Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
data is derived from a person’s facial features that are “manifest in public”
does not detract from this. The unique whorls and ridges on a person’s
fingertips are observable to the naked eye. But this does not render a
fingerprint any the less a unique and precise identifier of an individual. The
facial biometric identifiers too, are precise and unique.
58.
The Court of Justice of the European Union (“CJEU”) has also repeatedly
emphasised that the right to protection of personal data is “closely connected
with the right to respect for private life”, and that “the right to respect for
private life with regard to the processing of personal data” is founded on both
Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
and extends to “any information relating to an identified or identifiable
individual” (C-468/10 and C-469/10 ASNEF v Administración del Estado
[2012] 1 CMLR 48 at [41] – [42]; see also C-291/12 Schwarz v Stadt Bochum
[2014] 2 CMLR 5 at [26] which concerned a person’s refusal to provide his
fingerprints in the context of obtaining a passport). The CJEU noted that
fingerprints “objectively contain unique information about individuals which
allows those individuals to be identified with precision” (at [27]). It held that
both the taking and retention of fingerprints “constitutes a threat to the rights
to respect for private life” (at [30]). The Court went on to hold that the taking
of fingerprints and facial images engaged Articles 7 and 8 of the Charter (at
[49]).
59.
The fact that, save where a match is detected, facial biometric information is
retained for only a very short period, does not affect the analysis. The
application of Article 8 is not dependent on the long-term retention of
biometric data. It is sufficient if biometric data is captured, stored and
processed, even momentarily. The mere storing of biometric data is enough to
trigger Article 8 and the subsequent use (or discarding) of the stored
information has no bearing (see S v. United Kingdom at [67], above).
Accordingly, the fact that the process involves the near instantaneous
processing and discarding of a person’s biometric data where there is no match
with anyone on the watchlist (and such data is never seen by or available to a
human agent) does not matter. The AFR process still necessarily involves the
capture, storage and “sensitive processing” of an individual’s biometric data
before discarding. Article 8 is triggered by the initial gathering of the
information. In the context of the interception of communications, the
Strasbourg Court has treated the initial gathering of the information in
question, its retention, and any subsequent use, as discrete interferences with
Article 8 (see Amann v Switzerland (2000) 30 EHRR 843 [GC] at [48] and
[69]).
60.
We are fortified in our conclusion that the use of AFR technology engages
Article 8 by the fact that our view is shared by both the Information
Commissioner and the Surveillance Camera Commissioner. The Information
Commissioner stated in her skeleton argument:
“18.
… The automated capture of facial biometrics,
and conversion of those images into biometric data,
involves large scale and relatively indiscriminate
processing of personal data. If such processing is not