QSA & Ors, R (On the Application Of) v National Police Chiefs' Council & Anor

The three Claimants, QSA, Ms Fiona Broadfoot and ARB, were each convicted in the 1980s and 1990s of offences of loitering in a street or public place for the purposes of prostitution. Pursuant to a policy of the First Defendant, the National Police Chiefs’ Council (“the NPCC”), those convictions are recorded on the Police National Computer (“the PNC”) and will remain so recorded until the Claimants are one hundred years old. Having ceased prostitution, the Claimants claim that that policy is unlawful, since it interferes with their rights under Article 8 ECHR, is not in accordance with the law, and is disproportionate.

Karon Monaghan QC, with Jude Bunting, represented the Claimants; Jason Beer QC with Robert Talalay the First Defendant and Kate Gallafent QC with Christopher Knight the Second Defendant. We are grateful to all counsel, and those who instruct them, for their assistance.

Each Claimant was in her teens when she was forced, or groomed, into prostitution. The First and Second Claimants suffered sexual abuse as children and were still children when they were forced by older men to have sex with others.

The First Claimant, QSA, who was born in 1973, was convicted of loitering in a street or public place for the purposes of prostitution contrary to s. 1 Street Offences Act 1959 (“the s. 1 offence”) some 57 times between 1990 and 1998, when she “exited” prostitution. She is the subject of an anonymity order. The Second Claimant, Ms Broadfoot, who was born in 1968, was convicted of the s. 1 offence some 39 times between January and November 1986 and further times thereafter until 1995, when she exited prostitution. The Third Claimant was convicted of the s. 1 offence some seven times between 1990 and 1992. She exited prostitution in the early 1990s. She too is the subject of an anonymity order.

The First Claimant lives in fear of the abuse she suffered being disclosed to others. She says she feels unable to move on while records of her convictions remain recorded. The Second and Third Claimants feel degraded and angry at the fact that their convictions will be recorded until the hundredth anniversary of their respective dates of birth. Both have failed to progress in their chosen professional fields (social work and health and social care respectively) because, they say, of the records of their convictions.

None of the three Claimants has been convicted of any offence for over 20 years.

The Claimants made attempts to have their records deleted from the PNC. On 6 March 2020, a request was made to the First Defendant to delete the records relating to these offences in the case of ARB. On 11 March 2020, the same request was made in relation to QSA and Fiona Broadfoot. These requests were refused by the First Defendant on 9 March 2020 and 12 March 2020, respectively.

On 23 February 2017, the Claimants issued judicial review proceedings against the Second Defendant advancing seven grounds of claim. Permission was granted by William Davis J to proceed with three grounds.

On 17 and 18 January 2018, a Divisional Court (Holroyde LJ and Nicola Davies J (as she then was)) heard argument on the three grounds in respect of which permission had been granted and three other grounds in respect of which the application for permission was renewed. The grounds can, in summary, be grouped into three challenges.

On 2 March 2018, the Divisional Court allowed the claim in respect of Ground 1, ([2018] EWHC 407 (Admin)), finding that the multiple conviction rule resulted in an interference with the Claimants’ rights that was neither in accordance with the law nor necessary in a democratic society. The court dismissed the claim in respect of the other grounds on which permission had been granted and refused permission on all other grounds.

On 26 March 2018, the same Divisional Court granted the Second Defendants permission to appeal in respect of Ground 1 and refused the Claimants permission to appeal in respect of all grounds sought. Upon the handing-down of the judgment of the Supreme Court in Re Gallagher and R (P, G and W) v Secretary of State for Justice and another [2019] 2 WLR 509; [2020] 2 AC 185 on 30 January 2019, by which the multiple convictions rule was held to be a disproportionate means of meeting its objective, the Second Defendants withdraw their appeal against the judgment of the Divisional Court. It should therefore be noted that this litigation has already been successful in an important respect.

On 11 June 2019, Rafferty and King LJJ granted the Claimants permission to appeal against the refusal of permission to apply for judicial review in respect of the retention challenge and the criminalisation challenge. In a judgment reported at [2020] EWCA Civ 130, the Court of Appeal (Bean, King and Hickinbottom LJJ) dismissed the appeal in respect of the latter but allowed it in respect of the retention challenge, granting permission to apply for judicial review and remitting the matter to be heard by a fresh Divisional Court.

It is in those circumstances that the matter now before this court is a challenge to the First Defendant’s policy called “Deletion of Records from National Police Systems (v2.1)”, (“the NPCC Policy”). By the NPCC Policy, the Claimants’ convictions for the s. 1 offence will remain recorded on the PNC until the convicted individual would reach the age of one hundred. This is conveniently, if not quite accurately, referred to as the 100-year rule.

As originally enacted, s. 1(1) of the Street Offences Act 1959 provided as follows.

It shall be an offence for a common prostitute to loiter or solicit in a street or public place for the purpose of prostitution.” 15.As amended, it now reads:

“(1)

It shall be an offence for a person aged 18 or over (whether male or female) persistently to loiter or solicit in a street or public place for the purpose of prostitution.”

It is of note that that the offence can no longer be committed by someone under 18 and that “persistence” (two or more offences in a period of 3 months) is now required.

S. 1 (2) provides for the sentence to be imposed for these offences:

“(2)

A person guilty of an offence under this section shall be liable on summary conviction to a fine of an amount not exceeding level 2 on the standard scale, or, for an offence committed after a previous conviction, to a fine of an amount not exceeding level 3 on that scale.”

National police records are provided for by s. 27 of the Police and Criminal Evidence Act 1984 (“PACE 1984”), as amended. The relevant parts of that section provide as follows:

“(4)

The Secretary of State may by regulations make provision for recording in national police records convictions for such offences as are specified in the regulations.

(4A) In subsection (4) “conviction” includes—

(a)

a caution within the meaning of Part 5 of the Police Act 1997; and

(b)

a reprimand or warning given under section 65 of the Crime and Disorder Act 1998.”

The Regulations made under that provision are the National Police Records

By paragraph 50 of the Schedule to the Recordable Offences Regulations, the s. 1 offence is a specified offence for the purposes of s. 27(4) PACE 1984.

The purpose of the NPCC Policy is set out at paragraph 1.1.2:

“The purpose of this Guidance is to ensure that a consistent approach is taken by relevant and specified Chief Officers and others in relation to dealing with applications for the deletion of records from these three national police systems:

•

Police National Computer (PNC)

•

National DNA Database (NDNAD)

•

National Fingerprint Database (IDENT1)”

The policy includes the following provision ( the “100-year rule”):

“1.5.5

Under this Guidance, PNC records are required to be retained until a person is deemed to have reached 100 years of age. However, Chief Officers can exercise their discretion, in exceptional circumstances, to delete records for which they are responsible, specifically those relating to non-court disposals e.g. adult simple cautions and conditional cautions as well as any

‘Event History’ owned by them on the PNC but only where the grounds for so doing have been examined and agreed.

1.5.6

Court convictions are not eligible for record deletion from the PNC under this process.”

S. 6 of the Human Rights Act 1998 provides in subsections (1)-(2):

“(1)

It is unlawful for a public authority to act in a way which is incompatible with a Convention right.

(2)

Subsection (1) does not apply to an act if—

(a)

as the result of one or more provisions of primary legislation, the authority could not have acted differently; or (b) in the case of one or more provisions of, or made under, primary legislation which cannot be read or given effect in a way which is compatible with the Convention rights, the authority was acting so as to give effect to or enforce those provisions.”

Article 8 of Schedule 1 to the Human Rights Act 1998 provides as follows.

“1.

Everyone has the right to respect for his private and family life, his home and his correspondence.

(2)

There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

The Claimants advanced the following three grounds of claim in their amended Statement of Facts and Grounds dated 13 July 2020.

Neither in her skeleton argument nor in her oral submissions did Ms Monaghan address Ground 2 separately from ground 3; and for present purposes the two may be treated as indistinguishable.

Referring to the decision of the Court of Appeal in R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1048; [2020] 1 WLR 5037, Ms Monaghan submits that the principles to be applied when determining whether an interference with a Convention right is “in accordance with the law” include the following:

“the law must afford adequate legal protection against arbitrariness, and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise:

Where the impugned measure is a discretionary power, (a) what is not required is an over-rigid regime which does not contain the flexibility which is needed to avoid an unjustified interference with a fundamental right and (b) what is required is that safeguards should be present in order to guard against overbroad discretion resulting in arbitrary, and thus disproportionate, interference with Convention rights. Any exercise of power that is unrestrained by law is not in accordance with the law.”

She submits that the Strasbourg decision in M.M. v. UK (Application no. 24029/07) shows how these principles apply in the context of the retention of criminal record data.

