Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
88.
The requirements arising under the DPA 2018 are mirrored in the Code of
Practice on the Management of Police Information, issued by the College of
Policing under section 39A of the Police Act 1996. By section 39A(7) of the
1996 Act, chief police officers must have regard to the contents of any code
issued under section 39A, when exercising any relevant function. Under the
Code of Practice on the Management of Police Information, the College may
(and has) issued guidance which specifies principles which govern the
handling of information, and this includes any processing of personal data.
(b)
Secondary legislative instruments
89.
The second element in the framework is the Surveillance Camera Code of
Practice. This Code was issued by the Home Secretary pursuant to section 30
of the Protection of Freedoms Act 2012 (“the 2012 Act”); it contains guidance
about the use of surveillance camera systems (see, generally, section 29 of the
2012 Act). By section 33 of the 2012 Act any chief officer of police must have
regard to the contents of this Code when exercising any function to which it
relates; and when deciding any issue in any proceedings, a court may take
account of any failure to act in accordance with the requirements of the Code.
Section 34 of the 2012 Act further provides that the functions of the
Surveillance Camera Commissioner include encouraging compliance with the
Code and providing advice in respect of its contents.
90.
The Code comprises 12 “guiding principles”. These principles concern when
and where surveillance cameras (such as those used as part of AFR Locate)
should be used; the information to be provided to members of the public when
surveillance cameras are used; the extent to which information obtained from
surveillance cameras should be retained; the circumstances in which access to
such information should be permitted, or use should be made of the
information; and the technical standards to be required of any equipment that
is used. Importantly, the Code also provides that no adverse action against any
person should be taken without human intervention (see paragraph 3.2.3 of the
Code).
91.
The Surveillance Camera Commissioner’s overall submission on the Code was
that it provided a “… full system approach to the regulation of surveillance
camera systems as it provides the legal and good practice standard which the
Government expects, as well as highlighting the broader spectrum of
legislative requirements which apply”. We agree with that submission19.
(c)
SWP’s own policies
92.
The third element of the framework is SWP’s own policies as to the use of
AFR Locate. There are three relevant policy documents: (i) SWP’s Standard
19
We note that in March 2019 the Surveillance Camera Commissioner issued a
guidance document in exercise of his power under section 34 of the 2012 Act – “The
Police Use of Automated Facial Recognition Technology with Surveillance Camera
Systems”. This guidance does not itself give rise to any legally enforceable standard.
However, it does provide additional information about how the 12 guiding principles
in the Code apply to the operation of AFR systems.