England and Wales Court of Appeal (Civil Division) Decisions

You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> YZ v Chief Constable of South Wales Police [2022] EWCA Civ 683 (19 May 2022)
URL: http://www.bailii.org/ew/cases/EWCA/Civ/2022/683.html
Cite as: [2022] EWCA Civ 683

[New search] [Printable PDF version] [Help]

		Neutral Citation Number: [2022] EWCA Civ 683
		Case No: CA-2021-001412

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT IN CARDIFF
HIS HONOUR JUDGE JARMAN QC
(SITTING AS A JUDGE OF THE HIGH COURT)
[2021] EWHC 1060 (Admin)

Royal Courts of Justice
Strand, London, WC2A 2LL

19/05/2022

B e f o r e :

LORD JUSTICE PETER JACKSON
LADY JUSTICE SIMLER
and
LADY JUSTICE ANDREWS
____________________

Between:

	YZ	Claimant/Appellant
	- and -
	THE CHIEF CONSTABLE OF SOUTH WALES POLICE	Defendant/Respondent
	- and -
	THE NATIONAL POLICE CHIEFS' COUNCIL	Intervener

____________________

Ramby de Mello and Daniel Bazini (instructed by Instalaw Ltd) for the Appellant
Alan Payne QC and Amy Clarke (instructed by Special Legal Casework Department, South Wales Police) for the Respondent
Jason Beer QC and Robert Talalay (instructed by Directorate of Legal Services, Metropolitan Police Service) for the Intervener
Hearing date: 4 May 2022
____________________

HTML VERSION OF APPROVED JUDGMENT
____________________

This judgment was handed down by the Judge remotely by circulation to the parties' representatives by email and release to The National Archives. The date and time for hand-down is deemed to be 10:30am on Thursday 19th May 2022.

Lady Justice Andrews:

INTRODUCTION

This is an appeal against the decision of HH Judge Jarman QC (sitting as a Judge of the High Court) ("the Judge") made in a judgment handed down on 30 April 2021, [2021] EWHC 1060 (Admin), dismissing a claim for judicial review. For reasons which will become apparent, an order was made by the Judge pursuant to CPR 39.2(4) preventing the identification of the Appellant or any details leading to his identification in any report of the proceedings or of the judgment of the court below. At the start of the hearing of this appeal, a similar order was made in respect of the appeal and the judgments of this court. Accordingly I shall refer to the Appellant as "YZ".

The claim for judicial review which gave rise to the decision under appeal began as a challenge to the lawfulness of the Respondent's decision to refuse to delete from records on the police national computer ("PNC") data pertaining to YZ's acquittal of serious criminal offences. As I will explain, the target of the challenge (and the grounds) expanded in a less than satisfactory manner as the claim progressed.

Before us, Mr de Mello, on behalf of YZ, confirmed that what his client now seeks (and sought at the hearing below) is the erasure from all police records, national and local, of all personal and sensitive data (including information provided to the police from other agencies), even if it is plainly of relevance to risks that he might pose to others. He wishes to be put in the same position as any member of the public who had never been of interest to the police: or, to use the vernacular, to have a "clean sheet".

That is an ambitious target, all the more so because YZ has never asked the Respondent to delete any data other than those specifically pertaining to his acquittal (which, by necessary implication, includes the nature and details of the offences with which he was charged). Therefore, as Mr Payne QC pointed out on behalf of the Respondent, there has never been a specific decision refusing to delete the further data from all police records, which could be made the target of a claim for judicial review. Whilst he accepted that in theory a claim could be brought for judicial review of the continued retention of such data without such a request having been made, Mr Payne submitted that such a claim would necessarily involve a challenge to the lawfulness of the policies applied to their retention, rather than to any individual decision or the reasons for it, and that is not the way in which the claim has been framed.

As Mr de Mello expressly confirmed, there is no challenge to the lawfulness of the policy applicable to requests for the deletion of records on the PNC, which is a national policy reflected in guidance published by the National Police Chiefs' Council ("NPCC") and which was applied by the decision-makers in making the impugned decisions ("the Guidance"). Instead, Mr de Mello put the Appellant's case on the basis that the obligations on a controller of data are set out in the Data Protection Act 2018 ("DPA") and if, as he contends, the Guidance (or an aspect of it) has not kept pace with the legislation, "it is the latter that steers the analysis and the result."