Ms Monaghan says that the safeguards in MM were held to be insufficient because (i) they were not regulated by statute; (ii) there was a presumption in favour of retention and the guidance required data to be retained until the subject was deemed to have reached one hundred years of age; (iii) the only review during that time was a review of whether the data was adequate and up to date; and (iv) there was no possibility of data being deleted where the subject admitted having committed an offence and the data are accurate.

She argues that the absence of any independent review mechanism of a decision to retain the data was key. The importance of an independent review mechanism for compliance with Article 8 was recognised by Lord Reed in R (T) v Chief Constable of

Ms Monaghan argues that the NPCC Policy lacks the safeguards necessary to ensure that the proportionality of the interference with the Claimants’ rights can be adequately examined. In particular, she says that (i) the NPCC Policy requires the retention of all criminal record data, including biometric data and data of the utmost sensitivity. The data held is significant in volume and sensitive in quality; (ii) the NPCC Policy is indiscriminate and open-ended. All conviction data must be held indefinitely; (iii) there are no regulations (whether statutory or otherwise) that regulate the duration of storage or the circumstances in which the data may be destroyed. Retention of data does not depend on different categories of conviction or caution, on the gravity of the offence,

In response Mr Beer for the NPCC, citing R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland (Equality and Human Rights Commission intervening) [2015] UKSC 9, [2015] AC 1065, argues that there is no requirement for the 100-year rule to be set out in a statute or regulations. Referring to Gallagher, he says that there is no requirement for a measure to take account of any particular criterion, such as the seriousness of the offence, and no requirement that there is a mechanism to effect removal of a record of conviction from the PNC. All it requires is sufficient clarity and foreseeability to enable the proportionality of an interference to be properly assessed. He contends that Gallagher also establishes thatif a bright-line rule, such as the 100-year rule, is sufficiently precise and clear, it is in accordance with the law.

Ms Gallafent adopts Mr Beer’s submissions on this issue.

Ms Monaghan says that the disproportionate effect of the policy is exemplified by the Claimants’ cases. Records of historic convictions for minor convictions, which it is alleged were brought about by abuse, are retained on the PNC for the lifetime of the Claimants to their obvious distress and disadvantage.

She relies on the decisions of both the Supreme Court and the ECtHR in Catt, a challenge to the maintenance of records about a 91-year-old man attending political protests. The information was public and had been gathered overtly. Nevertheless, Lord Sumption held that Article 8 was “squarely engaged” where public information is systemically collected and stored in files by the authorities. She says that conclusion applies a fortiori to the data in this case, which is also historic and directly linked to the Claimants’ history of sexual exploitation.

In Catt Lord Sumption described the interference as minor, but even that minor interference required justification. There was detailed evidence before the Court as to why its retention was necessary and Lord Sumption accepted that evidence as credible. Lady Hale contrasted the minor information held about Mr Catt with a “nominal” record. If the police had been holding the latter, she would have been inclined to hold that it could not be justified. It follows, says Ms Monaghan, that, if the Supreme Court had been considering nominal records (which are more obviously analogous to the detailed nominal records in the PNC), a majority of the Supreme Court would have found their retention to be unlawful.

She says that the European Court went further. It found the retention of even the “information records” in Mr Catt’s case to be disproportionate. It placed particular weight on the fact that the data held purported to reveal a political opinion, which was among the special categories of data attracting a heightened level of protection. It was also concerned by the breadth of the power to retain the data. The Court was well aware of the need for caution before overriding the judgment of the police about what information is likely to assist them in their task.

Insofar as it is suggested that Catt is a case about non-conviction data, Ms Monaghan argues, the distinction does not bear the weight the Defendants seek to place on it. In Catt, the fact that the data did not result from a conviction was, if anything, a factor pointing away from a finding of violation. As Lord Sumption noted, the data about Mr Catt was not stigmatising. Yet the European Court found the retention of the data to be disproportionate. Such a finding is all the more likely where, as here, the data is highly stigmatising, arising as it does from findings of prostitution by criminal courts. Moreover, she says, the mere fact of a conviction is not necessarily of significance to how relevant the data will be for future criminal investigations. Many who have been convicted (especially of less serious recordable offences) never re-offend. The rational connection between the retention of their data and any legitimate aim cannot be inferred or presumed simply because they have been found guilty.

She argues that although there is evidence that there is “policing value” in the retention of the data pursuant to the NPCC Policy, that point was, in effect, rejected in Catt and in Gaughran v United Kingdom (App. No. 45245/15): taken to its logical conclusion, the argument would justify the permanent retention of all police data. She points out that Police Scotland operates a more nuanced conviction data retention policy, pursuant to which the 100-year rule would only apply to convictions for a sexually aggravated offence or in relation to which a sentence of life imprisonment was imposed. The fact that such a policy is workable in Scotland suggests that the cruder NPCC Policy is disproportionate.

Finally, she argues that the international human rights framework concerning discrimination against women is relevant to assessing the proportionality of a measure that interferes with women’s Article 8 rights. The Committee on the Elimination of Discrimination Against Women, which monitors the implementation of the Convention on the Elimination of All Forms of Discrimination Against Women, has recommended that the United Kingdom “revise legislation to decriminalize women in prostitution and clear the criminal records of women who have been convicted for offences related to prostitution to enable them to seek alternative forms of employment”. She says that the NPCC Policy’s interference with the Claimant’s rights is the graver for this important context having been ignored.

Mr Beer responds by observing that the Claimants’ case on proportionality is based almost entirely on the decisions of the Strasbourg Court in Catt and Gaughran. Those decisions, he says, cannot be transposed to the facts of this case for the following reasons: (i) Gaughran dealt with biometric data, whose retention was novel within many Council of Europe countries; (ii) conviction records, arising out of the judgment of an independent court, are of a different nature to “police-made” or biometric data; (iii) conviction data is put to a wider range of uses than police-made or biometric data; and (iv) the retention of biometric data pertaining to one individual can impact the rights of other individuals.

He argues that the Supreme Court’s decision in Gaughran is binding authority to the effect that the indefinite retention of a comprehensive database of criminal convictions is compliant with Article 8, because it decided that the indefinite retention of biometric data in such a database was compliant. He says that the analysis of the Court of Appeal in Chief Constable of Humberside v Information Commissioner [2009] EWCA Civ

Mr Beer says that there are three important objectives that justify the maintenance of the comprehensive register of conviction records facilitated by the NPCC Policy, namely: to assist the police and other agencies to investigate crimes; to facilitate the proper operation of the justice system; and to ensure the safeguarding of children, vulnerable adults, and the population at large.

He says that the retention of conviction records constitutes only a slight interference with the Claimants’ rights because the information is drawn from public court proceedings and it is the disclosure of criminal records, and not their retention, that constitutes the real interference in this context.

Mr Beer argues that the NPCC Policy is rationally connected to those objectives. The Police National Computer is the only comprehensive national database of criminal record data in England and Wales. Without the 100-year rule, there would be no such complete database. The question is therefore whether a complete national database of conviction records is rationally connected to each of the objectives above. It is the completeness of the PNC record that gives it its value, since it enables patterns of behaviour to be established and individuals to be located at certain times. A full record of an individual’s convictions is required in order to ensure that fair and legally sound decisions are made throughout the prosecution process. As regards safeguarding, the state is required by both the law and common sense to have access to a complete record of an individual’s convictions.

He says that the NPCC Policy goes no further than is necessary in order to accomplish the objectives described above. The adoption of a bright-line rule is acceptable because of the strength of the reasons underlying the complete PNC record. The hard cases that will necessarily arise do not demonstrate any disproportionality.

He argues that a fair balance has been struck between the rights of those whose convictions are recorded on the PNC pursuant to the NPCC Policy and the importance of the objectives justifying their retention. To correct the historic wrong which the Claimants submit their convictions constitute is not for a court, but for Parliament. Were the claim to succeed, the police’s ability to investigate crime, the administration of justice and the protection of the public would be compromised.

For the SSHD, Ms Gallafent submits that the Claimants’ arguments that the NPCC Policy is not necessary, or is disproportionate, are unsustainable by reference to four considerations. They are the nature of conviction data; the permissibility of pre-defined categories; the direct precedent of Humberside; and the nature of the s. 1 offence of which the Claimants have been convicted.

First, she says a conviction record is fundamentally different from other kinds of data held by the police. Being the result of an independent judicial determination, a conviction cannot be called into question by the police or any other part of the executive. The deletion of a conviction record would have the effect of setting aside the conviction.

Second, she maintains that the Claimants are not entitled to rely on their personal circumstances in challenging the NPCC Policy. Such an approach was rejected by the Supreme Court in Gallagher. It is necessary to have bright-line rules in order to maintain the completeness of the PNC record that constitutes its central value.

