Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor

The issue on this appeal is whether by virtue of the principles (referred to as DPP) under the Data Protection Act 1998 (the Data Protection Act) the Police are bound to delete certain old convictions from the Police National Computer (the PNC). The appeal is concerned with the convictions of five individuals, details of which, as provided in appendices to the appellants’ skeleton, are annexed hereto. The complaint in each case follows the disclosure of the convictions pursuant to a request by the Criminal Records Bureau (the CRB) or, in one case, a request by one of the individuals herself, and it is important to emphasise at the outset that the complaint about retention flows in reality not from the retention itself but from the fact that, if retained, disclosure may follow. In respect of each of those convictions the Information Tribunal (the IT) has upheld the view of the Information Commissioner (the IC) that they should be deleted. However the ramifications are far wider than these five cases since, if these convictions must be deleted and if the police are to treat people consistently, the application of any viable system of weeding would probably lead to the deletion of around a million convictions.

There was a time when the Police and the IC were able to agree the appropriate policy in relation to the way old convictions recorded on the PNC should dealt with, to accord with the Data Protection Act principles. The Data Protection Act section 51(4)(b) provides that any trade association may submit a code of practice to the IC and presumably the Association of Chief Police Officers (ACPO) did so. My reading of Deputy Chief Constable Ian Readhead’s statement would lead me to think that ACPO (without consultation with, for example, the CPS or the courts) were persuaded that data protection principles should lead them to have what was termed a “weeding policy” which resulted in certain convictions being removed after a certain period without further convictions. That was acceptable to the IC, who indeed endorsed the Codes of Practice for Data Protection produced by the Association of Chief Police Officers (ACPO) in 1995, 1999 and 2002. However, following an inquiry held by Sir Michael Bichard (as a result of Ian Huntley’s conviction in December 2003 for the murders of Jessica Chapman and Holly Wells), and a review of the duties of the Police, resulting from a number of matters, e.g. (a) legislation relating to retention of DNA and fingerprints and (b) legislation relating to the admissibility of bad character in criminal proceedings, and (c) obligations to the court and the CPS, ACPO have taken the view that the weeding policy was not consistent with the purposes for which the records of convictions were retained on the PNC. Although they are prepared to “step down” certain convictions rendering them “for Police eyes only”, the Police view became that no convictions should be deleted except in exceptional circumstances. They have further construed exceptional circumstances as being limited to such matters as convictions being established as wrongly obtained, i.e. very narrowly.

In that context fresh guidelines have been produced which have not been endorsed by the IC. Prior to the complaints from the individuals, the subject of this appeal, there had been previous complaints in respect of which the IC sought to challenge the policy of ACPO. The IC issued enforcement notices which lead to an appeal and decision of the IT in 2005. On that occasion the IT ruled that an undertaking to “step down” was sufficient, but the IT’s view, and indeed the Police’s view, of what the result of stepping down would be, was inaccurate. It is unnecessary to go into the detail of that misunderstanding. I simply say that it seems that both the Police and the IT understood that the result of stepping down would be that in certain circumstances the CRB would not have access to “stepped down” convictions when preparing “standard disclosure certificates”(as opposed to “enhanced disclosure certificates”) under Part V of the Police Act 1997. It is now accepted that that is not accurate. Under Part V of the 1997 Act “stepped down” convictions are required to be revealed even on “standard disclosure certificates”, and thus although “stepping down” prevents disclosure in many circumstances to persons other than the police, it does not prevent disclosure by the police in many others including the circumstances under which disclosure was made of four of the convictions the subject of this appeal.

Following the 2005 decision ACPO produced “Retention Guidelines for Nominal Records on the Police National Computer – incorporating the Step Down Model” - referred to as the 2006 guidelines. They have not received the endorsement of the IC. There have again been complaints from individuals as to the retention and then disclosure of old minor convictions. In the result in 2008 the IC issued five enforcement notices against five different Chief Constables, seeking to compel the deletion of the old minor convictions of the five individuals identified in the annex hereto. The five Chief Constables appealed to the IT under Section 48 of the Data Protection Act which resulted in a decision dated 21^st July 2007, which ruled that the retention of the five convictions, even if they were stepped down, would infringe the principles of the Data Protection Act and thus that the convictions should be deleted.

The five Chief Constables appealed that decision under section 49 on points of law to the Administrative Court where King J directed under CPR 52.14 that the matter should be considered by the Court of Appeal and under that provision the Master of the Rolls accepted the matter in the Court of Appeal.

What the IT were concerned with in the main was whether two important principles under the Data Protection Act were being complied with; in short whether “excessive data” was being retained (DPP 3) and whether data was being “kept for longer than necessary” (DPP 5). In broad terms the reasoning of the IT was first that the purposes for which the data (the convictions ) were held were “core” police purposes, i.e. detection of crime, and second that the evidence given by the Police that these convictions had some value for those “core” police purposes, should be rejected. Mr David Jones, representing the five Chief Constables against whom the decision to delete has been made, has submitted before us as he did before the IT that to confine “purposes” to “core” police purposes finds no support from the provisions of the Data Protection Act and is to take too narrow a view. Thus, he submits, that insofar as it is a registered purpose to hold the information so that it can be supplied to others, e.g. a complete history of convictions to the courts and the CPS, there can be no question of the retention being held to be either excessive or being held for longer than necessary. In any event, he has submitted, it was wrong for the IT to take upon itself the role of deciding what was of value to the Police, even for “core” police purposes, unless the view of the Police could be shown to be perverse.

Mr Pitt-Payne has sought to uphold the decision of the IT, arguing as he did before the IT that police purposes cannot include holding the information for others, and thus the question of compliance with the principles under the Data Protection Act should be tested by reference to “police purposes”, i.e. “their operational purposes”. He further submits that the role of the IC must be to bring an independent mind to bear on whether it is proportionate for the police to retain old minor convictions which have little if any value to police “operational purposes”.

There are a number of issues that arise under the above stated broad points, and in order to obtain a proper understanding it is necessary to examine in some detail first the provisions of the Data Protection Act and the EC Directive from which it sprang; second the nature of old convictions and in particular the Rehabilitation of Offenders Act and the exceptions thereto; third the uses which the Police in fact make of the data stored on the PNC; fourth the purposes registered by the individual Chief Constables as the purposes for which the convictions are retained. I should then return to the questions whether the IT were correct in confining purposes in the way they did, and whether in any event they were right in their approach to the police evidence as to the value of old convictions, and finally deal shortly with Article 8.

Article 8(5) is important as recognising the importance of records of criminal convictions and recognising the safeguard of control by official authority. It is not disputed that the PNC is controlled by official authority.

Section 1 deals with the “Basic interpretative provisions” such as what data means, what is personal data, who data subjects are etc, and it is not in issue that what is stored on the PNC is personal data, and that the five persons who complained are “data subjects”. Indeed it is not in issue that convictions are “sensitive personal data” as provided for by section 2 (g) and (h).

The definition of “data controller” in section 1 is important – data controller means (subject to subsection (4) not relevant for present purposes) “a person who (either alone or jointly or in common with other persons) determines the purpose for which and the manner in which any personal data are, or are to be, processed”.

The Act has a number of fairly complex provisions but for our purposes it suffices to say that it is clear from all its terms as confirmed by the above definition that it is the data controller who determines the purpose for which data is processed. The Act is concerned to ensure that the purposes as determined by the data controller are registered so that any person can know the purposes for which data is being processed.

Section 16 identifies “the registrable particulars in relation to a data controller” and provides that they mean:-

(a)

his name and address,

(b)

if he has nominated a representative for the purposes of this Act, the name and address of the representative,

(c)

a description of the personal data being or to be processed by or on behalf of the data controller and of the category or categories of data subject to which they relate,

(d)

a description of the purpose or purposes for which the data are being or are to be processed,

(e)

a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data,

. . .”

Section 18 imposes on the data controller the duty to notify the IC of the registrable particulars; section 19 imposes on the IC an obligation to maintain a register containing the registrable particulars; and section 20 imposes a duty to notify changes to ensure “so far as practicable that at any time:-

“(a)

the entries in the register maintained under section 19 contain current names and addresses and describe the current practice or intentions of the data controller with respect to the processing of personal data, . .”.

