Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
(3) personal data processed for any of the law enforcement purposes must
adequate, relevant and not excessive in relation to the purpose for which is
it processed (section 37);
(4) personal data must be accurate and kept up to date; inaccurate data should,
subject to the purpose for which it would otherwise be retained, be
corrected or erased (section 38);
(5) personal data should be kept for no longer than is necessary (section
39(1));
(6) personal data should be processed in a secure manner (section 40).
In addition, there is a relevant safeguarding measure, namely, the controller
must have an appropriate policy document (section 42).
87.
The data protection principles are well-known and comprehensive. They apply
to all operations which involve retention or use of personal data. The fact that
they are principles of general application rather than rules specifically targeted
to use of AFR Locate does not make them any the less important or relevant. It
is well-recognised that the need under the ECHR for any interference with
Convention rights to be regulated by law can be met by standards of general
application: see and compare per Lord Sumption in Catt, above, at [11] –
[17]18. In this instance, the general standards in the DPA 2018 have been
formulated with specific reference to regulation of the use of personal data.
Moreover, section 35(3) of the DPA 2018 sets out specific conditions that
must be met for “sensitive processing”, which includes “processing … of
biometric data for the purposes of uniquely identifying an individual”. As we
explain below, when addressing the Claimant’s data protection claims, section
35(3) does apply to the use of AFR Locate, both for the persons on the
watchlists, and the members of the public whose images are caught on CCTV
and then processed. The additional conditions imposed by section 35(3)
include (1) that the processing is “strictly necessary” for the law enforcement
purposes prescribed at section 31 of the Act; and (2) that the processing meets
“at least one of the conditions in Schedule 8”. The Schedule 8 conditions are
each clearly and distinctly described: i.e. (1)(a) necessary “for the exercise of a
function conferred on a person by an enactment or rule of law” or (b)
necessary “for reasons of substantial public interest” or (2) necessary “for the
administration of justice”. The circumstances in which AFR is used are, in
this way, foreseeable.
18
The Claimant drew our attention to the decision of the European Court of Human
Rights in Catt v United Kingdom (2019) (ECHR application no. 43514/15). However,
in that case the Court considered it unnecessary to reach any conclusion on the “in
accordance with the law” issue, and the comments that it did make (see, generally, at
paragraphs 94 – 107) have no specific application to the circumstances of AFR
Locate. In any event, the judgment of the Supreme Court in Catt is binding on us (see
Kay v Lambeth London Borough Council [2006] 2 AC 465 per Lord Bingham at [40][45], Lord Nicholls at [50], Lord Hope at [62], Lord Scott at [121], Lord Walker at
[177], Baroness Hale at [178] and Lord Brown at [213]).