Third, Humberside directly addressed the lifetime retention of purportedly minor convictions on the PNC, which is the issue in this case. The Court of Appeal went into detail in showing the importance of the completeness of the PNC’s conviction records for various purposes. Further, it is the only authority to have dealt with conviction data. Catt and Gaughran, which dealt with protest attendance data and biometric data respectively, are not applicable to the present case, because conviction data is of a fundamentally different nature from other police data.

Fourth, the emphasis the Claimants place on their own convictions is inapposite because the s. 1 offence requires a complete conviction record to be kept. By s. 1(2) of the 1959 Act the fine to be imposed upon conviction depends on whether the defendant has a previous conviction for that offence. If convictions under s. 1 were expunged from the record, a court would be unable to determine the correct level of fine upon a fresh conviction.

We begin with a consideration of the Court of Appeal’s decision in Humberside. Mr Beer and Ms Gallafent submit that the court’s analysis in that case is critical to the present case, whereas Ms Monaghan says the Court of Appeal’s conclusion – shown by later case law to be erroneous – that Article 8 was not engaged means it is of little value here.

Humberside arose out of complaints by five individuals to the Information Commissioner following the disclosure of old, minor convictions in response to requests to the Criminal Records Bureau: in one case, a request by one of the individuals herself. In respect of each of those convictions the Information Tribunal upheld the view of the Information Commissioner that they should be deleted from the PNC. The police took the view that no conviction should be deleted save in exceptional circumstances, such as where it had been established that the convictions had been wrongly obtained.

The Information Tribunal found that the purposes for which the convictions were held were "core" police purposes, such as the detection of crime, but rejected the evidence of the police that the convictions were of value for those core purposes. The Tribunal went on to hold that excessive data was being retained contrary to the third data protection principle under the Data Protection Act 1998 Sch. 1 and that such data was being kept for longer than necessary contrary to the fifth data protection principle.

The appellant chief constables appealed against the decision of the Information Tribunal. They submitted that to confine "purposes" to "core" police purposes found no support from the provisions of the Data Protection Act 1998 and Directive 95/46, and in so far as it was a registered purpose to hold the information so that it could be supplied to others, for example to give a complete history of convictions to the courts and the Crown Prosecution Service, there could be no question of the data retained being excessive or being held for longer than necessary.

The appeals were allowed, essentially on the construction of the 1998 Act. The court held that it was a misinterpretation of the Act to suggest that if the police registered particulars then the only purposes for which data could be retained were "core" or operational police purposes. The data controller had to specify the purpose for which data was retained. There was no statutory constraint on any individual or company as to the purposes for which he or it was entitled to retain data. The purposes had to be lawful in order to comply with the first data protection principle but, that apart, a data controller could process data for any purpose. What the data controller had to do, however, was identify the purpose or purposes in the public register so that people knew what the data was being retained for and so that the Information Commissioner and data subjects could test the principles under the Act by reference to the purposes identified.

At [43] – [44] Waller LJ said:

“It seems to me that the approach described is the correct approach. If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter. The examination of statistics relevant only to the question as to the risk of re-offending was not to the point. Furthermore the fact that the statistics actually showed that the risk was greater than with non-offenders is not something I would pray in aid. It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police.

44 I emphasise the word retention because if there is any basis for complaint by the data subjects in this case, it seems to me to relate to the fact that in certain circumstances this information will be disclosed, but that is because Parliament has made exceptions to the Rehabilitation of Offenders Act 1974. What is more, the circumstances in which there will be disclosure are circumstances in which the data subject would be bound to give the correct answer if he or she were asked. It is not as it seems to me the purpose of the 1998 Act to overrule the will of Parliament by a side wind.”

The Court went onto consider Article 8. Waller LJ said this at [50]:

“A further argument was addressed to the tribunal on article 8 independently from the arguments on construction under the 1998 Act. I am not persuaded that article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure. Even if that were wrong, if my conclusions so far are right, the processing is in accordance with the law and necessary in a democratic society. I do not think any extra point arises by reference to article 8 on its own and I mean no disrespect in dealing with this aspect so shortly.”

At [81] Carnwath LJ said:

“I find it unnecessary to reach a general conclusion on the relevance of article 8 to information about convictions. In the present context, in my view, it is enough to rely on the specific endorsement by the Directive of the concept of a complete register. That in my view makes it impossible to argue that the retention of information in such a register is in itself objectionable under the Convention.”

It is common ground that subsequent decisions have demonstrated that the court was wrong to proceed on the basis that Art 8 is not engaged by the retention of such data. For example, in R (L) v Comr of Police of the Metropolis (Secretary of State for the Home Department intervening) [2010] 1 AC 410, Lord Hope said (at [29]):

“It seems to me that the decisions which the chief officer of police is required to take by section 115(7) of the 1997 Act are likely to fall within the scope of article 8(1) in every case, as the information which he is considering has been stored in files held by the police. It follows that its disclosure is likely to affect the private life of the applicant in virtually every case.” In MM v UK the ECtHR held, at[187]:

“The Court reiterates that both the storing of information relating to an individual’s private life and the release of such information come within the scope of Article 8 § 1” In Catt, Lord Sumption said, at [6]:

“…it is clear that the state’s systematic collection and storage in retrievable form even of public information about an individual is an interference with private life. For that reason, I think that the Court of Appeal was right to hold (overruling the Divisional Court in Catt) that article 8.1 was engaged.”

Nevertheless, it does not seem to us that the careful analysis of the justification for the storage of data by the police conducted by the Court of Appeal in Humberside can be disregarded. We return to it in the section below dealing with proportionality.

In In re Gallagher, Lord Sumption, with whom Lords Carnwath and Hughes agreed, referred at [16] to the following passage from the judgments of the Strasbourg Court in Huvig v France (1990) 12 EHRR 528 and Kruslin v France (1990) 12 EHRR 547, saying that the passage “has become the classic definition of law in this context”.

“The expression “in accordance with the law”, within the meaning of article 8.2, requires firstly that the impugned measure should have some basis in domestic law; it also refers to the quality of the law in question, requiring that it should be accessible to the person concerned, who must moreover be able to foresee its consequences for him, and compatible with the rule of law.”

In order to determine whether the 100-year rule is “in accordance with the law” we turn to consider a series of five cases in which the requirement that an interference must be “in accordance with law” was considered in the context of police records.

First, in MM v UK the Strasbourg court was concerned with the maintenance by the police in Northern Ireland of a record of a caution for an offence of child abduction. At [6] – [8] the court recounted the history:

“6.

In April 2000 the girlfriend of the applicant’s son wished to leave Northern Ireland with the applicant’s ten-month old grandson and return to live in Australia following her separation from the applicant’s son. In order to try and force her son and his girlfriend to reconcile their differences, and in the hope that her grandson would not return to Australia, the applicant disappeared with her grandson at 6 p.m. on 19 April 2000 without the parents’ permission. The police were called and the child was returned unharmed on the morning of 21 April 2000.

7.

The applicant was subsequently arrested for child abduction. At a police interview on 24 April 2000, in the presence of her solicitor, the applicant confirmed that she had been aware at the time that she took her grandson that her conduct amounted to child abduction.

8.

By letter dated 10 October 2000 the Director of Public Prosecutions recorded his decision that the public interest did not require the initiation of criminal proceedings against the applicant and that no such proceedings should therefore be brought. Instead, he indicated that a caution should be administered.”

At [23] the court noted that the relevant regulations

“..... identify the relevant convictions as being those for offences punishable by imprisonment, as well as a number of additional specified offences. The regulations do not make any reference to cautions.

24.

According to the Government, the recording of cautions in

Northern Ireland takes place under the police’s common law powers to retain and use information for police purposes....”

At [188] the court noted that

“the data in question constitute both “personal data” and

“sensitive personal data” ... In this regard the Court, like Lord

Hope in R (L), emphasises that although data contained in the criminal record are, in one sense, public information, their systematic storing in central records means that they are available for disclosure long after the event when everyone other than the person concerned is likely to have forgotten about it, and all the more so where, as in the present case, the caution has occurred in private. Thus as the conviction or caution itself recedes into the past, it becomes a part of the person’s private life which must be respected (see Rotaru, cited above, §§ 43-44). In the present case, the administration of the caution occurred almost twelve years ago.”

At [193] the court set out the contents of the requirement that any interference must be in accordance with the law:

“The requirement that any interference must be “in accordance with the law” under Article 8 § 2 means that the impugned measure must have some basis in domestic law and be compatible with the rule of law, which is expressly mentioned in the preamble to the Convention and inherent in the object and purpose of Article 8. The law must thus be adequately accessible and foreseeable, that is, formulated with sufficient precision to enable the individual – if need be with appropriate advice – to regulate his conduct. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.”