The Act is then importantly concerned that data should be processed in accordance with the data protection principles contained and to be interpreted in accordance with schedules to the Act. Section 4 thus provides:-

“(1)

References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

(2)

Those principles are to be interpreted in accordance with Part II of Schedule 1.

(3)

Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.

(4)

Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.”

The DPP in Schedule 1 are:-

“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a)

at least one of the conditions in Schedule 2 is met, and

(b)

in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2 Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3 Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4 Personal data shall be accurate and, where necessary, kept up to date.

5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6 Personal data shall be processed in accordance with the rights of data subjects under this Act.

7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

The appeals relating to all five convictions are concerned with DPP3 and DPP5. There is a discrete issue in relation to the conviction of SP which involves consideration of DPP1, which I shall deal with at the end.

Section 40 deals with enforcement:-

“Enforcement notices

(1)

If the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve him with a notice (in this Act referred to as “an enforcement notice”) requiring him, for complying with the principle or principles in question, to do either or both of the following—

(a)

to take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified, or

(b)

to refrain from processing any personal data, or any personal data of a description specified in the notice, or to refrain from processing them for a purpose so specified or in a manner so specified, after such time as may be so specified.

(2)

In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress.

. . .

(6)

An enforcement notice must contain—

(a)

a statement of the data protection principle or principles which the Commissioner is satisfied have been or are being contravened and his reasons for reaching that conclusion, and

(b)

particulars of the rights of appeal conferred by section 48.

(7)

Subject to subsection (8), an enforcement notice must not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.

Rights of appeal are provided for under Section 48 and thereafter on points of law to the courts under Section 49.

Other provisions which are relevant are Section 7, which gives the “data subject” a right of access to personal data on a request in writing. The details of the section do not matter. Under this section a data subject is entitled to a description of the personal data, the purposes for which they are being processed, and the recipients to whom the data are or may be disclosed. The relevance to the issues on this appeal of this section is that in the case of one of the five data subjects, GMP, the retention came to light when GMP made a subject access request for her own records. That request was made in order to support an application for passport, residency and citizenship to the State of Lucia. It is right also to mention that because section 56 (which prohibits such conduct) has not been brought into force, certain employers as a condition of recruitment or of continued employment, do require a data subject to obtain and supply to them data to which the employer would not be entitled if they applied directly.

Section 13 gives a right to damages and provides as follows:-

“13 Compensation for failure to comply with certain requirements

(1)

An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2)

An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—

(a)

the individual also suffers damage by reason of the contravention, or

(b)

the contravention relates to the processing of personal data for the special purposes.

(3)

In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”

Section 29 relates to “Crime and taxation” and by subsection 1 provides:-

“(1)

Personal data processed for any of the following purposes—

(a)

the prevention or detection of crime,

(b)

the apprehension or prosecution of offenders, or

(c)

the assessment or collection of any tax or duty or of any imposition of a similar nature,

are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.”

This sub-section emphasises the special position of data retained for the purpose of preventing crime. This sub-section will need a mention in relation to the discrete point raised by SP on fairness under DPP 1.

The statutory authority for the PNC is provided by Section 27(4) of the Police and Criminal Evidence Act 1984 and the type of information that may be recorded is governed by regulations made under that section. Paragraph 18 of the decision of the Tribunal quotes the relevant provisions. As the Tribunal noted the language is not mandatory but is permissive but what may be recorded and is recorded are “convictions for, and cautions, reprimands and warnings given in respect of any offence punishable with imprisonment and any offence specified in the Schedule to these regulations”. The Tribunal points out that certain offences are not punishable with imprisonment and not specified in the schedule and thus, even if all recordable offences were recorded, the PNC would not be a complete record of all criminal convictions. That is no doubt true, but I am doubtful about its relevance.

Before turning to the uses made by the Police of the data retained it is convenient to refer to the position under the 1974 Act. The Act defines “rehabilitated persons and spent convictions”, its intention being to rehabilitate offenders who have not been reconvicted of any serious offence for periods of years and to penalise the unauthorised disclosure of those previous convictions. Section 4 is in broad terms and provides as follows:-

“4 Effect of rehabilitation

(1)

Subject to sections 7 and 8 below, a person who has become a rehabilitated person for the purposes of this Act in respect of a conviction shall be treated for all purposes in law as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of that conviction; and, notwithstanding the provisions of any other enactment or rule of law to the contrary, but subject as aforesaid—

(a)

no evidence shall be admissible in any proceedings before a judicial authority exercising its jurisdiction or functions in Great Britain to prove that any such person has committed or been charged with or prosecuted for or convicted of or sentenced for any offence which was the subject of a spent conviction; and

(b)

a person shall not, in any such proceedings, be asked, and, if asked, shall not be required to answer, any question relating to his past which cannot be answered without acknowledging or referring to a spent conviction or spent convictions or any circumstances ancillary thereto.

(2)

Subject to the provisions of any order made under subsection (4) below, where a question seeking information with respect to a person’s previous convictions, offences, conduct or circumstances is put to him or to any other person otherwise than in proceedings before a judicial authority—

(a)

the question shall be treated as not relating to spent convictions or to any circumstances ancillary to spent convictions, and the answer thereto may be framed accordingly; and

(b)

the person questioned shall not be subjected to any liability or otherwise prejudiced in law by reason of any failure to acknowledge or disclose a spent conviction or any circumstances ancillary to a spent conviction in his answer to the question.

(3)

Subject to the provisions of any order made under subsection (4) below,—

(a)

any obligation imposed on any person by any rule of law or by the provisions of any agreement or arrangement to disclose any matters to any other person shall not extend to requiring him to disclose a spent conviction or any circumstances ancillary to a spent conviction (whether the conviction is his own or another’s); and

(b)

a conviction which has become spent or any circumstances ancillary thereto, or any failure to disclose a spent conviction or any such circumstances, shall not be a proper ground for dismissing or excluding a person from any office, profession, occupation or employment, or for prejudicing him in any way in any occupation or employment.

(4)

The Secretary of State may by order—

(a)

make such provision as seems to him appropriate for excluding or modifying the application of either or both of paragraphs (a) and (b) of subsection (2) above in relation to questions put in such circumstances as may be specified in the order;

(b)

provide for such exceptions from the provisions of subsection (3) above as seem to him appropriate, in such cases or classes of case, and in relation to convictions of such a description, as may be specified in the order.”

The breadth of section 4 is cut down by the Act itself by section 7 and in particular so far as the present proceedings are concerned 7(2) (as amended from time to time as shown by parentheses), which provides that:-

“Nothing in section 4(1) above shall affect the determination of any issue or prevent the admission or requirement of any evidence relating to a person’s previous convictions or to circumstances ancillary thereto -

(a)

in any criminal proceedings before a court in Great Britain (including any appeal or reference in a criminal matter);

(b)

in any service disciplinary proceedings or in any proceedings on appeal from any service disciplinary proceedings;

[bb] in any proceedings under Part 2 of the Sexual Offences Act 2003, or on appeal from any such proceedings;]

[(c) in any proceedings relating to adoption, the marriage of any minor, [or the formation of a civil partnership by any minor,] the exercise of the inherent jurisdiction of the High Court with respect to minors or the provision by any person of accommodation, care or schooling for minors;

(cc) in any proceedings brought under the Children Act 1989;]

[(d) in any proceedings relating to the variation or discharge of a supervision order under [the Powers of Criminal Courts (Sentencing) Act 2000], or on appeal from any such proceedings;]

[(d) in any proceedings relating to the variation or discharge of a youth rehabilitation order under Part 1 of the Criminal Justice and Immigration Act 2008, or on appeal from any such proceedings;]

(e)

. . .

(f)

in any proceedings in which he is a party or a witness, provided that, on the occasion when the issue or the admission or requirement of the evidence falls to be determined, he consents to the determination of the issue or, as the case may be, the admission or requirement of the evidence notwithstanding the provisions of section 4(1).”

