Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
Definitions
23.
Section 3(2) of the DPA 2018 defines “personal data” as:
“…any information relating to an identified or identifiable living
individual", which means an individual "who can be identified,
directly or indirectly, in particular by reference to—(a) an
identifier such as a name, an identification number, location data
or an online identifier, or (b) one or more factors specific to the
physical, physiological, genetic, mental, economic, cultural or
social identity of the individual”.
24.
Section 35(8) of the DPA 2018 defines “sensitive processing” as activities including:
“…the processing of… biometric data… for the purpose of
uniquely identifying an individual.”
25.
Section 205(1) of the DPA 2018 defines “biometric data” as:
“…personal data resulting from specific technical processing
relating to the physical, physiological or behavioural
characteristics of an individual, which allows or confirms the
unique identification of that individual, such as facial images or
dactyloscopic data”.
Conditions
26.
Section 35(5) prescribes conditions which must be satisfied before the processing of
biometric data for law enforcement purposes may be permitted. These conditions are
threefold: (a) the processing is strictly necessary for the law enforcement purpose;
(b) the processing meets at least one of the conditions in Schedule 8; and (c) the
controller has an appropriate policy document in place (see section 42).
27.
The Schedule 8 conditions include:
“1. Statutory etc purposes
This condition is met if the processing(a) is necessary for the exercise of a function conferred on a
person by an enactment or rule of law, and
(b) is necessary for reasons of substantial public interest.
2. Administration of justice
This condition is met if the processing is necessary for the
administration of justice.
…
6. Legal claims