Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
subject to the regime in Part II of RIPA. We are satisfied that the steps
generally taken by the SWP to deploy surveillance camera systems equipped
with AFR in an overt manner are collectively sufficient such that that the
provisions of RIPA 2000 are not engaged17. Since AFR Locate is not a form of
covert intelligence gathering tool, observations made in cases that have dealt
with such situations, as to the need for steps such as prior judicial authorisation
or authorisation by independent administrative authority are not apposite. It
would be wrong in principle when applying the “in accordance with the law”
standard to start from a premise that AFR Locate is to be seen as the
equivalent of covert interception whether of specific communications, or bulk
communications data.
84.
In our view, there is a clear and sufficient legal framework governing whether,
when and how AFR Locate may be used. What is important is to focus on the
substance of the actions that use of AFR Locate entails, not simply that it
involves a first-time deployment by SWP of an emerging technology. The fact
that a technology is new does not mean that it is outside the scope of existing
regulation, or that it is always necessary to create a bespoke legal framework
for it. The legal framework within which AFR Locate operates comprises
three elements or layers (in addition to the common law), namely: (a) primary
legislation; (b) secondary legislative instruments in the form of codes of
practice issued under primary legislation; and (c) SWP’s own local policies.
Each element provides legally enforceable standards. When these elements are
considered collectively against the backdrop of the common law, the use of
AFR Locate by SWP is sufficiently foreseeable and accessible for the purpose
of the “in accordance with the law” standard.
(a)
Primary legislation
85.
The first element in the framework is the DPA 2018 (we focus on this Act
rather than the DPA 1998, only for sake of convenience). As explained by
Lord Sumption in Catt (at [8]), the DPA 2018 embeds key safeguards which
apply to all processing of all personal data – including the biometric data
processed when AFR Locate is used. Part 3 of the DPA 2018 applies to
processing for law enforcement purposes (and gives effect to the provisions of
Directive 2016/680/EU – “the Law Enforcement Directive”).
86.
By section 34(3) of the DPA 2018, SWP as data controller, “must be able to
demonstrate its compliance with” the six data protection principles and the two
safeguarding measures set out at sections 35 – 42 of the Act. These six data
protection principles are as follows:
(1) processing must be lawful and fair (section 35(1));
(2) the purposes of processing must be specified, explicit and legitimate
(section 36(1));
17
In particular, advertising AFR deployments on Facebook and Twitter, displaying
notices on AFR-equipped police vehicles and handing out of notices to members of
the public (see above).