal. The submissions were made by
an intervener in the context of Ground 1 in the appeal. Ground 1 was formulated as
follows on behalf of the Appellant:
“The Divisional Court erred in concluding that the interference
with the Appellant’s rights under Article 8(1) … occasioned by
the Respondent’s use of live automated facial recognition
technology … on 21 December 2017 and 27 March 2018 and on
an ongoing basis was/is in accordance with the law for the
purposes of Article 8(2) ECHR.”
108.
It is clear therefore that the submissions advanced on behalf of the Information
Commissioner, at least in writing, went beyond the scope of Ground 1 since they