The above exception directly affects the recording of convictions in that in a criminal case it is the duty of the prosecution to disclose the convictions however old of a witness. Furthermore it is the duty of the CPS to provide to any court responsible for sentencing the full record of the person appearing, however old and however minor the convictions, and it is the police who provide the same from the PNC.

Second under section 4(4) the Secretary of State has made “The Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975” (the Exceptions Order). The Exceptions Order provides for many exceptions. Section 3 commences with the words “none of the provisions of section 4(2) of the Act shall apply in relation to”; there then follow a great number of subsections referring to a great number of schedules. As an example (a)(i) and (ii) relate to any question asked by or on behalf of any person in the course of the duties of his office or employment in order to assess the suitability (i) of the person to whom the question relates for admission to any of the professions specified in Part 1 of Schedule 1 to this Order, and eighteen different professions are set out in the Schedule; and (ii) of the person to whom the question relates for any office or employment specified in Part II of the said Schedule 1, or for any other work specified in [paragraphs 13, 14, 20, 21, 35, 36, 37, 40 or 43 of Part II] of the said schedule 1, (Part II containing some 43 paragraphs). Thus the exceptions are numerous and indeed it was because of the exceptions that the convictions in four of the five cases with which this appeal is concerned were disclosed, i.e. those of HP, SP, WMP under enhanced disclosure certificates and NP under a standard disclosure certificate.

The evidence before the IT covered many different uses and I shall attempt a summary:-

Before the Tribunal and before us Mr Pitt-Payne submitted that only (a) was “core” police purposes. He accepted the police used the data for the other “purposes” but he submitted that did not turn those purposes, which he submitted were actually the purposes of the persons to whom the information was supplied, into police purposes. He submitted that the police could only justify retaining data by reference to their core purposes.

Then directing his attention to purpose (a) he, as he had done before the Tribunal, relied on statistical evidence by reference to which he sought to establish that the old minor convictions with which the case was concerned were of little “value” to the police. This reference to “value” was to value as evidence as to the likelihood of a person with a spent conviction being likely to commit a further offence compared with that of a person without any convictions at all. I will return to this aspect below.

In my view Mr Pitt-Payne misconstrues the Data Protection Act insofar as he suggests that if the police register particulars then the only purpose for which data can be retained are “core” or operational police purposes. As already indicated, the data controller must specify the purpose for which data is retained. There is no statutory constraint on any individual or company as to the purposes for which he or it is entitled to retain data. I would accept that the purposes must be lawful in order to comply with DPP 1 but, that apart, a data controller can process data for any purpose. What the data controller must do, however, is identify the purpose or purposes in the public register so that people know what the data is being retained for and so that the IC and data subjects can test the principles under the Data Protection Act by reference to the purposes identified.

It is thus important in this case to identify what purposes were registered. It is important that the full details of the particulars are looked at including the persons to whom the data would be disclosed in order to identify the purposes registered by the data controllers.

The Data Controllers in this case were each Chief Constable. They each registered particulars but the particulars in each case were almost in identical terms and it is thus sufficient to take one set as an example. I should preface the next section with the advice from the Notification Guide book produced by the Information Commissioner’s Office which says this:-

“Notification is the process by which a data controller informs the Information Commissioner of certain details about their processing of personal information. These details are used by the Information Commissioner to make an entry describing the processing in the register of data controllers that is available to the public for inspection.

The principal purpose of having notification and the public register is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is carrying out the processing of personal information as well as other details about the processing (such as for what reason it is being carried out).

Notification, therefore, serves the interests of individuals in assisting them to understand how personal information is being processed by data controllers.

It is not, however, intended (nor is it practicable) that the register should contain very detailed information about a data controller’s processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing. More detail is only necessary to satisfy specific statutory requirements or where there is particular sensitivity.”

The registration document starts by saying “This register entry describes, in general terms, the personal data being processed by: Chief Constable of Northumbria Police. It contains personal data held for 3 purposes detailed in the following pages:” There then are three headings under which details are given: 1 Staff Administration; 2 Policing; and 3 Data Controller’s free text Description of purpose. Under Policing the headings are “Purpose description: Data controller’s further description of purpose: Data subjects: Data Classes: recipients (1998 Act)”. Under “Purpose description” there is a list including “The prevention and detection of crime; apprehension and prosecution of offenders; protection of life and property; maintenance of law and order; also rendering assistance to the public in accordance with Force policies and procedures”. Under the “further description” there are repeated some of the above but added are “vetting and licensing”. Under recipients appear the following: “Current, past or prospective employers of the Data subject . . . police forces . . . central government . . . local government . . . law enforcement agencies . . . regulatory bodies prosecuting authorities . . . defence solicitors . . . courts . . . approved organisations and people working with the police . . .etc.”

If one looks at the above, it seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. “Rendering assistance to the public in accordance with force policies” clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include “Employers” “the courts” and “law enforcement agencies”.

If one then poses the question whether the Data being retained is excessive or being retained for longer than necessary for the above purposes there is, it seems to me, only one answer, since for all the above a complete record of convictions spent and otherwise is required. That seems to me to be a complete answer to the appeal. Indeed it was a submission to this effect by Mr Jones in opening the appeal before the Tribunal which forced Mr Pitt-Payne to argue that purposes must be confined to Police “core” purposes. It was that submission which got the Tribunal off on the wrong foot.

If one examines the reasoning of the Tribunal one sees that it is the submission of Mr Pitt-Payne, which they accept in paragraph 91, which leads them to say:-

“91 . . .Therefore we find that we agree with the Commissioner that we must concentrate on the obvious or core police purposes which are easily understood. We would comment that one of the principal reasons behind the registration process is so that it is transparent and clear as to what purposes are being pursued by a data controller in order for it to be seen that there is compliance with the DPPs.

92.

It is clear from the evidence before the Tribunal, particularly that given by Mike McMullen, that a considerable number of other bodies use information held on the PNC for various purposes, although they do not necessarily have direct access. The 2006 Guidelines recognise this: hence the provision for certain convictions to be stepped down, and thereby protected from access by non-police users.

93.

The Commissioner contends that the fact that such organisations are permitted to access the PNC and that the Chief Constables may work in partnership with other organisations does not mean that the purposes for which it does so are to be treated as policing purposes. This does not mean that all of the purposes pursued by the partner organisation should be treated as being police purposes.

. . .

96.

We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police’s core purposes. During the course of holding such data the police are under statutory obligations to allow access to or disclosure of such data to other bodies for their purposes. However we do not consider that Chief Constables are required under their statutory obligations to hold data they no longer require for core purposes. They are only required to provide data that they do hold at the time of the request for access. We heard evidence that Chief Constables in accordance with good management practice and/or other statutory requirements, like their data protection obligations, as envisaged by the 2005 Code and the criteria used in MOPI, delete conviction data or other intelligence from time to time, then in the Tribunal’s view there is no counter or overriding obligation on them not to delete that data.”

There is then an odd paragraph 100 in which the Tribunal appear to say that even if they were wrong with that approach when examining the other purposes for which the police process the data, the Tribunal’s conclusion would be the same. But when they deal with the other purposes, e.g. paragraphs 101 to 104 – the CPS and the courts, 105-106 Multi-agency and 107 to 109 Employment Vetting, they do so (accepting submissions on behalf of the IC) adopting the same wrong approach.

If a narrower approach were justified, my conclusion would still be that the Tribunal went wrong in this case. The Tribunal analysed the statistical evidence placed before them to consider the value of the retained data. As the tribunal put it in paragraph 129 “If there comes a point where the difference in the risk of future offending behaviour as between ex-offenders and non-offenders is of no practical significance, then the [IC] argues any justification for retaining the information in order to assess the risk of future offending behaviour is destroyed”.

The Tribunal then examined the circumstances of each of the five convictions and applied the statistical evidence to the circumstances of those cases. In relation to HP having done that, the Tribunal recorded the submissions of the IC in these terms:-

“135.

The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that is it extremely unlikely either: (i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or (ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5.”

and then also said in paragraph 136:-

“136.

The general considerations in paragraphs 134 and 135 are also applicable to the analysis of the other data subjects.”