At [195] the court identified what it regarded as essential in the context of the recording of criminal record data:

“The Court considers it essential, in the context of the recording and communication of criminal record data as in telephone tapping, secret surveillance and covert intelligence-gathering, to have clear, detailed rules governing the scope and application of measures; as well as minimum safeguards concerning, inter alia, duration, storage, usage, access of third parties, procedures for preserving the integrity and confidentiality of data and procedures for their destruction, thus providing sufficient guarantees against the risk of abuse and arbitrariness (see S. and Marper, cited above, § 99, and the references therein). There are various crucial stages at which data protection issues under Article 8 of the Convention may arise, including during collection, storage, use and communication of data. At each stage, appropriate and adequate safeguards which reflect the principles elaborated in applicable data protection instruments and prevent arbitrary and disproportionate interference with Article 8 rights must be in place.”

At [199] it recognised the need for a comprehensive record but indicated the need for safeguards:

“199.

The Court recognises that there may be a need for a comprehensive record of all cautions, convictions, warnings, reprimands, acquittals and even other information of the nature currently disclosed pursuant to section 113B(4) of the 1997 Act. However, the indiscriminate and open-ended collection of criminal record data is unlikely to comply with the requirements of Article 8 in the absence of clear and detailed statutory regulations clarifying the safeguards applicable and setting out the rules governing, inter alia, the circumstances in which data can be collected, the duration of their storage, the use to which they can be put and the circumstances in which they may be destroyed”

At [202] the court said:

“The Court reiterates that there is no statutory law in respect of Northern Ireland which governs the collection and storage of data regarding the administration of cautions. Retention of such data is carried out pursuant to the common law powers of the police, in accordance with the general principles set out in the Data Protection Act. In the absence of any statutory provisions, a number of policy documents which apply in Northern Ireland have been identified by the Government (see paragraphs 33-46 above). As noted above, it is clear from the MOPI Guidance and the ACPO Guidelines that the recording and initial retention of caution data are intended in practice to be automatic. While reference is made in the MOPI Guidance to a review of retention after a six-year period, the criteria for review appear to be very restrictive. The Guidance notes that there is a presumption in favour of retention and the review schedule requires police to retain data in the category of “Certain Public Protection Matters” until the data subject is deemed to have reached one hundred years of age, regardless of the type or classification of data or grade of the intelligence concerned (see paragraphs 39-40 above). Any review in such cases seems intended to focus on whether the data are adequate and up to date. Pursuant to the ACPO Guidelines, it appears that data held in central police records are now automatically retained, regardless of the seriousness of the offence in question, until the person is deemed to have reached one hundred years of age. The ACPO Guidelines themselves explain that they are based on a format of restricting access to data, rather than deleting them. While deletion requests can be made under the ACPO Guidelines, they should only be granted in exceptional circumstances (see paragraphs 43-46 above). As noted above the examples given as to what constitute exceptional circumstances do not suggest a possibility of deletion being ordered in any case where the data subject admits having committed an offence and the data are accurate.”

At [207] the court concluded:

“The cumulative effect of these shortcomings is that the Court is not satisfied that there were, and are, sufficient safeguards in the system for retention and disclosure of criminal record data to ensure that data relating to the applicant’s private life have not been, and will not be, disclosed in violation of her right to respect for her private life. The retention and disclosure of the applicant’s caution data accordingly cannot be regarded as being in accordance with the law.”

In our judgment, the focus of the court’s concern in MM was the risk of disclosure of data, and the critical feature of the Northern Irish arrangements for recording of cautions which were under challenge was their discretionary, common law nature. Apart from the Data Protection Act, there was no legislation, primary or secondary, governing the collection and retention of cautions. Whether or not a caution would be recorded or disclosed was governed by potentially arbitrary decision-making by individual police officers. As a result, it could not be said that the applicable law was adequately accessible and foreseeable or that it afforded adequate legal protection against arbitrariness. It was in those circumstances that the interference with the applicant's Article 8 rights was not in accordance with the law.

The second case is T v Chief Constable of Greater Manchester Police, where MM was considered by the Supreme Court. That case concerned provisions for disclosure of warnings given to a child in respect of two stolen bicycles and a caution given to an adult for failing to pay for an item from a chemist’s store. Lord Wilson addressed the requirements of legality and the decision in MM at [29] and [35]:

“29 But for the decision of the ECtHR on 13 November 2012 in MM v United Kingdom … to which I will turn at para 35 below, there is in my view little reason to doubt that the issue of the certificates and the imposition of the obligations on T were, at any rate, in accordance with law…

35…It is hard to see how absence of review can affect either the accessibility or the precision of the legislation although, if safeguards against arbitrariness are a free-standing aspect of the principle, it might arguably qualify in that regard. But in my view the court’s third and final point, namely its powerful criticism of the failure of the regime under [the Police Act 1997] to regulate disclosure by reference to the circumstances of the caution, clearly addresses its proportionality and thus the necessity, as opposed to the legality, of the interference. Then in para 207 the court concluded that the consequence of these three points was an absence of safeguards which precipitated a violation of the grandmother’s rights and that accordingly the retention and disclosure of the information about her caution were not in accordance with law. So, although – significantly - the grandmother had not even disputed that the interference was in accordance with law (para 192), the court reached its determination on that basis and therefore without any reference to the margin of appreciation.”

Lord Reed reached a different view on whether the arrangements for disclosing records were in accordance with the law. In a passage [113]-[114] with which Lord Neuberger, Baroness Hale and Lord Clarke agreed, and on which Ms Monaghan placed particular reliance, Lord Reed said this:

“113 … Put shortly, legislation which requires the indiscriminate disclosure by the state of personal data which it has collected and stored does not contain adequate safeguards against arbitrary interferences with article 8 rights.

114 This issue may appear to overlap with the question whether the interference is necessary in a democratic society: a question which requires an assessment of the proportionality of the interference. These two issues are indeed inter-linked, as I shall explain, but their focus is different. Determination of whether the collection and use by the state of personal data was necessary in a particular case involves an assessment of the relevancy and sufficiency of the reasons given by the national authorities. In making that assessment, in a context where the aim pursued is likely to be the protection of national security or public safety, or the prevention of disorder or crime, the court allows a margin of appreciation to the national authorities, recognising that they are often in the best position to determine the necessity for the interference. As I have explained, the court’s focus tends to be on whether there were adequate safeguards against abuse, since the existence of such safeguards should ensure that the national authorities have addressed the issue of the necessity for the interference in a manner which is capable of satisfying the requirements of the Convention. In other words, in order for the interference to be in accordance with the law, there must be safeguards which have the effect of enabling the proportionality of the interference to be adequately examined. Whether the interference in a given case was in fact proportionate is a separate question. (Emphasis added.)”

At [119] Lord Reed said:

“119 In the light of the judgment in MM v United Kingdom, it is plain that the disclosure of the data relating to the respondent’s cautions is an interference with the right protected by article 8.1. The legislation governing the disclosure of the data, in the version with which these appeals are concerned, is indistinguishable from the version of Part V of the 1997 Act which was considered in MM. That judgment establishes, in my opinion persuasively, that the legislation fails to meet the requirements for disclosure to constitute an interference in accordance with the law. That is so, as the court explained in MM, because of the cumulative effect of the failure to draw any distinction on the basis of the nature of the offence, the disposal in the case, the time which has elapsed since the offence took place or the relevance of the data to the employment sought, and the absence of any mechanism for independent review of a decision to disclose data under section 113A.”

The passage we have emphasised, says Ms Monaghan, establishes beyond argument that the need for safeguards to ensure that the effect of the measure in question is proportionate is an essential element of a measure that is in accordance with the law.

However, both MM and T were considered by Lord Sumption in the third case, Catt. Mr Catt had attended many public demonstrations organised by a group which campaigned against the operations of a commercial weapons manufacturer. Some of the group’s supporters sought to further its aims by means of violence and other criminal behaviour, but there was no evidence that the claimant had ever been involved in criminal activity. It was the practice of the police routinely to identify the participants in such demonstrations and to keep such information about them as was deemed relevant on a domestic extremism database maintained by the National Public Order Intelligence Unit. The data in question consisted entirely of records made of acts of the individuals in question which took place in public or in the common spaces of a block of flats to which other tenants had access. The information had not been obtained by any intrusive technique such as bugging or DNA sampling.

