Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
within the scope of that Directive in so far as it constitutes
automatic processing.
25.
Surveillance in the form of a video recording of
persons, as in the case before the referring court, which is
stored on a continuous recording device—the hard disk
drive—constitutes, pursuant to article 3(1) of Directive 95/46,
the automatic processing of personal data.”
Discussion
122.
In our view, the Claimant succeeds on his argument that the processing of his
image by the AFR Locate equipment was processing of his personal data not
on the first route but on the second. He succeeds on the basis that the
information recorded by AFR Locate individuates him from all others, i.e. it
singles him out and distinguishes him from all others.
123.
On the evidence before us, the first route - the possibility of indirect
identification by reference to further information that may already be or in
future come to be in SWP possession - is somewhat speculative. There is
nothing in the evidence in this case that is equivalent to the mechanism relied
on by the court in Breyer, namely the ability to contact the service provider
(see at paragraph 47 of the judgment in that case), and in any event, in the
circumstances of the present case, this route seems artificial and unnecessary.
124.
As regards the second route – individuation – in our view, the members of the
public caught on the CCTV cameras are sufficiently individuated because the
AFR Locate equipment takes images of their faces, that information is
processed to extract biometric facial data, which is itself processed by being
compared with information being drawn from the watchlist. By its nature, the
facial biometric data is information about a natural person. That person is
identifiable in the sense required by the definition in the 1995 Directive and
the DPA 1998 because the biometric facial data is used to distinguish that
person from any other person so that the matching process can take place.
125.
Where the data in issue is biometric facial data, we see no need for the analysis
adopted by the CJEU in Breyer (in the context of information comprising
dynamic IP addresses). Whether or not such information is personal data may
be open to debate, as is apparent from the judgment in Vidal-Hall. However,
the biometric facial data in issue in this case is qualitatively different and
clearly does comprise personal data, because, per se, it permits immediate
identification of a person. It follows that SWP was (and is) required to process
that data consistently with the data protection principles.
126.
The Claimant’s case that SWP acted unlawfully under section 4(4) DPA 1998
by failing to comply with the data protection principles rests only on the first
data protection principle. The first requirement of that principle is that
personal data must be processed lawfully and fairly. Given our conclusion on
the Claimant’s Article 8 claim, however, we are satisfied that the use of AFR
Locate in December 2017 and March 2018 satisfied this condition of