Having applied the statistical analysis to each of the other five convictions the Tribunal said at paragraph 147 that the analysis was “helpful” and that “It clearly tends to the view, applying the necessity and proportionality tests referred to in paragraph 121 above, that retention of this information is an infringement of DPP 3 and DPP5”.

In my judgment the approach of the Tribunal was wrong. The IC, when giving evidence to Bichard Inquiry, was recorded by Sir Michael Bichard as saying this about the approach to the Data retained by the Police:-

“4.45.

Data protection concerns are relevant but should not dominate the Code or any supporting manual. That said, some important messages for those drafting the Code emerged from the Information Commissioner’s evidence. He clearly and helpfully said that:

4.45.1

The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner’s role is a reviewing or supervisory one.

4.45.2

Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office ‘cannot and should not substitute [their] judgement for that of experienced practitioners’. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, ‘that should be the end of the story’.

4.45.3

There is, at present, considerable latitude extending both to decisions about how long to retain records and about when to disclose information (under the Enhanced Disclosure regime, for example, in the employment-vetting context).

4.45.4

It could be presumed to be reasonable if, after discussions with the Information Commission, certain categories of information were retained for specified periods, while still allowing the right of challenge in individual cases.

4.45.5

In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify.”

It seems to me that the approach described is the correct approach. If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter. The examination of statistics relevant only to the question as to the risk of reoffending was not to the point. Furthermore the fact that the statistics actually showed that the risk was greater than with non-offenders is not something I would pray in aid. It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police.

I emphasise the word “retention” because if there is any basis for complaint by the data subjects in this case, it seems to me to relate to the fact that in certain circumstances this information will be disclosed, but that is because Parliament has made exceptions to the Rehabilitation of Offenders Act. What is more, the circumstances in which there will be disclosure are circumstances in which the Data Subject would be bound to give the correct answer if he or she were asked. It is not as it seems to me the purpose of the 1998 Act to overrule the will of Parliament by a side wind.

I would thus allow the appeal and quash the enforcement notices on the points with which I have dealt so far.

There however arises a separate point relating to SP. She alleges that as a result of the assurance she received in 2001 (that the reprimand would be removed from her record when she was 18 if she did not get into anymore trouble) the retention of the reprimand on the PNC after her 18^th birthday was unfair under DPP 1.

The Tribunal did not find that she was misled into agreeing to a reprimand in reliance on the assurance. But they were not convinced of the importance in the public interest of being able to retain this conviction for all the reasons they had already given and with which I have dealt above. They made their finding in these terms:-

“165.

The basis of the Appellants’ argument is that the 2006 Guidelines should be followed despite the representation made to SP because of the benefits the conviction data will provide to the wider public. As will be appreciated from our findings so far we are not convinced that will be so in SP’s case and certainly the 2006 Guidelines do not in our view provide that proportionate approach which leads us to accept the Appellant’s argument.

166.

Janet Turner for Staffordshire Police in evidence was very unclear as to whether the question of fairness to SP had been considered when reaching the decision to retain the information. This leads us to the view that the personal data was processed unfairly.”

Mr Jones argued before the IT that Section 29(1) applied so as to disapply DPP1 altogether. Before us he was inclined to submit that the questions whether there was likely to be prejudice to (a) the prevention or detection of crime or (b) the apprehension or prosecution of offenders was very much intertwined with the question as to whether it was ‘fair’ under DPP 1 to continue to retain SP’s reprimand in the context of the fact that many others will be in SP’s position. The point being that SP will not be alone in having been informed of what was then the policy of weeding. To thus treat all equally would require the police to accept that they should delete all convictions in which the data subject has been told of the original policy when the reprimand or caution has been administered. It seems to me that if it is fair to retain convictions under the new policy it does not become unfair to do so simply because the data subject was told of what the policy then was when being convicted or reprimanded. Furthermore, the deletion of this reprimand leading (as it would have to) to deletion of many others would be likely to prejudice the prevention and detection of crime and the apprehension or prosecution of offenders. The court and the CPS need the full information, never mind the fact the police are of the view that for their operational purposes they need the same. It is in this context that I draw attention to article 8(5) of the Directive (see paragraph 9 above) which recognises, in my view, that “a complete register of criminal records may be kept” albeit only “under the control of official authority”.

Does it make any difference that, as the Tribunal found, Janet Turner did not consider the question of fairness to SP? In my view it does not because Janet Turner was applying the policy by then in force, which would have required there to be exceptional circumstances if the conviction was to be deleted. It might have been different if a request had been made while the former guidance was in place, as was the situation in relation to the Greater Manchester Police when they did delete a conviction as noted in paragraph 153 of the Tribunal’s judgment.

A further argument was addressed to the IT on Article 8 independently from the arguments on construction under the Data Protection Act. I am not persuaded that Article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure. Even if that were wrong, if my conclusions so far are right, the processing is in accordance with the law and necessary in a democratic society. I do not think any extra point arises by reference to Article 8 on its own and I mean no disrespect in dealing with this aspect so shortly.

I would accordingly allow all five appeals and quash the enforcement notices.

I agree with Waller LJ on the resolution of the main issues under DPP3 and DPP5, but disagree respectfully on the application of DPP1 to the case of SP. I have not found the route to this conclusion entirely straightforward. I prefer therefore to set out my own reasoning, while adopting Waller LJ’s exposition of the relevant factual and legal background. The tribunal’s judgment is in many respects an impressively clear and comprehensive treatment of the voluminous material presented to them. However, I think that their task was made unnecessarily difficult by the way in which the cases were presented on both sides.

At the heart of the debate before the tribunal was the application of the two principles relied on by the Commissioner in respect of all five cases

DPP3: “Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.”

DPP5: “Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.”

Crucial to both principles was the identification of the “purposes” by reference to which the criteria were to be applied.

In simple terms, as I understand it, the underlying purpose of the PNC is the maintenance of a complete record of convictions, subject to certain defined limitations, for the assistance both of the Police itself and of other agencies which legitimately require that information. I agree with Waller LJ that the Commissioner’s reliance on the concept of “core purposes” was misconceived and led to the tribunal “getting off on the wrong foot”. As a result, their treatment of the main issues was materially flawed. I shall return to this aspect below. However, part of the problem was the failure of the Police themselves to articulate clearly or consistently their own view of the relevant purpose or purposes. There was little congruence between the purposes relied on by the Police before the tribunal and the terms of the “specified” purposes in their registered particulars; and neither spelt out in unequivocal terms what I have taken to be the underlying purpose of the PNC. The tribunal was also faced with a surprising mass of oral and written evidence, from a total of 24 witnesses, which must have made it very difficult for anyone to see the wood for the trees.

I found the most helpful analysis in the written submissions by Mr Swift and Miss Ivimy on behalf of the Home Secretary. They start from the proposition that the PNC is “the most complete and accessible database of conviction records”, and that the sharing of such information by the Police with other public bodies is “in principle wholly lawful and in the public interest”. They cite Sir Michael Bichard’s recommendation that there should be more investment by the Government to ensure the PNC’s future -

“… given its importance to intelligence-led policing and to the criminal justice system as a whole”.

Of the tribunal’s emphasis on the “core purposes” they say:

“This approach is misconceived and wrong in principle. There is nothing in the scheme of the DPA, nor the EC Directive it implements, to support the proposition that only the ‘core’ purposes of a data controller should be taken into account in assessing whether a given act of processing infringes DPP3 and DPP5. Moreover, the DPA contains no framework by which the Commissioner or the Tribunal could properly assess what is a ‘core’ and what is not a ‘core’ purpose of a given data controller. Fundamentally, it is not for the Commissioner or the Tribunal to specify for what purposes in considers a public body, acting lawfully, should or should not process data.”

They also emphasise the need under DPP3 and 5 to have regard to “the particular processing which is sought to be impugned”, in this case “the simple retention of the data on the PNC”. They criticise the tribunal for at times confusing its analysis -

“… by reference to the question whether other processing (such as the disclosure of the data to third parties, such as the CRB, the Courts social services etc) infringes DPP3 and 5… But the question whether any given act of processing breaches DPP3 or DPP5 must be determined separately, having regard to the purposes and particular circumstances of that processing. Retention of data cannot in principle be held unlawful under DPP3 and 5 on the basis, for example, that it might give rise in future to disclosure contrary to those principles.”