The Guidance applies only to data held on the three national police systems, the PNC, the National DNA database (NDNAD) and the National Fingerprints Database (IDENT1). Its stated purpose is to ensure that a consistent approach is taken by specified Chief Officers of Police (who are the controllers of the data for the purposes of the DPA) in relation to dealing with applications for the deletion of records from those three databases.

Whilst the information held on the PNC is relatively limited, it may be duplicated on local records, which may also contain other intelligence gathered by the police about the individual concerned. These records include Niche RMS, which is an operational police records management system. The digitised version is used to store scanned copies of legacy paper crime files held by the local police force. The records also include the CATS (legacy Domestic Abuse and Child Abuse Case Administration Tracking System). Records held locally by Chief Officers, whether stored on electronic document management systems or on paper, are managed in accordance with the Authorised Professional Practice on Management of Police Information published by the College of Policing ("MoPI APP"). There is no challenge by YZ to the lawfulness of the policy reflected in the MoPI APP. Nor is that policy said to be unfair.

In consequence of the fact that neither of the applicable policies has been challenged, neither the Judge nor this court had the advantage of seeing the type of evidence that was adduced in R(QSA and others) v NPCC [2021] EWHC 272 (Admin), [2021] 1 WLR 2962, in which the Divisional Court rejected a challenge to the lawfulness of an aspect of the Guidance relating to the long-term retention of data about a subject's criminal convictions. We did, however, have the benefit of helpful written and oral submissions from Mr Beer QC and Mr Talalay on behalf of the NPCC, which obtained permission to intervene in the appeal. The Judge did not have the same benefit, because the NPCC only found out about the claim after his judgment was handed down.

It follows that, when considering the grounds of appeal, the Court must proceed upon the assumption that the relevant policy applied by the decision maker(s) is lawful and compatible with Art 8 ECHR. This fatally undermines YZ's challenge to the retention of all the data about him on local police records, including "sensitive data", because it was and is retained in accordance with a lawful policy. This point was made in the Respondent's notice, and Mr de Mello had no answer to it.

Strictly speaking, that makes it unnecessary to address the arguments raised by YZ in respect of data held on local police records, other than data duplicating the data on the PNC which was the specific subject of the request for deletion. Nevertheless, in this judgment I have taken into consideration and addressed all the submissions made on behalf of YZ in respect of all the data, wherever held. For the reasons set out below, I have reached the conclusion that this appeal should be dismissed.

THE GUIDANCE

There have been several versions of the Guidance since it was first published in March 2015. It was specifically amended and updated in June 2018 following the coming into force of the DPA. The most recent version of the Guidance was published in 2019. We were told by Mr Beer on instructions that a review of that version is currently being undertaken. There are no material differences between the versions which were in force at the time of the impugned decisions.

A PNC record will contain information about non-conviction outcomes, which are referred to in the Guidance as an individual's "Event History". Such outcomes specifically include acquittals and verdicts of "Not Guilty" on the direction of the judge. Para 1.5.5 of the Guidance provides that:

"under this Guidance, PNC records are required to be retained until a person is deemed to have reached 100 years of age. However, Chief Officers can exercise their discretion, in exceptional circumstances, to delete records for which they are responsible, specifically those relating to non-court disposals… as well as any "Event History" owned by them on the PNC, but only where the grounds for so doing have been examined and agreed."

The Guidance encourages individuals seeking the deletion of an "Event History" from the PNC to complete a formal application and state the grounds for having their records deleted. Paragraph 5.3.3 of the Guidance states that the submission of a record deletion application to a police force should also be treated as a MoPI review, prompting forces to review all the information that they hold.

Paragraph 5.3.4 refers to examples of the grounds that Chief Officers are obliged to consider which are set out in Annex B to the Guidance, describing the list as "indicative but not prescriptive". It states that the Chief Officer must exercise professional judgment in deciding whether the early deletion of the data is reasonable, based on "all the information that is available to them". Paragraph 5.3.5 makes it clear that the review is not confined to the grounds specifically identified by the applicant. If those grounds are considered to be insufficiently evidenced, it is best practice to consider whether any other grounds are applicable. Paragraph 5.3.7 states that, whilst providing supporting information and circumstances surrounding the event sought for deletion is not a legal requirement, individuals are advised that providing such detail will enable a more thorough review to be carried out by the Chief Officer.