At [15]-[17] Lord Sumption said that both MM and T:

“concerned the disclosure of information from police records under the Police Act 1997 to potential employers and regulatory bodies, as a result of which the complainants were unable to obtain employment involving contact with children or vulnerable adults ... Since these disclosures were required by statute, the provisions of the Data Protection Act 1998 restricting their disclosure had no application: see section 35(1) of that Act. In MM, the European Court of Human Rights held that disclosure in accordance with sections 113A and 113B was not in accordance with the law because it was mandatory. The relevant provisions involved no rational assessment of risk and contained no safeguards against abuse or arbitrary treatment of individuals. In T, the Supreme Court, on materially indistinguishable facts, applied the same principle. The present appeals, however, come before us on a very different basis. There has been no disclosure to third parties, and the prospect of future disclosure is limited by comprehensive restrictions. It is limited to policing purposes, and is subject to an internal proportionality review and the review by the Information Commissioner and the courts.

16

In MM, the Strasbourg court criticised the generous approach of the law of the United Kingdom to the exercise of police power to retain personal data even before disclosure: para 170. It does not, however, follow from these criticisms that retention of personal data in the United Kingdom is not in accordance with the law. In the first place, at the time which was relevant to the applicant’s complaint in MM, challenges to the retention of data were seriously inhibited by the decisions of the House of Lords in R (S) v Chief Constable of the South Yorkshire Police [2004] 1 WLR 2196, which concerned the statutory power of the police to retain DNA profiles taken from persons who had been arrested but who were subsequently acquitted or not prosecuted, and the Court of Appeal in Chief Constable of Humberside Police v Information Comr (Secretary of State for the Home Department intervening) [2010] 1 WLR 1136, which concerned the retention of records of minor convictions. In both cases, the courts had doubted whether article 8 of the Convention was even engaged, but on the footing that it was engaged considered that the interference with private life was minor and justified. Things have moved on since then. There is no longer any doubt about the application of article 8 to the systematic retention of processable personal data, and the test of justification has become more exacting since the decision of the Strasbourg court in S v United Kingdom 48 EHRR 1169. The decisions of this court in R (GC) v Comr of Police for the Metropolis (Liberty intervening) [2011] 1 WLR 1230 and R (L) v Comr of Police of the Metropolis (Secretary of State for the Home Department intervening) [2010] 1 AC 410 were important milestones. Secondly, the purpose for which the rules and practices about data retention were reviewed by the Strasbourg court in MM was not to ascertain the legality of the retention but to assess the adequacy of domestic remedies having regard to the applicants alleged failure to exhaust them before petitioning the Strasbourg court. Thirdly, it is clear that the retention of the data in MM was relevant not so much in itself as because it exposed the applicant to future disclosure. The problem with which the Strasbourg court was concerned was that once the data were entered into the system, there was no way of preventing their disclosure under the mandatory provisions of the Police Act. It followed that the only legal protection against disclosure consisted in the restrictions on the obtaining or retention of the data in the first place. The point is well captured in the court’s conclusion, at para 207...

17

In my opinion, the retention of data in police information systems in the United Kingdom is in accordance with law. The real question on these appeals is whether the interference with the respondents article 8 rights was proportionate to the objective of maintaining public order and preventing or detecting crime. For this purpose, it is necessary to look separately at the two cases before us, for the relevant considerations are very different.” (Emphasis added.)

Baroness Hale agreed. At [47] she said:

“I too agree that the systematic collection and retention of information about Mr Catt and Ms T constitutes an interference with their right to respect for their private life protected by article 8, even though, in the case of Mr Catt, the information collected related to his activities in public. I also agree that, as Lord Sumption JSC has explained, the combination of the requirements of the Data Protection Act 1998, coupled with the Code of Practice issued by the Secretary of State under the Police Act 1996 and the detailed Guidance on the Management of Police Information issued by the Association of Chief Police Officers, provided sufficient protection against arbitrary police behaviour, so that the collection and retention of this information was in accordance with the law for the purpose of article 8.2 of the Convention.”

Lord Sumption returned to the issue in the fourth case, Gallagher. The claimants in that case all had one or more convictions or police cautions or reprimands that were spent. Under section 4(2)(3) of the Rehabilitation of Offenders Act 1974 a person had the right not to disclose a conviction or reprimand that was spent. However, pursuant to exceptions to that right provided by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, the claimants had been, or would be, required to disclose their convictions or reprimands when applying for jobs involving contact with children or vulnerable adults. Moreover, pursuant to either section 113A or section 113B of the Police Act 1997, as amended, the claimants’ convictions had been, or would be, disclosed in any criminal record certificate or enhanced criminal record certificate in respect of them, which would generally be required when applying for such jobs.

The Court concluded (as set out in the headnote in the Law Reports, [2020] AC 185) that in order for legislation to be in accordance with the law, within Article 8.2 of the

At [17] Lord Sumption (with whom Lord Carnwath and Lord Hughes agreed) said:

“The accessibility test speaks for itself. For a measure to have the quality of law, it must be possible to discover, if necessary with the aid of professional advice, what its provisions are. In other words, it must be published and comprehensible. The requirement of foreseeability, so far as it adds to the requirement of accessibility, is essentially concerned with the principle summed up in the adage of the American founding father John Adams, a government of laws and not of men. A measure is not in accordance with the law if it purports to authorise an exercise of power unconstrained by law. The measure must not therefore confer a discretion so broad that its scope is in practice dependent on the will of those who apply it, rather than on the law itself. Nor should it be couched in terms so vague or so general as to produce substantially the same effect in practice. The breadth of a measure and the absence of safeguards for the rights of individuals are relevant to its quality as law where the measure confers discretions, in terms or in practice, which make its effects insufficiently foreseeable. Thus a power whose exercise is dependent on the judgment of an official as to when, in what circumstances or against whom to apply it, must be sufficiently constrained by some legal rule governing the principles on which that decision is to be made. But a legal rule imposing a duty to take some action in every case to which the rule applies does not necessarily give rise to the same problem. It may give rise to a different problem when it comes to necessity and proportionality, but that is another issue. If the question is how much discretion is too much, the only legal tool available for resolving it is a proportionality test which, unlike the test of legality, is a question of degree.”

He went on to deal with MM at [29]:

“The pre-2008 position in Northern Ireland as regards cautions was an obvious example of unconstrained discretionary power. For present purposes, however, the judgment is mainly of interest for its treatment of the position in Northern Ireland after April 2008 under the Police Act 1997. MM contended that the caution should have been deleted so as not to be available for disclosure under the new regime. The court recorded (para 195) its view that article 8 was engaged by the whole process of collection, retention, use and disclosure of data on police files. It recognised (para 199) that there may be a need for a comprehensive record of all cautions, conviction, warnings, reprimands, acquittals and even other information of the nature currently disclosed pursuant to section 113B(4) of the 1997 Act. However, as the court went on to observe at para 200: the greater the scope of the recording system, and thus the greater the amount and sensitivity of data held and available for disclosure, the more important the content of the safeguards to be applied at the various crucial stages in the subsequent processing of the data. In other words, the considerations that were relevant to each of the three stages were interrelated, because the greater the volume or significance of the data retained, the more important it was to restrict its disclosure. It followed that for the statutory scheme to have the quality of law, it was not enough that the circumstances in which disclosure was authorised were sufficiently defined by law. This merely pushed the issue back to the earlier stages of collection and storage of data. In R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland (Equality and Human Rights Commission intervening) [2015] AC 1065, para 15, I suggested that the Strasbourg court in MM had found disclosure of convictions under section 113A and 113B of the 1997 Act not to be in accordance with law because it was mandatory. It would have been more accurate to say that it was because its mandatory disclosure meant that the scheme as a whole was not in accordance with law, which is the third point made at para 16. If collection and retention continued to be subject to an unconstrained discretion, the result was that the bank of data available for mandatory disclosure was variable according to the judgment of the police and did not have the necessary quality of foreseeability.”

At [31] he considered how MM was treated by the Strasbourg court in Catt v United Kingdom (2019) 69 EHRR 7. At para 94, he said that:

“MM was treated as authority for the following proposition: As the court has recalled the expression in accordance with the law not only requires the impugned measure to have some basis in domestic law, but also refers to the quality of the law in question, requiring that it should be accessible to the person concerned and foreseeable as to its effects. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope and discretion conferred on the competent authorities and the manner of its exercise (see, among other authorities, MM … para 193, with further references). In other words, an excessively broad discretion in the application of a measure infringing the right of privacy is likely to amount to an exercise of power unconstrained by law. It cannot therefore be in accordance with law unless there are sufficient safeguards, exercised on known legal principles, against the arbitrary exercise of that discretion, so as to make its application reasonably foreseeable.” (Emphasis added)

Lord Sumption turned to consider Lord Reed’s analysis of MM in T at [37]-[41]. He firmly rejected the submission that T was authority for the proposition that a measure may lack the quality of law even where there is no relevant discretion and the relevant rules are precise and entirely clear, if the categories requiring to be disclosed are simply too broad or insufficiently filtered. He gave three reasons for that conclusion. First, he said:

“it is hardly conceivable that Lord Reed JSC intended to effect a revolution in this branch of the law, with such far-reaching results, and without acknowledging the fact. On the contrary, it is clear that he did not. He regarded himself as applying the established case law of the Strasbourg court” which had been based on “the classic dual test of accessibility and foreseeability.”

