High Court of Justice in Northern Ireland King's Bench Division Decisions

Neutral Citation No:  [2023] NIKB 105     Judgment: approved by the court for handing down (subject to editorial corrections)*

Ref:              COL12031   ICOS No:       21/07689   Delivered:   27/10/2023

 

IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND

___________

 

KING’S BENCH DIVISION

(JUDICIAL REVIEW)

___________

 

IN THE MATTER OF AN APPLICATION BY JR195

FOR JUDICIAL REVIEW

 

AND IN THE MATTER OF A DECISION BY THE CHIEF CONSTABLE

OF THE PSNI

___________

 

Ms Fiona Doherty KC with Mr Seamus McIlroy (instructed by Finucane Toner Solicitors) on behalf of the Applicant

Dr Tony McGleenan KC with Ms Laura Curran (instructed by the Crown Solicitor’s Office) on behalf of the Respondent

___________

 

COLTON J

 

Introduction

 

[1]       At the outset I want to place on record my thanks to all the counsel who appeared in this difficult case for their written and oral submissions.

 

[2]       On Monday 5 July 2021 the applicant was arrested at his home address in Belfast pursuant to powers under section 41 of the Terrorism Act 2000.  His home and vehicle were searched.  He was arrested and transported in a police land rover to Musgrave PSNI station, where he was interviewed under caution in relation to an ongoing police investigation. 

 

[3]       At the time of the arrest and search the PSNI were accompanied by employees of BBC Studios Production Ltd (“the Production Company”) consisting of a cameraman and a producer. 

 

[4]       The arrest and search of the applicant’s house and car were recorded by the cameraman.  Footage of the applicant’s house was also taken by the cameraman but from outside the house.  The applicant was asked to consent to the cameraman entering the house and he refused.  The applicant asserts that the footage included part of the inside of his house, albeit that it was taken from a position outside.  At no stage did the applicant consent to any recording of him, his property or his family. 

 

[5]       The applicant was filmed as he was taken into a police land rover, where he was handcuffed by police officers.  He was filmed inside the land rover from the front passenger seat as the arresting officer spoke to him.  The camera operator stepped out of the land rover as the applicant was driven off to custody and was not filmed on the journey.

 

[6]       When the applicant arrived at Musgrave Street police station both he and his solicitor objected to ongoing filming.  Despite these objections footage was captured of the applicant from a communal corridor in a cell complex when he was coming out of the cell and being moved to and from an interview room on two separate occasions.  The interview was not filmed nor was he filmed from inside his cell. 

 

[7]       The applicant avers that no specific evidence was put to him in the course of the interview.  After interview the applicant was released unconditionally.

 

[8]       At this time, the Production Company were filming a documentary series in relation to the work of the Major Investigation Teams (“MIT”) of the PSNI.  The documentary was commissioned pursuant to an agreement entered into between it and the PSNI.  Under the agreement the series was expected to consist of three observational documentary programmes lasting 60 minutes each to be broadcast on Channel 4 in 2023.

 

The applicant’s challenge

 

[9]       By these proceedings the applicant challenges the actions of the PSNI in both providing his personal data to the production team and in facilitating the Production Company’s recording of the search, arrest and detention.  In the final amended version of the Order 53 Statement the grounds relied upon are as follows:

 

“[5]            …

 

(i)            Breach of statutory duty

 

(a)         …

 

(i) Part 3 of the Data Protection Act 2018/Article 5(i) of the General Data Protection Regulations (Regulation EU 2016/679) (“GDPR”) in that the respondent has breached the following requirements:

 

(a) failing to process his data lawfully and fairly under the first principle (s35(1) 2018 Act) by providing his data to the media and facilitating that access to the applicant;

 

(b) failing to process his data legitimately under the second principle (s36(1) 2018 Act) by sharing data originally collected for a particular investigation with the media without a legitimate aim;

 

(c) failing to process his data in a secure manner (s40 2018 Act) by sharing the data with a third party unlawfully;

 

(d) failing to ensure that his data is retained for no longer than is necessary for the purpose for which it is processed with appropriate periodic reviews (s39 2018 Act);

 

(e) failing to properly enter into a contract with a processor (s59(5)/(6) 2018 Act);

 

(f) failing to carry out a data protection impact assessment (s64 2018 Act).

