Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
freedom of assembly under Article 11 of the Convention and freedom of expression
under Article 10 of the Convention. There is no further elaboration of those points. The
skeleton argument concludes, on this ground of appeal, that in the light of those three
alleged deficiencies, the DPIA fell foul of the test specified by the Divisional Court
itself (at [146]), namely:
“If it is apparent that a data controller has approached its task on
a footing that is demonstrably false, or in a manner that is clearly
lacking, then the conclusion should be that there has been a
failure to meet the section 64 obligation”.
148.
Mr Facenna’s skeleton argument made the following criticisms of the DPIA. First, the
DPIA contained no assessment of the impact of the deployment of AFR on the
protection of the personal data of members of the public who might be affected by the
measures. Secondly, it contained no assessment of the risks to their rights and freedoms,
so that, for example, there was little or no engagement with the fact that SWP’s use of
AFR involved the collection of data on a blanket and indiscriminate basis, and it placed
too little weight on the interference posed by the initial collection itself and the plainly
ambitious scale of the collection, particularly bearing in mind that it involved the
sensitive processing of biometric data. Thirdly, the assessment did not adequately
address the risk that a false positive would result in innocent members of the public
having their biometric data retained for longer periods and place them at risk of being
subjected to more intrusive interventions by police. Fourthly, the assessment of the right
to privacy under Article 8 of the Convention, privacy risks, and possible mitigation of
those risks, was negligible at best, being more concerned with the technical operation
of AFR.
149.
In his oral submissions Mr Facenna said that the DPIA did not contain an assessment
of privacy, personal data and safeguards. He said it contained no acknowledgment that
AFR involves the collection of data on a blanket and indiscriminate basis and that the
risk of false positives would mean a longer period of retention. He criticised the DPIA
for failing to address the potential for gender and racial bias. Generally, he submitted
that there was a failure in the DPIA to provide an assessment of the risks and mitigation
of them, as required by section 64 of the DPA 2018. He said that the Divisional Court’s
dismissal of the claim under section 64 has to be seen in the context of the conclusion
of the Divisional Court that Article 8 was not infringed for non-matched members of
the public.
150.
Some of the criticisms now advanced by the Appellant and the Information
Commissioner in respect of the DPIA fall outside the alleged two material errors of law
specified in this ground of appeal. They include the point in Mr Squires’s skeleton
argument that the DPIA does not refer to interference with the Convention rights to
freedom of assembly and expression (Articles 10 and 11) and Mr Facenna’s arguments
that a false positive would result in innocent members of the public having their
biometric data retained for longer periods and place them at risk of being subjected to
more intrusive interventions by police and that the DPIA failed to address the potential
for gender and racial bias.
151.
We agree with the Divisional Court that some of the criticisms of the DPIA made by
Mr Squires and Mr Facenna are unjustified. The DPIA specifically acknowledged that