Second, he held that, “in distinguishing between the legality test and the proportionality test, Lord Reed JSC pointed out at para 114 that in order for the interference to be in accordance with the law, there must be safeguards which have the effect of enabling the proportionality of the interference to be adequately examined”. With that assertion

Third, he said that at para 119, where Lord Reed JSC explains his disposal of the appeal, he is expressly applying MM.

“That decision, as I have pointed out, had been based on the perceived absence of a clear legislative framework for the collection and storage of data … which would fall to be mandatorily disclosed under section 113A and 113B of the Police Act 1997. The absence of any clear legislative framework for the recording and retention of criminal records meant that the body of data falling to be mandatorily disclosed was of uncertain content. The uncertain character of the system for retaining criminal records affected the lawfulness of their disclosure. Hence the relevance of the indiscriminate character of the disclosure which Lord Reed JSC criticises at para 119.”

At [41] Lord Sumption added:

“In a precedent-based system, the reasoning of judges has to be approached in the light of the particular problem which was before them. There is a danger in treating a judge’s analysis of that problem as a general statement of principle applicable to a whole area of law. Lord Reed JSCs observations in T cannot inmy opinion be applied generally to the whole relationshipbetween legality and proportionality in the Convention, even incases where the relevant domestic rule satisfied the tests ofaccessibility and foreseeability. It is noticeable that the principle of legality was stated in narrower terms by Baroness Hale DPSC, Lord Reed and Lord Hodge JJSC in their joint judgment in

Christian Institute v Lord Advocate 2017 SC (UKSC) 29.” (Emphasis added.)

The passage to which Lord Sumption referred in the Christian Institute case read as follows:

“[79] In order to be ‘in accordance with the law’ under Art 8(2) of the ECHR, the measure must not only have some basis in domestic law … but also be accessible to the person concerned and foreseeable as to its effects. These qualitative requirements of accessibility and foreseeability have two elements. First, a rule must be formulated with sufficient precision to enable any individual — if need be with appropriate advice — to regulate his or her conduct ... Secondly, it must be sufficiently precise to give legal protection against arbitrariness:”

‘[I]t must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention. In matters affecting fundamental rights it would be contrary to the rule of law . . . for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any discretion conferred on the competent authorities and the manner of its exercise. The level of precision required of domestic legislation — which cannot in any case provide for every eventuality — depends to a considerable degree on the content of the instrument in question, the field it is designed to cover and the number and status of those to whom it is addressed.’ (Gillan, para 77; Peruzzo v Germany, para 35.) [80]

Recently, in R (T) v Chief Constable, Greater Manchester Police this court has explained that the obligation to give protection against arbitrary interference requires that there must be safeguards which have the effect of enabling the proportionality of the interference to be adequately examined. This is an issue of the rule of law and is not a matter on which national authorities are given a margin of appreciation.”

As Lord Sumption points out, there is nothing in that passage to suggest that Lord Reed considered that safeguards by which proportionality could be examined were necessary before a measure could be found to be in accordance with the law.

In her judgment in Gallagher, Baroness Hale made it clear she was of the same view on this issue as Lord Sumption. At [73] she said:

“The principles to be derived from the Strasbourg cases were to my mind accurately summarised in the joint judgment of Lord Reed, Lord Hodge JJSC and myself in Christian Institute v Lord Advocate 2017 SC (UKSC) 29, at paras 79–80, cited and agreed with by Lord Sumption at para 41 above. The foundation of the principle of legality is the rule of law itself—that people are to be governed by laws not men. They must not be subjected to the arbitrary—that is, the unprincipled, whimsical or inconsistent— decisions of those in power. This means, first, that the law must be adequately accessible and ascertainable, so that people can know what it is; and second, that it must be sufficiently precise to enable a person—with legal advice if necessary— to regulate his conduct accordingly. The law will not be sufficiently predictable if it is too broad, too imprecise or confers an unfettered discretion on those in power. This is a separate question from whether the law in question constitutes a disproportionate interference with a Convention right—but the law in question must contain safeguards which enable the proportionality of the interference to be adequately examined. This does not mean that the law in question has to contain a mechanism for the review of decisions in every individual case: it means only that it has to be possible to examine both the law itself and the decisions made under it, to see whether they pass the test of being necessary in a democratic society.” (Emphasis added)

It follows from Lord Sumption’s and Lady Hale’s analysis in Gallagher that the requirements which must be established if a measure is to be regarded as “in accordance with the law” do not include the incorporation, within the measure itself, of safeguards to prevent a disproportionate interference with a Convention right or a review mechanism by which a decision to apply the measure can be challenged. Instead, it has to be possible to examine the law itself, and the decisions made under it, to ensure they are necessary in a democratic society. In our judgment the policy here meets all the requirements articulated in Gallagher. It is undeniably accessible and precise. In fact, part of the complaint made under grounds 2 and 3 is that it admits of no exceptions. The absence of safeguards to prevent disproportionate effect or of any review mechanisms goes not to the lawfulness of the measure but to its proportionality.

Finally, it is necessary to touch on the Court of Appeal’s judgment in R (Bridges) v Chief Constable of South Wales Police [2020] 1 WLR 5037. There the defendant chief constable’s police force was involved in testing and conducting trials of automated facial recognition technology which compared live camera feeds of faces against a predetermined watch list in order to locate persons of interest. At [55] the Court of Appeal approved the general principles extracted by the Divisional Court from the previous caselaw, in particular Catt and Gallagher. When addressing the need for accessibility, the court said that

“the law must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise” and “[w]here the impugned measure is a discretionary power, (a) what is not required is an over-rigid regime which does not contain the flexibility which is needed to avoid an unjustified interference with a fundamental right and (b) what is required is that safeguards should be present in order to guard against overbroad discretion resulting in arbitrary, and thus disproportionate, interference with Convention rights: …. Any exercise of power that is unrestrained by law is not in accordance with the law.”

Ms Monaghan submits that the policy here breaches those requirements. We do not agree. The law does afford adequate legal protection against arbitrariness because it admits of no exceptions or qualifications. It is, as Mr Beer puts it, a bright line rule. It indicates precisely the scope of the power conferred on the competent authorities and the manner of its exercise; it is clear there is no discretion. The impugned measure is not a discretionary power.

At the heart of the requirement that an impugned measure must be in accordance with law is clarity and foreseeability. There is little that could be clearer or have a more foreseeable effect than the NPCC Policy. As a hard-edged rule that does not allow for the exercise of discretion, its effect on the Claimants’ Article 8 rights is plain and entirely foreseeable. The need for safeguards in the form of an independent review mechanism that the Claimants seek to derive from Bridges at [55], MM at [206], T at [114] and [119] and Gallagher at [39] does not apply to this case; there is no discretion that could give rise to any uncertainty as to whether there has been interference with the Article 8 rights of any individual. As such, this ground of the claim fails.

The four-fold test to be applied in determining whether an interference with an Article 8 right is disproportionate is set out by Lord Reed in Bank Mellat v HM Treasury (No 2)[2013] UKSC 39; [2014] AC 700at [74], namely:

Lord Reed said that, in essence, the question at step four is whether the impact of the rights infringement is disproportionate to the likely benefit of the impugned measure. He also noted (at [76]) that an assessment of proportionality inevitably involves a value judgment at the stage at which a balance is to be struck between the importance of the objective pursued and the value of the right intruded upon.

On the present facts, the first three of those questions fall to be considered together. The questions whether the objective in view justified the interference, whether the maintenance of a comprehensive criminal record was connected to that objective and whether the requirements of the PNC went no further than was necessary, all turn on the nature, purpose and utility of the PNC. On the Defendants’ cases, the objective in view is the maintenance of a complete and comprehensive record of criminal convictions under the Regulations; it is that comprehensiveness that justifies the 100year rule; and, by definition, if cases like the Claimants’ could be removed, the scheme would lack that essential comprehensiveness.

In addressing that issue, we return to the decision of the Court of Appeal in Humberside. We remind ourselves that the primary focus of the case was not Article 8 ECHR but the alleged breach of the Data Protection Act 1998 following disclosures of old, minor convictions by the Criminal Records Bureau. At [54] Carnwath LJ described the underlying purpose of the PNC as “the maintenance of a complete record of convictions, subject to certain defined limitations, for the assistance both of the Police itself and of other agencies which legitimately require that information”. At [109] Hughes LJ described the value of comprehensive criminal records:

“The criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings: see section 7(2)(a). There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown.