They conclude their submissions:

“It is in principle legitimate for the police to retain conviction data on the PNC not only for the ‘core’ purposes identified by the Tribunal, but for all their registered purposes. The Tribunal should have analysed the need for retention of the conviction data on the PNC on that basis. In practice, therefore, holding that information for the purpose of assisting other public bodies who share common public policy objectives to perform their functions is lawful under the DPA.”

As will appear, I agree essentially with that analysis. In what follows I will explain why I would reject the “core purposes” approach, and then identify what I believe to be the relevant questions and provide my answers to them. Finally I shall deal with the particular issue arising under DPP1.

As recorded by the tribunal, the Commissioner defined the “core” police purposes as –

“… the prevention and detection of crime, the investigation and apprehension of offenders, and the maintenance of law and order.” (decision para 90)

It was these “core” police purposes which, it was said, had to be taken into account in applying DPP3 and DPP5. This approach was contrasted with the position of the Police and the Home Office -

“The Appellants and Home Office take a different view and contend that all the notified purposes must be taken into account in applying DPP3 and DPP5. These purposes should be interpreted widely and require providing criminal intelligence to other bodies…” (para 91)

At paragraph 94 the tribunal described the four other purposes which had been relied on by the Police as potentially relevant:

“(1)

providing assistance to the Crown Prosecution Service (CPS) (or any other prosecuting agency) in the prosecution of an offence, and the courts in the administration of justice;

(2)

assisting organisations such as social services departments and probation services in multi-agency work to protect the public, in particular young and vulnerable persons;

(3)

disclosure of information in the context of employment vetting to the CRB; and

(4)

public safety and protection of life and property, for example assisting members of the public in discovering the whereabouts of missing persons.”

(I will refer to these in this judgment as “the additional purposes”.)

The tribunal did not accept that these additional purposes could be taken into account. They said:

“95.

The Appellants maintain that they process information about the criminal records of individuals for each of these four purposes, and that each of these purposes should be taken into account in the present case in relation to both DPP3 and DPP5.

“96.

We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police’s core purposes…

97.

This reflects the position, in our view, that Chief Constables cannot be expected to incorporate other bodies’ purposes as part of their own even though there may be some common objectives, like the prevention of crime.” (emphasis added)

This distinction between the core purposes of the Police themselves, and their function of assisting “other bodies’ purposes” is central to the tribunal’s discussion of the various categories. Thus, for example, of the argument that providing conviction data by way of disclosure certificate to the CRB was “for the prevention of crime”, they commented:

“This is rather remote from the police’s main activities in relation to this purpose, but even if encompassed in the purpose it is difficult to accept that the police would then be required to provide more data to such a body than is required for their core needs…” (para 91)

Similarly in relation to the provision of information to the CPS or the Courts, they say -

“The Commissioner accepts that where the police hold conviction information for their own purposes then it is proper for them to provide that information for use by the CPS or the Courts; but it does not follow, the Commissioner argues, that information that no longer has a policing purpose can properly be retained by the police, solely to ensure that a fuller record of conviction information is available for use by the CPS or by the Courts…

The Commissioner maintained that if the police forces are to be required to retain information that is no longer needed for their own purposes - because the CPS or the Court Service need it, or may need it, then there needs to be specific legal provision for this with proper safeguards as to who may use that information and for what purposes. We agree with the Commissioner’s contentions.” (para 102-4)

They accepted that this approach might have “unfortunate consequences” for other bodies which require such information, but the solution lay with the legislature:

“It seems to us that the PNC has evolved over the years and it is now regarded as the main source of criminal intelligence for a variety of organisations. However it has no proper statutory framework. It is not regarded as an entity in its own right with its own purposes serving a number of bodies and this is apparent from the fact that neither the PNC nor its various administrators, ACPO, NIS, NPIA, are registered as data controllers with the Commissioner. If the government wishes the PNC to have that role then it needs to legislate accordingly. This would provide the opportunity for Parliamentary debate as to how best to provide an appropriate and proper legislative framework so that there is a clear understanding of data ownership and obligations with proper safeguards.” (para 99)

For the reasons given on behalf of the Home Secretary, I regard that approach as unsupported by the legislation. I can see no reason why the purposes for which the Police retain information should not extend to the provision of information to assist other bodies with similar aims. As long as it is lawful (which is not in dispute), I see no reason why it needs to be authorised by specific legislation. The Data Protection Act already provides an appropriate framework, in accordance with the Directive, for regulating data ownership and providing proper safeguards.

I prefer to approach the issues by asking three questions (even though I may be departing from the way in which the case was developed in oral argument before us):

The answer to the first depends on the terms of the applicable legislation, in particular the “DP Directive” (95/46/EC), the Data Protection Act 1998, and the Human Rights Act 1998. The answer to the second turns on the terms of the registration. Neither requires the identification of “core purposes”. The answer to the third question raises issues as to the correct approach to evaluation of the evidence. Although only the last question is raised directly by the Commissioner’s notice, it can only be properly addressed in the context of the answers to the other two. I will take them in turn.

Permissible purposes

There is little doubt, in my view, that the maintenance of the PNC for both the “core” police purposes and the four additional purposes was in principle permissible under the applicable legislation.

The DP Directive provides the essential background to interpretation of the domestic law. The Preamble identifies as one category of lawful processing “the performance of a task carried out in the public interest or in the exercise of official authority” (recital (30)). In relation to such lawful categories, the main thrust of the Directive is not to restrict the purposes for which data may be processed, but to ensure that the purposes are “explicit and legitimate” and that processing are limited to what is required for or compatible with those purposes. Thus recital (28) of the preamble reads:

“(28)

Whereas any processing of personal data must be lawful and fair to the individuals concerned; whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; whereas such purposes must be explicit and legitimate and must be determined at the time of collection of the data; whereas the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified.” (emphasis added)

As would be expected, that approach is reflected in the Data Protection Act 1998. Waller LJ has set out the relevant provisions. As he says, it is the data controller who determines the purposes for which data are to be processed, provided that they are lawful, and subject to the “principles” set out in schedule 1. In the case of “sensitive” data such as data about convictions (see s 2), those conditions require compliance with at least one of the conditions in Schedule 2 and one of the conditions in Schedule 3. I note that under schedule 2 it is enough that the processing is -

“necessary… for the exercise of any other functions of a public nature exercised in the public interest by any person” (condition 5(d))

and under schedule 3 that it is -

“necessary for the exercise of any functions conferred on any person by or under an enactment” (condition 7(1)(b))

No issue arises before us in respect of compliance with either of those schedules.

I agree also with Waller LJ that Article 8(5) of the Directive is important. It recognises that the purpose of maintaining a “complete register of criminal convictions” is in principle compatible with the Directive, provided it is “under the control of official authority”, and there are “suitable specific safeguards… provided under national law”. The power to maintain a “complete register”, to my mind, logically encompasses power to maintain records of all convictions, without regard, for example, to age or relative seriousness.

The tribunal accepted the Commissioner’s case that the mere retention of conviction information had “a significant adverse effect” on the individuals concerned because it might suggest to them and others “(rightly or wrongly)” that they were still of interest to the police, and there was always the risk of disclosure by way of an enforced subject access request, or by “inadvertence” (para 148). However, as I read the Directive, it is envisaged that these issues will be dealt with by “suitable specific safeguards”; they are not recognised as objections in themselves to the maintenance of a “complete register”. There may of course be room for argument about the adequacy of the safeguards relating to use or disclosure under the domestic rules, but that is not a reason to disallow simple retention.

The tribunal identified the statutory authority for the PNC as section 27(4) of the Police and Criminal Evidence Act 1984, which enables the Secretary of State by regulations to make provision for “recording in national police records convictions for such offences as are specified in the regulations”. Regulation 3 of the National Police Records (Recordable Offences) Regulations 2000 (SI 2000/1139) provides that there may be recorded in national police records convictions, cautions, reprimands and warnings relating to any offence punishable with imprisonment or specified in the schedule to the regulations.

