Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
In this case, the Claimant’s arguments on strict necessity for this purpose
comprise the matters relied on for the purposes of the proportionality
submission on the claim under ECHR Article 8. For all material purposes the
issue is the same. The reasons set out above at paragraphs 98 – 106 apply
equally here; our conclusion is that the first of the requirements at section
35(5) of the DPA 2018 is satisfied.
137.
The second section 35(5) requirement is that the processing must meet at least
one of the conditions in Schedule 8 to the DPA 2018. SWP relies on
paragraph 1 of Schedule 8, that
“the processing –
(a) is necessary for the exercise of a function conferred on a
person by an enactment or rule of law, and
(b) is necessary for reasons of substantial public interest”.
The relevant rule of law is the common law duty to prevent and detect crime.
In the context of the present claim, the ‘necessity’ question is addressed by the
reasons we have set out above in the context of proportionality under the
Article 8 claim. For these reasons, the second section 35(5) requirement is
met.
138.
The third section 35(5) requirement is that when the processing occurs “the
controller has an appropriate policy document in place (see section 42)”.
Section 42(2) states the following.
“(2)
The controller has an appropriate policy document in
place in relation to the sensitive processing if the controller has
produced a document which —
(a) explains the controller's procedures for securing
compliance with the data protection principles (see section
34(1)) in connection with sensitive processing in reliance on
the consent of the data subject or (as the case may be) in
reliance on the condition in question, and
(b) explains the controller's policies as regards the
retention and erasure of personal data processed in reliance
on the consent of the data subject or (as the case may be) in
reliance on the condition in question, giving an indication of
how long such personal data is likely to be retained.”
139.
SWP relies on its policy document entitled “Policy on Sensitive Processing for
Law Enforcement Purposes” dated November 2018 (“the November 2018