(a)

It is the duty of the Crown to place before any sentencing court a complete record of previous convictions of the defendant. By section 143(2) of the Criminal Justice Act 2003, a previous conviction is to be treated as aggravating the offence if it reasonably can be. A court may of course disregard an old conviction and often will, but it may be wrong to do so. Certainly there ought often to be a real difference between sentencing a person who has never before offended and sentencing one who has, perhaps similarly, albeit many years previously. The court must be in a position to make an informed decision.

(b)

There is an obligation on the Crown to reveal to the defence any convictions of any witness on whom it relies. That does not mean that the conviction can automatically be put in evidence by the defendant, but it enables the court to give proper consideration to any application under section 100 of the Criminal Justice Act 2003 to do so. Similarly, it will sometimes happen that it is relevant to challenge a witness called on behalf of the defendant on the basis of his record, especially for example if he has professed to a respectability which he does not enjoy.

These simple, non-exhaustive, examples demonstrate how the common coin of the criminal court depends upon access by the court, through the prosecution and thus through the PNC, to a reliable and comprehensive record of convictions and their circumstances. Such records as might be pieced together from multiple courts, or from the historical files of diverse prosecuting authorities, would be no kind of substitute, and it is in any event highly undesirable that there should be multiple databases, with the inevitable concomitant risks of duplication of effort, inconsistency and reduced security. The criminal justice system thus depends on the maintenance of the PNC. If the PNC is not complete, the court can never know of a relevant old conviction. The Secretary of State for Justice expressed the view in this case that “providing anything less than full information to the courts would potentially undermine the criminal justice process”. I agree.”

In our judgment, what the court said in Humberside about the justification for a comprehensive criminal record is as powerful for the purposes of Article 8.2 in 202021 as it was for the Data Protection Act at the time of the hearing in Humberside in 2009. As Mr Christophe Prince, the Director of the Data and Identity Directorate in the Home Office, says at paragraph 21 of his witness statement:

“The criminal record of defendants (and even non-defendant witnesses) has potential relevance at various stages of criminal proceedings from the very beginning of the prosecution case, through plea and allocation, bail, evidence at trial, and sentencing. A person’s previous convictions thereafter continue to have relevance for parole and probation.”

Mr Prince provides a detailed analysis of the value of criminal records in the criminal justice system which we do not repeat here. One obvious example of where a comprehensive criminal record system is important to ensure a fair trial is provided by s. 100 of the 2003 Criminal Justice Act. By that provision evidence of the bad character of a person other than the defendant is admissible where it is both of substantial probative value to a matter in issue in the proceedings and of substantial importance in the context of the case as a whole. Evidence of such bad character may be provided by previous convictions of the witness (see R v Brewster and Cromwell [2010] EWCA

Examples of where a comprehensive record is essential for sentencing purposes are provided by ss. 313 and 314 of the Sentencing Act 2020 (formerly ss. 110-111 of the Powers of Criminal Courts (Sentencing) Act 2000) which provide a so called ‘threestrikes’ rule for class A drug trafficking offences and domestic burglary offences respectively. In the event that a person has two prior relevant convictions, the court is mandated to impose minimum sentences of seven and three years in custody respectively for the third offence. Similarly and as already noted, by s. 1(2) of the Street Offences Act 1959, the provision under which the Claimants were convicted, a person guilty of a second offence is liable to a greater fine than someone convicted for the first time.

Mr Beer identifies numerous other respects in which the existence of a comprehensive record of convictions is essential to the proper operation of public services. For example, he points to the evidence of Commissioner Ian Dyson, the Commissioner of the City of London Police and National Policing Lead on Information Management, as to the importance of records for the investigation of crime:

“Even seemingly “minor” aged convictions (including out of court disposals) can provide an invaluable policing tool for the prevention and detection of crime. Small details of information about the convictions are capable of establishing modi operandi and making it easier for the police service to make the necessary connections to bring offenders to justice.”

Mr Beer also refers to the evidence of Mr Prince in respect of the management of parole and probation, and the recruitment of covert human intelligence sources (“CHIS”). By way of example only, Mr Prince says that when recruiting CHIS:

“due diligence checks are performed which include examining records on the PNC. Any criminality the individual has been or is involved in is used to enable a full and complete risk assessment, including that of risk to the potential CHIS, of any recruiting activity to be taken. CHIS recruitment could take place at any age, that individual’s full criminal record including historical convictions is needed to enable officers be cognisant of all the risks associated with a CHIS and if needed, put the correct mitigations in place. The absence of such information would lead to an increased risk to officers, the CHIS, operations and enhance the likelihood of mission failure.”

Mr Prince explains that the Child Sexual Abuse and Exploitation (“CSAE”) team within the National Crime Agency uses the PNC to assess risk.

“If someone is identified as having a sexual interest in children, it has been found that their interest does not necessarily decline with age; there are multiple cases where individuals into their 70s and 80s have been identified as having a sexual interest in children, committing concomitant offences. As offenders grow older, they may also gain further access to children by becoming grandparents for example, and so the consideration of risk remains highly relevant. PNC data allows for detailed comparison between novel and prior offending behaviours, enhancing the effective identification of re-offenders. The 100 year rule allows for lifetime management to take place. On the PNC, continued risk around a subject can be flagged, allowing offender managers, police forces, and investigators to immediately identify risks and deliver effective offender management strategies.”

The PNC is also used by the Serious Fraud Office (“SFO”). Records of minor offences including low level dishonesty and fraud may be vital for investigations into very serious cases. Section 56A of the UK Borders Act 2007 provides that a person must declare all their criminal convictions in their dealings with the Home Office, regardless of whether or not they are spent. Without a comprehensive database of criminal convictions, it would be impossible for the immigration authorities to ascertain whether, for example, an applicant for leave to remain had complied with that requirement.

There are numerous examples where security, vetting and licensing are required which depend on access to a comprehensive database of criminal records. Simply by way of example, as Mr Prince explains:

“The UK is aligning with EU Regulation 2019/103 which requires all airport and air crew identity card holders to go through an ongoing review of their criminal record checks. The UK Government will carry out this ongoing review at least once every twelve months, using data from the PNC. …. The Civil Aviation Authority (“CAA”) accesses PNC data to identify those who have been convicted of a disqualifying offence and can remove individual’s passes where necessary, helping to reduce the risk of insider threat. ”

Similarly, Criminal Record information is considered in all applications for national security vetting. As Mr Prince explains:

“A criminal record is not necessarily a bar to security clearance, but a decision maker will need to consider both spent and unspent convictions to consider whether any conviction is relevant to their assessment of suitability… Failure to declare convictions may be taken as evidence of dishonesty and unreliability and may affect the granting of a security clearance.”

Ms Monaghan does not suggest that these are not legitimate objectives. Nonetheless, she says that to maintain the record of her clients’ historic convictions is disproportionate. The fundamental difficulty with that argument is that the PNC’s utility comes from its comprehensive nature. It is because, within its scope, the record is complete and permits no exceptions that it is so valuable. If the complaint was that the particular offences of which the Claimants were convicted ought not to be included in the Schedule to the Recordable Offences Regulations, then the decision to include

Ms Monaghan relies on two cases, both of which were heard in the Supreme Court and in Strasbourg, Catt and Gaughran v Chief Constable of the Police Service of Northern Ireland [2015] UKSC 29; Gaughran v United Kingdom (App. No. 45245/15). In our judgment, neither of these cases assists the Claimants.

As noted above, Catt concerned the retention of records that an individual had attended protests; it says nothing about records of convictions. The Supreme Court found for the appellant, ACPO, holding that the retention of data recording information relating to attendees of political protest meetings served a proper policing purpose; that the fact that some of the information recorded in the database related to attendees who had not committed and were not likely to commit offences did not make it irrelevant for legitimate policing purposes but rather could be of importance not only for the prevention and detection of crime associated with public demonstrations, but to enable the great majority of public demonstrations which were peaceful and lawful to take place without incident and without an overbearing police presence; and that, accordingly, the police had shown that the retention of data in nominal records of other persons about the claimant’s participation in demonstrations, albeit amounting to a minor interference with his right to private life, was justified under Article 8.2 by the legitimate requirements of police intelligence-gathering in the interests of the maintenance of public order and the prevention of crime.