The tribunal rightly observed that the legal framework is “permissive, not mandatory”; that there is no statutory obligation to record convictions nor to retain conviction information for any particular period, or indefinitely; and that not all convictions are recordable, so that –

“…even if all recordable offences were recorded and retained indefinitely, the PNC would not be a comprehensive record of all criminal convictions.” (para 19)

All this is true. However, the facts that there is no statutory obligation to maintain a complete register, nor to retain material for any period, and that the register may not include records of all convictions, does not mean that maintenance of the register it is not a permissible purpose. It is enough for schedules 2 and 3 that the maintenance of the register is for a function exercised by the authority in the public interest and under powers conferred by an enactment. If it is permissible under the Directive to maintain a fully complete record, then I do not see why it is not permissible to maintain a record which is designed to be complete in relation to all offences of a defined degree of seriousness.

I do not of course intend to detract from the importance of the policy objectives embodied in the Rehabilitation of Offenders Act 1974. But there are many (arguably, too many) exceptions to the principle of “spent” convictions under that Act. In any event, the scope and effect of the Act are matters of domestic legislation. They do not depend on the DP Directive, nor is there any reason to re-interpret the provisions of the Data Protection legislation by reference to them.

Finally with regard to the Human Rights Convention, it is significant that the DP Directive is itself specifically linked to the need to respect “fundamental rights and freedoms, notably the right to privacy…”, and that it refers in that respect to the European Convention on Human Rights (Preamble (2), (10)). This suggests that the maintenance of such a complete register of convictions, as implicitly endorsed by Article 8(5) of the Directive, should not normally raise any separate issues under the Convention.

There is considerable doubt in any event whether recording the mere fact of a conviction can ever engage article 8 of the Convention. Some guidance is found in the observations of Lord Hope in a recent case in respect of acquittals. As he said:

“The fact that D was acquitted of the rape is not of itself private information the publication of which would be incompatible with his right to privacy. This has nothing to do with his private life. The trial was held in public, and the media were at liberty to publish D's name along with other details of the case other than the identity of the complainant….” (A-G’s Ref No 3 of 1999: Application by BBC [2009] UKHL 34 [30])

He went on to explain that the BBC’s concern in the particular case was not confined to his acquittal, but related also to a DNA profile taken at the time of his arrest, which undoubtedly did engage Article 8. If one may apply the same reasoning in the present context, the bare fact of conviction should not be regarded as “private information” such as to engage article 8.

The Commissioner relies on the ECHR case of S and Marper v UK as authority that retention of personal data can engage article 8. That is correct, but the nature of the information was quite different. The main issue related to the retention of fingerprints and DNA records of the unconvicted. The court’s “particular concern” was that persons who had not been convicted of any offence and who were accordingly entitled to the presumption of innocence were treated in the same way as convicted persons (see para 122). The case is no authority for the proposition that a record of the mere fact of conviction engages article 8.

I find it unnecessary to reach a general conclusion on the relevance of article 8 to information about convictions. In the present context, in my view, it is enough to rely on the specific endorsement by the Directive of the concept of a complete register. That in my view makes it impossible to argue that the retention of information in such a register is in itself objectionable under the Convention.

The enforcement notices in this case asserted that principles DPP3 and 5 were being infringed in that –

“(the data controller)… is continuing to process the Conviction Data relating to X and that such data are irrelevant, excessive and no longer required for policing purposes and are being kept for longer than is necessary for such purposes.” (emphasis added)

“Policing purposes” were not further defined in the notice, but as will appear this expression seems to be derived from that used by the Police themselves in the registration.

As has been seen principles DPP3 and 5 both depend on identifying “the purpose or purposes” for which the data are processed. The second Principle in schedule 1 is that personal data may only be processed for one or more “specified and lawful purposes”. By paragraph 5 of Part II of the same schedule, a purpose may be “specified” either by a notice to the data subject or “in a notification given to the Commissioner under Part III of this Act”. The latter, which applies in this case, takes one in turn to Part III headed “Notification by Data Controllers”, and containing the registration provisions. Section 16 defines the “registrable particulars” including -

“(d)

a description of the purpose or purposes for which the data are being or are to be processed.

(e)

a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data.”

Waller LJ has referred to the Notification Guidebook, which explains that

“It is not… intended (nor is it practicable) that the register should contain very detailed information about a data controller’s processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing… ”

Accordingly, the obvious starting-point for considering the application of principles DPP3 and 5 would naturally be the identification of the specified purposes in the register. In this case that is not as easy as might be expected.

At paragraph 43, the tribunal identified their understanding of the registered purposes

“Under section 16 DPA, the five Appellants as data controllers registered their purpose as ‘policing’ and the purpose description as

‘The prevention and detection of crimes; apprehension and prosecution of offenders, protection of life and properties; maintenance of law and order; also rendering assistance to the public in accordance with force policies and procedures’

And the further description of purpose as

‘protection and detection of crime apprehension and prosecution of offenders maintenance of law and order, protection of life and property vetting and licensing public safety rendering assistance to members of the public in accordance with Force policy’”

At paragraph 91 the tribunal explained why they had difficulty in relating the specified purposes to the Police’s case as presented to them. Of the Police’s contention that the purposes should be interpreted widely as including “providing criminal intelligence to other bodies…”, they observed that the registered purposes included “no purpose expressed as such in these terms”. They noted also that they had been given “very little evidence to help us understand these purposes”. It was this difficulty which appears to have encouraged them (at the end of the same paragraph) to accept the Commissioner’s view that they should concentrate on the “obvious or core police purposes which are easily understood”.

I share some of the tribunal’s difficulty in interpreting the registered particulars. As Waller LJ has explained, the registration document says that the entry contains personal data held for “3 purposes detailed in the following pages”. The three purposes are then defined in successive sections of the document. The first, “Staff Administration”, can be ignored in the present context. The second is headed “Policing”; under sub-headings “purpose description” and “data controller’s further description of purpose”, it contains the material quoted by the tribunal. In the same section there is a reference to “recipients”, including for example “current, past or prospective employers of the Data subject”, “central government (and) local government”, “law enforcement agencies”, and so on.

The third section is headed “Data Controller’s free text Description of purpose”. The description starts “Administration and Ancillary Support for Policing Purposes, including…”; there follows a list of items such as “records of computing transactions”, “telephone log messages”, and so on. Whatever precisely is intended by the requirement for a “free text description” in the heading to this section, I do not think it can be relied on as adding anything material for present purposes. The section is confined to “administration and ancillary support” for “policing purposes”, which must be taken as referring back to the purposes previously defined in section 2. Accordingly it was right in my view for the tribunal to take the relevant description from that section.

Waller LJ comments:

“If one looks at the above, it seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. “Rendering assistance to the public in accordance with force policies” clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include “Employers” “the courts” and “law enforcement agencies”.”

I am not persuaded, with respect, that the picture is as clear as he suggests. What is in issue here is the rendering of assistance to other public agencies, not to the public in general. Arguably, the definition of the potential recipients can be relied on as filling out the description of the purpose, although they are treated separately in section 16 of the Act (see above). However, it is difficult to see why it should be necessary to rely on implication. As the preamble to the directive made clear, the intention is that the register should provide an “explicit” record of the purposes for which data are to be processed. It would have been easy for the specified purposes to be drafted in a way which made clear that they included the provision of information to other agencies.

In any event, the inadequacy or obscurity of the specification did not in my view justify the tribunal’s approach. There was no issue that the Police were in fact using the information on the PNC to assist the various bodies identified in the four additional purposes. It would have been open to the Commissioner to allege a breach of DPP2, which precludes the processing of data in any manner “incompatible with” the specified purposes. No such case had been advanced. The tribunal had to proceed therefore on the basis that the additional purposes were at least compatible with the specified purposes.

It is fair to observe also that there would have been little purpose in the Commissioner advancing such a case. If the only problem lay in the terms of the specification it could have been (and could still be) easily corrected. Such a contention by the Commissioner would not have thrown light on the issues of principle raised by the enforcement notice.