Importantly, paragraph 6.2.1 of the Guidance explains that:

"Acquittal at court… is not in itself grounds for record deletion… Insufficient evidence to convict does not necessarily mean that there is sufficient evidence for an individual to be eliminated as a suspect."

Paragraph 6.2.2 states that if an individual applies for the removal of a record in relation to a "not Guilty" outcome at Court they are encouraged to clearly "evidence" one of the grounds detailed in Annex B.

One of those grounds is "no crime", an expression which at first sight might appear apt to cover an acquittal after a full trial. However, the apparent inconsistency with paragraph 6.2.1 is clarified by the explanation in Annex B that this category is intended to cover the type of situation in which, for example, a person is charged with murder, only for it to be established that the victim died of natural causes. The notes make it clear that being acquitted or found "Not Guilty" does not automatically mean that no crime was committed, as the CPS would have felt that there was enough evidence in the first instance to bring charges.

Paragraph 6.4 of the Guidance goes on to explain that because the Guidance is based on, though not limited to, a Chief Officer having substantial evidence that someone has been eliminated as a suspect, there is a general requirement for positive evidence to support his or her decision to delete relevant records. Thus, for example, the withdrawal of an allegation by the alleged victim, or their unwillingness to support a prosecution, will not generally suffice, unless the allegation is malicious or false.

In short, as Males LJ put it in R(RD) v Secretary of State for Justice [2021] 1 WLR 262 at [32]:

"Chief officers have a discretion to delete records, but it appears that this is only expected to be exercised in exceptional circumstances – in practice, where the record is inaccurate or where there is some wider public interest involved."

THE MoPI APP

The MoPI APP states that one of its key objectives is to ensure compliance with the DPA. Under the heading "Retention Review and Disposal" the guidance explains that "the primary purpose of review retention and disposal procedures is to protect the public and help manage the risks posed by known offenders and other potentially dangerous people". It further states that "retaining information relating to criminal activity and known and suspected offenders allows the police service to develop a proactive approach to policing. It assists forces to prevent and detect crime and protect the public."

The MoPI APP then summarises the "National Retention Assessment Criteria" ("NRAC") which are objective criteria applied to deciding whether to retain information on police records. Among the key points identified are that the infringement of an individual's privacy caused by retaining their personal information must satisfy the proportionality test; and that the objective of the retention of records which are necessary for policing purposes for a minimum of 6 years is to help to ensure that forces have sufficient information to identify offending patterns over time and to help guard against individuals' efforts to avoid detection for lengthy periods.

The NRAC poses a series of questions focused on known risk factors in an effort to draw reasonable conclusions about the risk of harm presented by individuals. These questions include the following:

"Is there evidence of a capacity to inflict serious harm?

Are there any concerns in relation to children or vulnerable adults?

Is there evidence of established links or associations which might increase the risk of harm?

Are there concerns that an individual's mental state might exacerbate risk?"

If a positive answer is given to any of those questions, the information about the individual should be retained and reviewed periodically to ensure that it remains adequate and up-to-date, and that the identified risks are still relevant.

There will be an initial review of police information in accordance with the NRAC principles at the time of data input. Where the NRAC criteria are met, retention of the police information is considered to be proportionate to the level and type of risk posed. The interests of the public outweigh the interference with the rights of the individual. In practical terms that means there is a presumption in favour of retention of the data unless and until its deletion is demonstrably justified in the wider public interest.

The approach to the period of data retention is addressed by reference to different categories of offence. Category 1 is the most serious, and where the NRAC criteria are met in relation to a Category 1 offence, as they were here, the retention period for police information (which can include intelligence of any grading) is until the subject is 100 years old. This is subject to review every 10 years.

THE RELEVANT LEGAL OBLIGATIONS

There was no dispute about the relevant legal requirements. The statutory authority for the police to retain data relating to a person's record of convictions, cautions, reprimands and other matters forming their criminal record is provided for in s.27 of the Police and Criminal Evidence Act 1984 and regulations made thereunder, currently the National Police Records (Recordable Offences) Regulations 2000.

The processing of personal data for law enforcement purposes is governed by part 3 of the DPA. "Law enforcement purposes" is defined by s.31 of the DPA as "the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and prevention of threats to public security." [Emphasis added].