The ECtHR took a different view. At [111]-[115] the Court held that the determinative issue was whether the interference was “necessary in a democratic society”. Notwithstanding the respondent State’s margin of appreciation and the domestic Supreme Court judgment, there were compelling reasons to reassess the merits. First, personal data revealing political opinion fell among the special categories of sensitive data attracting a heightened level of protection under Article 8. Secondly, although the High Court’s finding that the collection and retention of the applicant’s data did not interfere with his Article 8 rights had not been upheld in the Court of Appeal and Supreme Court, nevertheless clarification was required, because the respondent State maintained arguments that the retention was not systematic, and the nature of the interference was limited. Thirdly, the respondent State’s powers were ambiguous and an examination of compliance with Article 8 principles was important where powers vested in a state were obscure, creating a risk of arbitrariness. Finally, the manner and timing of disclosure (notably that the police held more of the applicant’s data than was revealed during the domestic proceedings) impacted upon the evaluation of the available safeguards.

As Ms Monaghan concedes, the ECtHR placed particular weight on the fact that the data revealed a political opinion and so attracted a heightened level of protection (see [112]). That is not the position here. Of even greater significance was the fact that Mr Catt’s case did not concern retention of details of a conviction.

In the domestic courts, the Claimant in Gaughran challenged the Northern Irish policy of retaining indefinitely DNA profiles, fingerprints and photographs of all those convicted of recordable offences. He did not challenge the retention of the record of his conviction. Before the Supreme Court, Lord Clarke (with whom Lord Neuberger,

Baroness Hale and Lord Sumption agreed) considered the ECtHR decision in S and Marper v UK (2009) 48 EHRR 50. He pointed out, at [30], that “There is no indication that the Strasbourg court was considering the position of those who had been convicted at all.” He recognised (at [33]) that it did “not follow from the fact that the ECtHR was only considering unconvicted persons that the system in Northern Ireland (and the United Kingdom) is justified under article 8.2.” But he concluded at [40] that:

“the benefits to the public of retaining the DNA profiles of those who are convicted are potentially very considerable and outweigh the infringement of the right of the person concerned under article 8.”

When the case got to Strasbourg, the ECtHR found for the applicant. The court emphasised, at [81], the particularly intrusive nature of biometric data, noting that “retaining genetic data after the death of the data subject continues to impact on individuals biologically related to the data subject”. The court held (at [84]) that the United Kingdom was one of the few Council of Europe jurisdictions to permit indefinite retention of DNA profiles, fingerprints and photographs of convicted persons. “The degree of consensus existing amongst Contracting States has narrowed the margin of appreciation available to the respondent State in particular in respect of the retention of DNA profiles for the reasons set out above”. The court concluded (at [96]) that:

“the indiscriminate nature of the powers of retention of the DNA profile, fingerprints and photograph of the applicant as person convicted of an offence, even if spent, without reference to the seriousness of the offence or the need for indefinite retention and in the absence of any real possibility of review, failed to strike a fair balance between the competing public and private interests. The Court recalls its finding that the State retained a slightly wider margin of appreciation in respect of the retention of fingerprints and photographs. However, that widened margin is not sufficient for it to conclude that the retention of such data could be proportionate in the circumstances, which include the lack of any relevant safeguards including the absence of any real review”

Critical to the Court’s analysis was the particular nature of the material being retained and the evidence of much less intrusive retention policies elsewhere in Europe. Recording the fact of a conviction involves no intrusive biometric data and there is no evidence before this court that other members of the Council of Europe have adopted significantly different policies. It is of note in that context that Article 10 of EU Regulation 2016/679 (the General Data Protection Regulations) provides that “Any comprehensive register of criminal convictions shall be kept only under the control of official authority”, implicitly acknowledging that it is acceptable for state party to maintain a comprehensive register of criminal convictions.

Retention of a conviction record is different in kind, not merely in degree of intrusion, from the retention of other kinds of data. While some conviction records may be more stigmatising than some non-conviction data because of the nature of the offence in question, it remains the case that a conviction record is the proof of a finding of guilt by an independent court, usually in public proceedings. That conviction could be appealed. By contrast, for example, police intelligence or biometric data is not the product of a court’s judgment and is not susceptible to appeal.

There are many circumstances described in the Defendants’ evidence where, in our judgment, government agencies have a genuine and pressing need to access a comprehensive record of criminal convictions. In our view, the objective of the 100year rule, namely to maintain a comprehensive record of convictions, is sufficiently important to the criminal justice system alone to justify interference with the Claimants’ Article 8 rights. When taking into account, in addition, the importance of the PNC to all the other public services referred to above, the case for the maintenance of the rule is very powerful. The possibility that those records were incomplete would to a significant extent undermine that value. The removal of even a single recordable offence would mean that the PNC could not be relied upon as containing a complete record of any individual’s convictions.

The decision in Humberside, and theevidence of Mr Dyson and Mr Prince, make it clear it is the completeness of the PNC record that gives it its value for policing purposes, since it enables patterns of behaviour to be established and individuals to be located at certain times. In the criminal justice system, a full record of an individual’s convictions is required in order to ensure that fair and lawful decisions are made about prosecution, bail, character, sentencing and probation. As regards safeguarding, it is essential that the state has access to a complete record of an individual’s convictions for the purposes of firearms, explosives and poisons licensing; for the purposes of applications to offices of utmost integrity, such as the police and the judiciary; and for the purposes of applications to positions requiring an enhanced criminal record certificate, such as involving working with children or vulnerable adults.

The 100-year rule is rationally connected to that objective, in that it ensures the record subsists for the entirety of the Claimants’ lives and the lives of all those convicted of offences caught by the rule. No less intrusive measure could have been used without unacceptably compromising the achievement of the objective, because any less intrusive measure would have meant the record was not comprehensive.

The essence of Ms Monaghan’s argument is that the Defendants’ response to her complaints fails at the fourth stage of Lord Reed’s test. She argues that the severity of the 100-year rule’s effects on the Claimants outweighs the importance of the maintaining a comprehensive record of convictions.

It is necessary, first, to consider the impact of the interference with the Claimants’ Article 8 rights. We accept without hesitation that all three Claimants are greatly disturbed by the knowledge that their convictions under the 1959 Act continue to be recorded when they have all been of good character for decades. We accept that the

However, as Ms Gallafent submits, the engagement of Article 8 must be seen in its proper context. First, convictions are imposed in open court and there can be no expectation of privacy at the time. As was held by Lord Wilson in T (at [16-18]) a conviction may eventually become a part of a person’s private life after the passage of sufficient time, but that initial public context remains relevant to the degree of interference retention poses. Second, the interference occasioned by bare retention of data is modest and is readily justified by the need to avoid an “incomplete and potentially misleading record” (see R (C & J) v Commissioner of Police of the Metropolis [2012] 12 EWHC 1681 (Admin) at [61] per Richards LJ). Third, a “relativist approach” applies: the less intrusive the interference, the less precise and specific the law is required to be to justify it: Bridges at [82-83]. Fourth, the Secretary of State and the NPCC have a margin of judgment within which the courts will not interfere: Re Gallagher at [46] and [60-61] per Lord Sumption.

The PNC data retention policy applies a “bright line rule” by which all convictions are retained for 100 years; and it does not take account of the Claimants’ individual circumstances. It is not the proportionality of the interference with the Claimants’ rights in particular that falls to be judged, but the proportionality of the measure as a whole. If there is to be a challenge to that structure it has to be one of principle, not one which depends on individual circumstances. As Carnwath LJ put it at [98] in Humberside:

“The purpose of maintaining a complete record of convictions is not negated by showing in an individual case that one or more particular pieces of information is of no identifiable utility.”

To similar effect, in R (RD) v Secretary of State for Justice [2020] EWCA Civ 1346;

Standing back from the individual considerations, it is in our judgment clear that the public interest in the maintenance of a comprehensive record of convictions far outweighs the personal interest of the Claimants in deleting from the PNC records the fact of their past convictions which, now that their challenge to the multiple convictions rule has been upheld, are no longer liable to disclosure save within the criminal justice system and for the other limited purposes we have discussed earlier. We cannot accept the argument that this remaining interference is disproportionate.

In any event, as Ms Gallafent submits, it is entirely unclear how any decision-maker conducting a review of the sort for which the Claimants contend would be able to assess a claimant’s assertions about the inequity of maintaining a record of their convictions, set against the fact of a number of convictions, each for a summary offence and recorded decades ago. The police could not conduct a mini-trial and seek to replicate the role of the court (nor, we would add, of the Criminal Cases Review Commission): see R (AR) v Chief Constable of Greater Manchester Police [2018] UKSC 47; [2018] 1 WLR 4079 at [68] per Lord Carnwath.

We therefore conclude that the challenge to the 100-year rule fails. This makes it unnecessary to address the First Defendant’s alternative argument that s. 6 of the HRA provides them with a complete defence. We dismiss this application for judicial review.