 

(ii) In the alternative to (i) above, Part 2 of the Data Protection Act 2018/Article 5(1) GDPR in that the respondent has breached the following requirements:

 

(a) failing to process his data lawfully and fairly under the first principle (Article 5(1)(a) GDPR) by providing his data to the media and facilitating that access to him;

 

(b) failing to process his data legitimately under the second principle (Article 5(1)(b) GDPR) by sharing data originally collected for a particular police investigation with the media without a legitimate aim;

 

(c) failing to process his data in a limited manner to what was necessary under the third principle (Article 5(1)(c) GDPR) by sharing data originally collected and processed for a particular police investigation with the media unnecessarily; 

 

(d) failing to process his data in a secure manner (Article 5(1)(f) GDPR) by sharing the data with a third party unlawfully;

 

(e) failing to process his data for no longer than is necessary (Article 5(1)(e) GDPR) by sharing data with the media who intend to retain the data `in perpetuity’;

 

(f) failing to properly enter into a contract with a processor (Article 28 GDPR);

 

(g) failing to carry out a Data Protection Impact Assessment (Article 35 GDPR).

 

…

 

(v) Section 6 of the Human Rights Act 1998 and Article 8 of the ECHR.”

 

The documentary

 

[10]     Before analysing the grounds of challenge relied upon by the applicant it is necessary to set out some further factual background.  The court has received an affidavit from a former Detective Superintendent within the PSNI which explains the process by which the documentary project came about. 

 

[11]     At the relevant time he was the Head of Major Crime within the PSNI which involved the management of investigation teams who investigated homicides and other serious crimes.  He avers that the purpose behind the commissioning of the documentary was its potential to provide a solution to low levels of confidence in policing and community support for police operations arising from ill-informed public commentary regarding a number of difficult ongoing investigations. 

 

[12]     He considered that the documentary had the potential to provide the public with access to the workings of the PSNI’s Major Investigation Teams, which would allow members of the public to see how officers conducted investigations and understand their decision-making and use of resources.  His hope was that by doing so this would help the PSNI to secure the support and co-operation of the local community which he describes as fundamental to the PSNI successfully carrying out its policing functions.

 

[13]     He sought out a media partner for the project and identified the Production Company.  He met with the Executive Producer who had a special interest in policing.  The producer obtained funding for the project from Channel 4 which would be the ultimate broadcaster of the documentary series. 

 

[14]     Having entered into these discussions he was satisfied that BBC Studios and Channel 4 were suitable partners and that they were “aligned with my intentions for the documentary, which were to capture a responsible, interesting and, above all, accurate look `behind the scenes’ at the most challenging investigations conducted by PSNI.”

 

[15]     As a result he entered into an “Access Agreement” with the Production Company in relation to the production of the documentary.

 

[16]     I will return to the relevant clauses of the Agreement later in the judgment.

 

[17]     From his perspective central to the ethos of the documentary was building public confidence in the professionalism of the PSNI. 

 

[18]     The purpose of the documentary was to ensure the public saw the reality of policing and as a result he did not want to prejudice the public’s trust by overly restricting what was captured.  He wanted the production team to capture “a warts-and-all” footage, to ensure authenticity.

 

[19]     He avers “PSNI could not have centralised control about deployment of film crews or decisions on every single capture of footage.  My role was therefore to facilitate a professional and fully vetted production crew to move freely around the PSNI and its MITs.”

 

[20]     In his affidavit he addresses steps that were taken to ensure that police operations would not be prejudiced and that the rights of individuals subject to any filming would be protected. 