S.34 of the DPA requires law enforcement processing to comply with the six data protection principles set out in Chapter 2. The onus rests on the data controller to ensure compliance. It is unnecessary to set out all six of those principles in this judgment. The principle which was most strongly relied on by Mr de Mello is the first, which is that the processing of personal data for law enforcement purposes must be lawful and fair. Mr de Mello concentrated his oral submissions on the requirement of fairness.

In the absence of the consent of the data subject, in order to be lawful the processing must be "necessary for the performance of the task carried out for that purpose by a competent authority". If the data is "sensitive", as defined in s.35(8), (e.g. data pertaining to an individual's religious or political beliefs, racial or ethnic origin, or their health) the processing must meet the conditions set out in schedule 8, namely, it must be "strictly necessary" for certain specified reasons. These include reasons of substantial public interest, and certain safeguarding reasons for children and individuals at risk.

The data controller is obliged to satisfy themselves of the "strict necessity" of retaining the information, but on judicial review of a decision that it is strictly necessary, the court must decide for itself whether it is strictly necessary. The test is not one of rationality or Wednesbury reasonableness because the question admits of only one correct answer.

Retention must not only be necessary, but proportionate: there is no material difference in this regard between what is required by ss 35 and 39 of the DPA and Art 8 ECHR. The European and domestic case law establishes that in principle, the more serious the interference with an individual's rights, the greater the justification for that interference must be. Retention of data is self-evidently far less intrusive than data sharing or publication, though it must be recognised that information retained on local records may be shared with other police forces or indeed with other agencies in due course. However, that will require a further evaluation to be carried out of the necessity and proportionality of the processing of the data at that time.

HISTORY OF THE CLAIM

The factual background is set out in detail in the judgment below. The following summary will suffice for the purposes of this appeal.

In 2012, YZ was tried and unanimously acquitted by the jury of three counts of rape. Rape is a Category 1 offence. The complainant was his former wife, and the offences were alleged to have been committed while the couple were still married. YZ subsequently discovered that a record of the charges, and of his acquittal, in these terms: "Not Guilty – Discharged", had been retained on the PNC. On 13 March 2018, YZ applied for the record to be deleted, as well as for the deletion of his DNA profile and fingerprints which were taken at the time of his arrest. He filled in an NPCC form which, under the heading "Grounds for Record Deletion", stated that:

"The guidance issued in respect of the Record Deletion Process sets out the grounds under which an application should be considered. Please identify the reason(s) below for which [sic] you consider to be the grounds on which you make this application."

The form set out a number of grounds, against each of which there is a box to be ticked. These reflected the grounds set out in Annex B to the Guidance. There was no box on the form specifically relating to acquittal following a criminal trial. This is hardly surprising, as the Guidance makes it clear that acquittal in and of itself is not a sufficient ground for deleting the data. The specified grounds included such matters as "proven alibi", "mistaken identity" "no crime" and, relevantly, "malicious/false allegation" which was explained in these terms:

"Where you have been arrested and charged, but the case has been withdrawn at any stage, and there is corroborative evidence that the case was based on a malicious or false allegation."

YZ ticked that box. He also ticked the box next to the ground "unlawfully taken" (which, as the explanatory notes made clear, solely related to the taking of his biometric data). He did not tick the box next to "no crime". In a space for details to be provided of "event leading to arrest or issuing of a PND (if known)" he wrote the following:

"I was framed by the police. There was no case to answer yet the individuals with police uniform since I belong to the ethnic minority they abhor. The most used me as funnel to vent their hatred (sic). I was on remand for 6 months. I was tried and found not guilty via unanimous decision for allegedly allegations of marital rape. Please delete all records on me photos DNA fingerprints, data. I don't trust the police anymore. They could frame me in the future lock me up for the rest of my life for things I've never committed."

On 16 March 2018, someone from the Association of Chief Police Officers Criminal Records Office ("ACRO") sent an email to YZ thanking him for his application, and explaining why they were unable to process it at that time. She stated that it was a requirement of the record deletion process that all applicants must explain the background to their arrest and the reason why their records should be deleted, which should address the grounds selected for record deletion. She explained that:

"this element of the application process is important because without an applicant's version of events there is nothing to be verified against the records held locally by the reviewing police force. This process does not operate on the basis of us contacting the force for them to tell us what they hold, I'm afraid – it is for the applicants to put forward their case for record deletion in the first instance as without this, there is nothing for police forces to counterbalance what is recorded on their local systems".