Here again, it seems to me that the tribunal was not assisted by the way in which the case was presented on both sides. Waller LJ has quoted the comments of the Commissioner in evidence to the Bichard Inquiry on his approach to the Data retained by the Police. I note in particular the following:

“The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner’s role is a reviewing or supervisory one.”

“Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office ‘cannot and should not substitute [their] judgement for that of experienced practitioners’. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, ‘that should be the end of the story’.”

“In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify.”

Like Waller LJ I would endorse the approach there stated, which conforms to that taken by the courts. Thus in R v Chief Constable of the North Wales Police ex parte Thorpe [1999] QB 396, which concerned disclosure by the Police of information about the presence of a couple who had been convicted of sex offences against children, Lord Woolf said at p 429:-

"Both under the Convention and as a matter of English administrative law, the police are entitled to use information when they reasonably conclude this is what is required (after taking into account the interests of the applicants), in order to protect the public and in particular children…. where the use in question is decided upon as a result of the exercise of an honest judgment of professional police officers, that will of itself, go a long way to establish its reasonableness.” (emphasis added)

That statement was relied on by Nicol J in W v Chief Constable of Northumbria [2009] EWHC 747 (Admin), which concerned disclosure by the Police to an employer of information relating to an employee’s conviction for sexual offences:

“The briefing document recognised that disclosure could lead to the Claimant losing his job. ACC Vant took this into account, but considered that disclosure was proportionate and that the public interest outweighed the Claimant's individual rights. In Thorpe Lord Woolf said that the exercise of an honest judgment of professional police officers would go a long way to satisfying the test of reasonableness for the purposes of English administrative law and the Convention. It may be that the Convention requires a rather more exacting standard of review than Wednesbury reasonableness. Nonetheless, the Courts will still acknowledge the expertise which the police have in assessing risk and their professional judgment is still entitled to be given due weight. For similar reasons, it was relevant that the Social Services department endorsed the proposal for disclosure.” (para 59)

Those cases related to disclosure of information. As the extract from the Bichard report implies, the same principle applies a fortiori to retention. Consistently with that approach, I would have expected the Commissioner to have presented the case to the tribunal on the basis that his and their function was to “review” the Police’s judgment of what was required to fulfil the purposes of the PNC, not to substitute their own judgment. Had that approach been adopted, it is hard to see why it would have been necessary for as many as 19 witnesses to be called on behalf of the police, or for there to have been (as there was) detailed examination of complex statistical evidence about the risk of re-offending in different types of case.

Perhaps understandably, given the way the case was presented, and having been taken through this voluminous evidence, the tribunal felt obliged to undertake the task of evaluating it and forming its own view. For example, having referred to the evidence of certain witnesses about their application of the 2006 guidelines, the tribunal commented:

“None of these witnesses identified any features specific to the individual data subjects that justified the retention of their conviction information… Rather than relying on considerations that are specific to any of the individual data subjects, the Appellants appear to have relied on a general principle: conviction information, once recorded by the police, ought to be retained for life… In order to justify this principle the Appellants called a number of experienced police officers who gave evidence as to how past convictions had led to the apprehension of offenders. Although in no way wishing to substitute our judgment for that of experienced practitioners we would observe that it seemed to us that few if any of these examples seemed to relate to the sorts of offences committed by the data subjects in this case.” (para 122-3)

Similarly, when dealing with each of the individual cases, the tribunal generally accepted the Commissioner’s evaluation of the utility of the information relating to that particular case. For example, in respect of HP, who had been convicted of shop-lifting in 1984 and fined £15, the tribunal summarised (and apparently accepts – para 147) the Commissioner’s case:

“The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that it is extremely unlikely either: (i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or (ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5.”

To my mind this shows the Commissioner doing precisely what he indicated to Bichard that he would not do, that is to substitute his own judgment for that of the Police. Furthermore it misses the point. The purpose of maintaining a complete record of convictions is not negated by showing in an individual case that one or more particular pieces of information is of no identifiable utility. To require a review at that level of particularity would impose a completely unrealistic burden on the controller of the record. Perhaps, if it could be shown that a category of information (defined perhaps by remoteness in time, or triviality) could never be of utility, there might be a case for a general requirement to exclude items within that category. But this is not the case being made by the Commissioner. In any event it would be difficult to reconcile such a requirement with the recognition in the Directive of the legitimacy of a “complete register”.

I conclude that the approach of the Commissioner was fundamentally flawed, and that the tribunal was wrong to endorse it. It follows that, in agreement with Waller LJ, I would quash the enforcement notices in so far as they rely on DPP3 and 5.

As already indicated, I take a different view of the tribunal’s decision in respect of principle DPP1 that personal data must be “processed fairly”. This applies only to SP. In 2001, when she was reprimanded, she was given an assurance that the reprimand would be removed from her record when she was 18 if she did not get into any more trouble. The Commissioner alleged and the tribunal found that the retention of the reprimand on the PNC after her 18^th birthday was unfair. Waller LJ has quoted the relevant passage of the tribunal’s reasoning. They were “not convinced” on the facts of SP’s case that the representation should be disregarded because of “the benefits the conviction data will provide to the wider public”; and there was no clear evidence that the issue of fairness had even been considered by the Police.

Waller LJ criticises this reasoning, on the basis as I understand that it would need to be applied to all those in a similar position to that of SP. The representation was in accordance with the “weeding” policy then in force, and SP would not have been alone in being told about its expected effect. That should not bind the Police if the policy subsequently changes. I could see the force of this reasoning, with respect, if there were evidence that the Police had considered the issue along those lines. That was not the case. The tribunal in my view were entitled to proceed on the evidence before them. The Police did not, as I understand it, advance a case based on the potential consequential effects on other cases of the same kind. In the absence of evidence of the implications for other cases, the tribunal was entitled to limit consideration to this particular case; and to balance, on the one hand, the effect on SP of going back on the representation, against, on the other, the potential significance of the information in question. In my view, their conclusion cannot be faulted in law.

Before closing, I add a brief comment on the future role of the Information Tribunal. This case is one of a number which have demonstrated the weight and public importance of some of the cases which come before the tribunal. Without any disrespect to the experienced President and members who sat in this case, the issues were as complex and significant as many cases in the High Court. It is envisaged that from January 2010 this jurisdiction will become part of the new two-tier tribunal system under the Tribunal Courts and Enforcement Act 2007. The relevant orders are expected to provide for some selected cases to begin in the Upper Tribunal, where it is also possible for High Court or Circuit judges to sit by request. The selection of such cases, and the deployment of judges and members to sit on them, will be a matter for the relevant Chamber President. I observe only that a case of this kind might have been particularly suitable for such treatment, not only because of the importance of the issues, but also because it would have allowed for the involvement of a judge with direct hands-on experience of the criminal system.

Returning to the present case, I would allow the appeal on the grounds based on DDP3 and 5 in relation to all five cases. In the case of SP I would dismiss the appeal in relation to the application of DPP1.

I agree with both my Lords that all these appeals should be allowed on the grounds arising from DPP 3 and 5, and for the reasons which they both give. It is undesirable to prolong this judgment by re-stating those reasons at length. At the risk of over-summarising, I respectfully agree that:

On the separate question of DPP 1 in the case of SP, I respectfully agree with Waller LJ that the appeal must also be allowed. It would be different if the Tribunal had found that SP had been induced to admit the offence by a promise that the record would be expunged if she reached 18 without further offence; in that event there would have been particular considerations, individual to SP, which might justify a conclusion with which a court of appeal ought not to interfere. But the Tribunal did not so find, unsurprisingly given that such a procedure would have been quite improper and that it was not consistent with the recorded interview under caution, in which SP had volunteered the admission in forthright terms: “it was not really self defence; I just went mad.” It did not follow from the fact that the relevant police employee had not separately considered DPP 1, but had simply applied the general rule as it now stood, that the application of that rule was unfair: that was to focus on some requirement for express reasoning rather than on the objective fairness or unfairness of the decision. I am satisfied that it cannot be unfair to apply to SP exactly the same rules as are applied to everyone else, after a change in practice for which there was good reason. Although it is not necessary to do so, I would myself also hold that the retention of this record, like all conviction records, is taken out of the fairness requirement of DPP 1 by section 29(1) Data Protection Act; the absence of a comprehensive record of such matters would be likely to prejudice the prevention and detection of crime and the apprehension or prosecution of offenders.