 

[21]     He points out that the entire crew employed by the Production Company were vetted by PSNI to “security cleared” level.  In relation to information that was provided to the Company he says at paragraph 14 of his affidavit:

 

“… Throughout the filming period the film crew were in regular contact with PSNI contacts, who advised as to potentially relevant ongoing operations, which required providing a certain level of detail, for example, relevant locations, relevant suspects, and possible lines of inquiry.  Depending on the individual circumstances, production crews could be permitted to film a briefing.  Crews were not permitted to be present in intelligence briefings.  The embedding of the production crew in PSNI teams meant that they were provided with a certain amount of personal data about victims and suspects.  I was satisfied in light of the security vetting of the individual crew, the limitations of data protection law, the protections in the Access Agreement and the professionalism of BBC Studios that this was a necessary and proportionate sharing of information.”

 

[22]     He points out that the camera crew were not to capture footage in private dwellings without the consent of the occupier. 

 

[23]     As filming progressed the parameters applicable to the filming were extended to include filming within police vehicles whilst detained persons were being transported, within the police station carpark upon arrival and within the custody suite complex.  The latter filming was limited to communal areas.  It was also subject to the consent of local policing and the display of signage within the station providing information about the filming.

 

[24]     He expressly refused requests for filming within interview rooms, notwithstanding that this practice has been accommodated in other documentary programmes.

 

[25]     Throughout the entirety of the filming process the Detective Superintendent was in regular contact with the production teams and he describes the discussions as being cordial, professional and consensual. 

 

[26]     Returning to the facts of this case the applicant was arrested in connection with a murder which was committed in June 2020.  Although it was committed 10 months before the documentary filming commenced it remained a live investigation when work commenced on the documentary.  The investigation into the murder had the potential to be considered for inclusion in the documentary although it was impossible to assess whether in fact it would end up in the final product. 

 

[27]     One line of inquiry in relation to the murder related to the suspected involvement of the applicant.  By 5 July 2021 the PSNI was operationally ready to conduct searches of various premises and arrest two individuals suspected of involvement in the murder.  One of those was the applicant.  His arrest and the search of his property was described by the Detective Superintendent as a “necessary operational step in the investigation.”

 

[28]     He confirms the circumstances of the filming of the arrest and search of the applicant’s home and car as set out above.  He says that he considers it highly unlikely that the footage will feature in the documentary but he understands that no final decision has yet been made by Channel 4 because the review and vetting process remains ongoing.

 

[29]     He then goes on to set out the protections in relation to the rights of individuals captured on footage including the applicant which I will consider in the context of this challenge.

 

Can the applicant establish an interference with his Article 8 ECHR rights?

 

[30]     At the hearing the applicant focussed on an alleged breach of his Article 8 ECHR rights.  The respondent argued that the applicant has not demonstrated that the actions of PSNI under challenge in this case either engaged or infringed his Article 8 rights.

 

[31]     Article 8 provides:

 

“1. Everyone has the right to respect for his private and family life, his home and his correspondence.

 

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

 

[32]     The applicant argues that there has been an interference with his Article 8 rights in two respects. 

 

[33]     The first relates to the provision by the respondent of personal information in relation to the applicant.  A most unsatisfactory aspect of this case is the failure of the respondent to set out precisely what information concerning the applicant it provided to the Production Company.  At a very general level in his affidavit the former Detective Superintendent indicates that the Production Company was provided with “a certain level of detail, for example, relevant locations, relevant suspects, and possible lines of inquiry.”  Nowhere in the affidavit evidence is there anything from the respondent to indicate what information was in fact provided in respect of the applicant.  In the course of submissions Dr McGleenan was reduced to submitting that “certain information” was provided.  This has an adverse impact on the court’s ability to assess the extent of any breach of the applicant’s Article 8 rights. 

 

[34]     Separately from these proceedings, the applicant has unsuccessfully sought details by way of correspondence of what information is held by the Production Company.  The Production Company was invited and has declined the opportunity of submitting affidavit evidence in this application (something which it is perfectly entitled to do).

 

[35]     It seems that at the very minimum the Production Company was given the name of the applicant, his address, that his premises and car were to be searched, that he was a suspect in the murder of a named individual in June 2020 which was the subject matter of a live investigation.  The latter information would have been obtained from their filming of the arrest and detention of the applicant.  In submissions it was said that the applicant has a concern that significantly more information about him was provided to the Production Company.  It appears to be common case that the applicant is someone with a criminal record, which is a matter of public record.  He has been described in the media as a prominent figure in an illegal organisation.  In providing some background to the police operation Ms Doherty submits that this may have resulted in disclosure of the applicant’s political opinions and beliefs. 