She then drew specific attention to relevant extracts from the Guidance, explaining that "providing as much information as possible in support of your application will assist the Chief Officer in their decision making process." YZ's response, on 22 March 2018, was to attach to an email a further copy of the form he had already sent. He stated in the covering email that everything he had already noted down was clear. He told ACRO to "please feel free to put my application under the category that makes you satisfied" and repeated his allegations that the police officers involved were motivated by "immense and boundless hatred towards persons of my colour and faith". He stated:

"My demand is very simple I want all my details held by the police deleted.

I have zero convictions it's my right to have them deleted."

ACRO then forwarded the request for deletion to South Wales Police, explaining that the applicant had provided a "limited overview of what happened" but "despite the limited information, we hope that this is enough for you to conduct a review and for a decision to be made on whether to retain or delete the records."

The records were reviewed, and the application was refused by the South Wales Police Record Deletion Panel ("the Panel") which took the decision on behalf of the Respondent. A draft of the refusal letter was sent to ACRO before it was finalised. The letter, which was sent to YZ on 16 May 2018, confirmed that his DNA and fingerprints had been automatically deleted prior to receipt of his application, in accordance with the provisions of the Protection of Freedoms Act 2012. That meant that the only matter remaining in issue at that stage was the retention of the data on the PNC pertaining to the rape charges and YZ's acquittal.

The following explanation was given for refusing the request for deletion:

"[YZ] was arrested lawfully in March 2012 for the offence of Rape. His fingerprints and DNA samples were taken in compliance with the Police and Criminal Evidence Act.

[YZ] was charged in court and found not guilty however there is no evidence to suggest that the case was based on a malicious or false allegation.

Therefore, South Wales Police do not agree that the grounds of "unlawfully taken" and "no crime" are met. The PNC record will be retained."

This demonstrates that, in accordance with what the Guidance describes as "best practice", the Panel considered the ground of "no crime" even though YZ did not tick the box to indicate that he was relying on it.

After the response refusing the request was sent to YZ, there was a hiatus of some 18 months, before a letter before action was sent by his solicitors on 3 October 2019. That letter articulated YZ's concern that information pertaining to his acquittal remained on his police file. It provided information that had not been previously mentioned, including that following his acquittal the complainant had been arrested and charged with perjury, but that the charges against her had been dropped. It also made reference to YZ's mental health, and the deleterious impact that the decision to retain the information was having upon him.

There is an informal internal appeals process provided for under the Guidance, and once this was made known to YZ's solicitors, they asked that the letter before action be treated as a request to appeal against the original decision. Although the request was made long after the 3 months envisaged in the Guidance, that request was acceded to. By then, a claim for judicial review of "the failure to delete the details of [YZ]'s acquittal of rape which is held [on the PNC]" had already been issued, but it was stayed pending the appeal.

On consideration of the appeal, the Information Sharing Agreements and Records Management Officer for South Wales Police, Mark Russell, decided to uphold the Panel's refusal. His decision was communicated to YZ's solicitors by a letter dated 3 June 2020. The judicial review proceedings were then reinstated as a challenge to Mr Russell's decision and to the Panel's initial rejection of the request for deletion. Permission to proceed was granted by Holman J on 21 July 2020. He suggested that YZ should focus on his best point; unfortunately, that advice was not heeded. Permission to rely upon further grounds under Art 8 ECHR was granted by Cheema-Grubb J on 1 July 2020. However the Art 8 challenge added nothing, as it is predicated upon the same arguments advanced in relation to the challenge under the DPA.

Prior to the hearing of the claim for judicial review, YZ successfully applied to add what were inaccurately described as "additional grounds" to his claim, arising from information in Mr Russell's first witness statement, dated 21 August 2020. The statement set out, for the first time, Mr Russell's reasons for refusing the appeal and the information that he took into account when reviewing the Panel's decision. This revealed to YZ the nature and extent of other data about him which was held by the police in the local records.

Mr Russell's evidence, and the detail of the information about YZ held by the police to which he referred when making his decision, is addressed by the Judge at [14] to [20] of his judgment. In summary, that information revealed a significant history of allegations of domestic abuse; YZ's former wife and their child were still regarded as being at risk, although concerns that the child might be abducted appeared to have abated to some extent, as no specific concerns were expressed when it emerged that YZ had become aware of the address to which mother and child had moved. Moreover, there was intelligence (including information emanating from sources other than YZ's former wife and members of her family) relating to YZ's extremist beliefs and associations, and his mental health, that gave rise to wider concerns about the risk he posed to them and to others. On the basis of the information held by the police, not just one but all four of the questions from the NRAC that I have identified in paragraph 21 above would have received a positive answer.

