Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
the purposes of Article 8(2) the interference is neither “in accordance with the
law” nor “necessary” or “proportionate”. 3
20.
The Data Protection Claims are brought both under the DPA 1998 and under
the DPA 2018. The latter superseded the former with effect from 25 May
2018. The claim under the DPA 1998 is that by using AFR Locate on Queen
Street on 21st December 2017, and at the Motorpoint Arena on 27th March
2018, SWP acted contrary to section 4(4) of that Act by failing to act in
accordance with the data protection principles. The claim under the DPA 2018
is in two parts:
(1)
The first part is that any current or future use by SWP of AFR
Locate would fail to comply with section 35 of that Act. Section 35
is within Chapter 2 of Part 3 of the DPA 2018, which applies to law
enforcement processing by “competent authorities”. SWP is such an
authority. A failure to comply with section 35 (which sets out the
first data protection principle) would be a breach of the obligation at
section 34(3) of the Act which requires SWP to be able to
demonstrate compliance with the requirements of Chapter 2 of Part
3 of the DPA 2018.
(2)
The second part is that the use of AFR Locate is processing that falls
within section 64(1) of the DPA 2018, and that SWP has failed to
comply with the requirement under that section to carry out a data
protection impact assessment.
21.
The Public Sector Equality Duty Claim (under section 149(1) of the Equality
Act 2010) is that it is evident from the equality impact assessment document
created by SWP in April 2017, in respect of its then proposed use of AFR
Locate, that it failed to have regard to the possibility that use of the AFR
software would produce a disproportionately higher rate of false positive
matches for those who are women or from minority ethnic groups, such that
use of AFR Locate would indirectly discriminate against those groups. That
failure, says the Claimant, means that SWP failed to have the required due
regard for any of the relevant considerations prescribed at section 149(1)(a) –
(c) of the 2010 Act.
22.
For ease of reference, we set out in ANNEX “A” to this judgment the relevant
legal framework under consideration comprising:
(1) Legislation
3
Data Protection Act 1998 (“DPA 1998”)
Protection of Freedoms Act 2012 (“PFA 2012”)
The Law Enforcement Directive
Data Protection Act 2018 (“DPA 2018”)
Ground 2 (breach of Articles 10 and 11 ECHR) was withdrawn.