I add a few words of my own principally to underline some practical considerations and in particular the value, in the public interest, of the existence of a single comprehensive record of convictions and of its being held by police forces acting collectively. By ‘comprehensive’ I mean a complete record of all significant convictions, cautions and reprimands, together with associated information. That the PNC does not extend to recording parking offences and the like does not affect the principle.

First, even if only what the Commissioner called ‘core purposes’ were relevant, the attack on the retention of this data must fail. Like both Waller and Carnwath LJJ, I take the clear view that if senior police officers with considerable operational experience are satisfied that even very old and comparatively minor convictions may sometimes be of assistance in police investigations, then unless that view is perversely or unreasonably held, it is not open to the Commissioner to substitute his own view of their potential use. But I should also add that the opinion expressed by the police witnesses in this case entirely accords with what is seen to be true from time to time in major criminal investigations. As was in evidence in these proceedings, Dame Janet Smith also reached a similar conclusion when considering the investigation into Dr Shipman. Such old convictions, if never subsequently repeated, may very well not be the kind of material which it is proper to put before a jury, for example pursuant to the ‘bad character’ rules contained in sections 98-113 of the Criminal Justice Act 2003, but that does not begin to mean that they have not been of use in the investigation. Quite apart from propensity (or lack of it) to offend in a particular manner, they are likely to be useful for other reasons, of which location and associates are but two simple examples. Moreover, the critical consideration is not the use of the conviction standing by itself, but its potential value in conjunction with other information pieced together by a skilled detective. For the same reason, statistics on the probability of re-offending (even if their interpretation were agreed) are simply not a useful measure of potential use.

Second, many others depend heavily, and reasonably, on the maintenance by the police of these records. Those others include (but are not limited to) the criminal courts, the family courts and those concerned with the protection of children and the vulnerable.

The criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings: section 7(2)(a). There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown.

The importance of multi-agency working to child welfare in general, and to child-centred family proceedings in particular, has been recognised for many years, has been the repeated subject of judicial and ministerial exhortation alike, and is difficult to overstate. It is, nowadays, the daily norm of cases in the family courts. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to these proceedings either: see section 7(2)(c) and (cc). It may well be that at times such co-operation throws up difficult questions about the extent of disclosure which a police force ought to make to social services or other child welfare professionals, but that is not a reason for failing to have available a comprehensive record in order to make a fully-informed decision about it.

When it comes to the vetting of potential employees, the retention of conviction information is, in effect, governed by statute. Relevant potential employers are given by section 4(4) Rehabilitation of Offenders Act and the Exceptions Order made under it the statutory right to ask “exempt questions” about spent convictions. The potential employee cannot rely on the fact that the conviction is spent if the employer is within the Exceptions Order. He is bound to tell the truth. Without some comprehensive record in existence there is a risk that that obligation is an empty one. The answer can, however, be verified by the employer requiring the employee to obtain from the Secretary of State (in practice from the Criminal Records Bureau) a standard certificate of conviction under section 113A Police Act 1997. If the employer has additional qualification he can require the obtaining of an enhanced certificate under s 113B. Either certificate must reveal spent as well as unspent convictions: s 113A(3) and (6)(a) and 113B(3)(a). The enhanced certificate or a disclosure associated with it may also reveal other relevant information: s 113B(4) and (5). The Secretary of State is under a statutory duty to issue such certificates. The Police are under a statutory duty to supply him with the information so that he can do so. Section 119 provides:

“Any person who holds records of convictions, cautions or other information for the use of police forces generally shall make those records available to the Secretary of State for the purpose of enabling him to carry out his functions under this Part…”

Given that statutory framework, it is plain that it is part of the necessary public purposes of the PNC that it maintain a complete record of convictions etc to enable the statutory scheme to work.

I fully understand the concern of the Commissioner at the combination of the extent of a comprehensive database of conviction information and the range of those who have access, directly or indirectly, to it. The greater concern is perhaps related to indirect access. The Tribunal was told in 2005, in a similar appeal (Chief Constable of West Yorkshire and others v Information Commissioner) that at that time approximately 2.6 million CRB certificates were issued in a year and of those 90% or thereabouts enhanced. Some 13,000 organisations are, it would seem, entitled to seek such certificates. But this concern is with policy, and with what ought or ought not to be in the legislation, rather than with the application of the law as it stands. It is for Parliament, and not for the Commissioner alone, to consider any limitation on the indirect access of others to the contents of the PNC. I would respectfully agree that the time may well have come to review the accretions which there have been to the Rehabilitation of Offenders Act 1974 (Exceptions) Order. It currently includes amongst the exceedingly long list of those who must answer questions relating to spent convictions persons as diverse as those who wish to hold a National Lottery licence, or to be a doctor’s receptionist, dental nurse, steward at a football ground, or traffic officer designated under the Traffic Management Act 2000 as having the power to direct traffic. Given that it does not follow that old convictions will in fact be treated as a bar to such employment, it might nevertheless be thought that consideration of the ambit of the Order might be useful. There might also be a case for reviewing the rehabilitation periods applicable to offences, and extending some. There might well be a case for implementing section 56 Data Protection Act in order to prevent employers and others who are outside the Exceptions Order from in effect circumventing the Rehabilitation of Offenders Act. But none of this is for me; it is for Parliament. And it is not for the Commissioner to try to modify the effect of statute by construction of the data protection principles.

For the same reason I can understand why over the years the police and the Commissioner have actively discussed a so-called ‘step down’ regime, under which some information on the PNC would become available only to the police. This may have potential as a policy, although to my mind the criminal and family courts and child protection professionals engaged in working together with police officers would all need continued access to unexpurgated information. It would, however, require modification of the Rehabilitation of Offenders Act and of the Police Act 1997, which at present requires the police to provide the Secretary of State with everything in the record. Moreover, it would require immensely detailed programmes for organisation of the database: the March 2006 edition of the Retention Guidelines, which attempts the exercise, has 25 different categories of offender/outcome combination and no less than 200 pages of a closely-typed list of offences; yet it would still remove from the record convictions which would, for example, disqualify from jury service for life, and some which might plainly be relevant even many years later (for example wounding with intent, bigamy or importing Class A drugs). It would require, thirdly, as it seems to me at least, a method of accommodating fixed penalty notices as they are currently issued for offences which include not only public disorder but dishonesty. But again, if a workable and fair restricted access scheme can nevertheless be devised, this is not to be achieved through the Data Protection Act.

HP was born.

HP was convicted of the offence of theft at the Juvenile Court. He was fined £15 [Bundle pp 33-34].

SP was born.

SP was 13 years of age. She punched a 15 year old girl to the ground, kicked her and caused her injury in Wolgaston Way, Penkrage, Staffordshire [Bundle pp. 85-123]. That day she was arrested and taken to the police station. SP was given a reprimand for an offence of common assault [p 90].

NP was born. He is now 48 years of age.

NP was convicted of an offence of obtaining by deception and an offence of attempting to obtain by deception at the Magistrates Court for which he was fined £150 and £100 respectively and ordered to pay costs of £10 [Bundle pp 160-161].

WMP was born.

At the Juvenile Court, WMP was convicted of two offences of attempted theft, in respect of which he was conditionally discharged for two years, and an offence of criminal damage, for which he was fined £25 and ordered to pay compensation of £6.60, a legal aid contribution of £30 and costs of £29.20 [Bundle pp189-191].

GMP was born. She is now 44 years of age.

GMP was convicted of an offence of theft (and two matters that were taken into consideration) at the Magistrates’ Court. GMP was sentenced to a conditional discharge of 12 months and ordered to pay compensation of £185 and costs of £35 [Bundle pp 244-246]. GMP was 19 years of age at the date of the conviction.