Mr Russell made it clear that he was using the entirety of the information on police records to make an informed evaluation of whether the deletion of the data relating to the rape charges (both from the PNC and local records) was justified in the wider public interest. He was not considering, nor was he required to consider, whether all the other data about YZ should be deleted.

Mr Russell took into account the fact that YZ's former wife had been charged with perjury (though the charges were dropped) and an email that YZ alleged he had received from her, which lent some support to his contention that her allegations of rape were deliberate lies. However, in the light of the fact that the police had investigated the email and had been unable to determine whether it was in fact sent by her, he took the view that it did not provide substantial evidence that the allegations were malicious or false. His conclusion was that:

"when [the data on the PNC] was considered in relation to other occurrences on YZ's record, it was decided that it would not be in the public interest to dispose of the offence at this time. Whilst YZ was discharged in the rape case, it forms part of a pattern of allegations against him."

He also repeated the important point made in the Guidance, that an acquittal means no more than that the jury were not satisfied that the case had been proved to the criminal standard. Even in a case turning on one person's word against another's, an acquittal does not establish that the jury must have disbelieved the complainant.

An application to further amend the grounds for judicial review was made in a notice issued on 25 November 2020. Unfortunately the application (which was opposed) was not put before the Judge to deal with until February 2021, because it was overlooked in the process of transferring the case from London to Cardiff. On 2 March 2021 he made an Order granting permission. The "additional grounds" were expressed as follows:

"The decision to process, retain and not erase [YZ's] sensitive personal data (including that he expressed extreme views – and was mentally ill i.e. Events History) is not lawful under the Data Protection Act 2018, and second the decision is also incompatible with Article 8 ECHR and/or unreasonable."

As Mr Payne pointed out, this is neither a challenge to the original decision refusing the application for deletion of the records relating to YZ's acquittal, nor to Mr Russell's decision taken on appeal. It is a completely new claim for judicial review. It is muddled because the "Events History" is the data relating to the rape charges and the acquittal kept on the PNC, which does not include the sensitive data about his views and his health which was retained on local records. It is also factually inaccurate, because there was and is no extant "decision" relating to the other personal data, as no request has ever been made to the police to delete it.

The claim for judicial review was listed for hearing on 19 March 2021. Shortly before this, the Respondent sought an adjournment, because it was then considered that there was insufficient time to respond to the expanded challenge to the retention of all personal data concerning YZ on all police records. The Judge refused the adjournment. Instead, he heard Mr de Mello's submissions on all the grounds, but granted permission to the Respondent to put in written submissions in response (though we were told that he set no time limit for doing so).

On 30 April 2021, the Judge handed down judgment. By then, he had received no submissions from the Respondent in opposition to the "amended grounds". However, as Mr Payne realistically accepted, there was not much more that the Respondent could have said than it had already said in written submissions lodged in opposition to the application to add those grounds; namely, that there was no challenge to the policy in the MoPI APP, and that contrary to the factual premise underlying the expanded grounds, no decision had ever been made to retain that data. It was retained in accordance with the application of a lawful policy. In any event, no prejudice was suffered by the Respondent, since the claim was dismissed in its entirety.

THE JUDGMENT

The Judge began his consideration of the grounds of judicial review at [40], where he noted that Mr de Mello had adopted a more focussed approach in his oral submissions. He dealt first with the submission that the Guidance was not compatible with the first data protection principle because it put the onus on the applicant for deletion to give reasons for the deletion. Having found at [42] that Mr Russell had express regard to the DPA 2018 when making his decision, the Judge rejected that submission at [43] to [45].

He held that the encouragement of individuals to give reasons why records should be deleted from the PNC does not detract from the first data protection principle, pointing out that an individual may be able to put forward reasons, previously unknown to the controller, which make it unlawful or unfair to retain the data for law enforcement purposes. He then said, at [44]:

"The requirement in the guidance for positive evidence must be read in the context that the elimination of an individual as a suspect, the withdrawal of an allegation, or a case not proceeded with because of a technical legal argument, does not itself mean that there is sufficient evidence to provide a basis for the deletion of their PNC record. In my judgment this does not put the onus of proof on the applicant. It means that something more may be required than such elimination or withdrawal."

After addressing an argument made by Mr de Mello about the presumption of innocence, the Judge made the following salient observations at [49]:

" .. what is being considered in deciding whether or not to delete his data from the PNC is the issue of law enforcement and the safeguarding of individuals and in particular the welfare of the claimant's former wife and the child of the relationship. It is no part of the latter process to suggest that the claimant should have been convicted. Rather, it is a question of taking the allegations into account with other information and deciding whether retention is necessary."

The Judge then turned to consider a submission made by Mr de Mello about the processing of sensitive data at [50]. It appears from this passage in the judgment that both Mr de Mello and the Judge were labouring under the misapprehension that data about YZ's racial or ethnic origins, political opinions, religious beliefs and mental health was retained on the PNC records (as opposed to the local records) and therefore that the applicable policy was the Guidance, rather than the MoPI APP.

At [50] the Judge accepted that the processing of sensitive data must be strictly necessary for law enforcement purposes, and must meet at least one of the conditions in Schedule 8, and that at the time of processing there must be an appropriate policy document in place. He then said this at [51]:

"In my judgment, the processing of all the information on the claimant's PNC record is strictly necessary for law enforcement, for the safeguarding of the child of the relationship and/or his former wife, and the guidance does amount to a policy within the meaning of that subsection. The information, taken as a whole, deals with the risk which the claimant poses to his former wife and child, in particular. The information relating to the claimant's religious or political views goes further than recording such views because it includes concerns of extremism, which impacts upon the safeguarding concerns. So too does information regarding the claimant's mental health. The decision to retain it is rational and fair in my judgment."

Finally, the Judge considered, and dismissed, a challenge to the decision to retain the information until YZ was deemed to be 100 years old. He concluded at [56] that "the challenged decision complies with the requirements of the DPA 2018". He then dealt briefly with the Article 8 challenge, concluding at [58] that the interference with the rights of the individual was in accordance with the law and in the interest of the prevention of crime or the protection of the rights of others, namely YZ's child and/or his former wife.

THE APPEAL

On 16 February 2022, William Davis LJ gave permission to appeal against the Judge's decision on four related and, to an extent, overlapping grounds, namely that:

(1) The Respondent wrongly placed the burden on YZ to show why his personal data should not be retained, whereas s.34(3) of the DPA places the burden on the data controller to demonstrate compliance with the Act. The Judge erred in law in holding that in the impugned decision(s) the onus had not been placed on YZ to justify the deletion of the data;

(2) The Judge applied the wrong legal test at [51] of the judgment, namely, a test of rationality, instead of the test of " strict necessity" under the DPA, and found that the decision was "rational and fair" instead of asking whether it was lawful, fair and proportionate and carried out for a law enforcement purpose under ss 31, 35(1) and 35(2)(b) of the DPA;

(3) The Judge erred in holding that the processing of the information was based on law and was strictly necessary for law enforcement, for the safeguarding of YZ's former wife and/or the child of the relationship, and that the Guidance is a policy within the meaning of ss 35(2), 35(5)(c) and 42(1) of the DPA. He also erred in holding that the decision complied with the requirements of the DPA.

(4) The Judge erred in holding that there was no breach of Art 8 ECHR in retaining the personal data/deciding not to delete it in the interests of the prevention of crime or for the protection of the rights of others, namely YZ's child and/or his former wife.

On 2 March 2022 the Respondent filed a Respondent's Notice alleging that the Judge's decision to dismiss the claim should be upheld on further or alternative grounds, in the light of the fact that the decision(s) under challenge were made on the application of the relevant policy and there was no challenge to the lawfulness of the policy.

On 4 April 2022, William Davis LJ gave the NPCC permission to intervene and to make short written and oral submissions in support of the Respondent's resistance to the appeal.

On 12 April 2022 the Respondent sought (and was subsequently granted) permission to rely upon a further witness statement from Mr Russell dated 11 April 2022, which exhibited three documents which the Respondent had not previously disclosed due to human error, namely:

(1) An email dated 23 March 2018 from a data protection officer who was part of the Panel, recording her note of the decision to retain YZ's records and refuse the application for their deletion;

(2) A print of an electronic file note recording the Panel's decision on 12 April 2018;

(3) A document created by Mr Russell as part of his assessment and evaluation of the appeal.

However, those documents added nothing significant to the information in the evidence already before the court.