 

[36]     The second relates to the PSNI facilitating the filming of the applicant.  There is no factual dispute about what was filmed. 

 

Article 8: Scope

 

[37]     The scope of Article 8 and what is meant by the phrase “private and family life” is the subject matter of much judicial consideration.  From the authorities it is clear the scope is a broad one.  In his seminal analysis in Regina (Wood) v Commissioner of Police of the Metropolis [2009] EWCA Civ 414 Laws LJ describes the central value protected by the right as the personal autonomy of every individual. 

 

[38]     At paragraph 21 of his judgment he says:

 

“The notion of the personal autonomy of every individual marches with the presumption of liberty enjoyed in a free polity; a presumption which consists in the principle that every interference with the freedom of the individual stands in need of objective justification.  Applied to the myriad instances recognised in the Article 8 jurisprudence, this presumption means that, subject to the qualifications I shall shortly describe, an individual’s personal autonomy makes him - should make him - master of all those facts about his own identity, such as his name, health, sexuality, ethnicity, his own image, of which the cases speak; and also of the `zone of interaction’ (the Vonhannover case 40 EHRR 1 para 50) between himself and others.  He is the presumed owner of these aspects of his own self; his control of them can only be loosened, abrogated, if the State shows an objective justification for doing so.

 

22. This cluster of values, summarises the personal autonomy of every individual and taking concrete form as a presumption against interference with the individual’s liberty, is a defining characteristic of a free society.  We therefore need to preserve it even in little cases.  At the same time it is important that this core right protected by Article 8, however protean, should not be read so widely that its claims become unreal and unreasonable.  For this purpose I think there are three safeguards, or qualifications.  First, the alleged threat or assault to the individual’s personal autonomy must (if Article 8 is to be engaged) attain `a certain level of seriousness’.  Secondly, the touchstone for Article 8(1)’s engagement is whether the claimant enjoys on the facts a `reasonable expectation of privacy’ (in any of the senses of privacy accepted in the cases).  Absence such an expectation, there is no relevant interference with personal autonomy.  Thirdly, the breadth of Article 8(1) may in many instances be greatly curtailed by the scope of the justification available to the State pursuant to Article 8(2).  I shall say a little in turn about these three antidotes to the overblown use of Article 8.”

 

[39]     This passage was quoted with approval by Toulson J in the Supreme Court judgment in JR 38 [2015] UKSC 42. 

 

[40]     Applying this analysis to the facts of this case it seems to me that the provision of his name, address and the fact that he was suspected of having committed a murder does engage and interfere with the applicant’s Article 8 rights.  Disclosing the latter information in particular attains the certain level of seriousness envisaged by Laws LJ.  More importantly, turning to the “touchstone” of Article 8(1) engagement, I consider that a person enjoys a reasonable expectation of privacy in relation to information that he is a suspect in a murder case and is about to be arrested in respect of that murder.  The applicant would not enjoy such an expectation to privacy in respect of matters which are already in the public domain.

 

[41]     In this regard the judgment of Mann J in Richard v British Broadcasting Corporation & Anor [2018] EWHC 1837 (Ch) is helpful.  In that case the plaintiff, a well-known entertainer, was the subject of an investigation by the police in relation to allegations of an historic sex offence.  A BBC reporter found out about the investigation from a confidential source and approached the police about it.  The police informed the reporter of an intended search of the plaintiff’s home and agreed to give him advance notice.  The BBC gave prominent and extensive television coverage to this search as it was happening and thereafter, some footage having been taken from a helicopter.

 

[42]     The plaintiff brought proceedings against both the BBC and the Chief Constable of the police force alleging inter alia, a violation of his privacy rights under Article 8.  The police accepted liability, apologised and paid damages. 

 

[43]     In considering the action against the BBC the court held that as a matter of general principle, a suspect had a reasonable expectation of privacy in relation to a police investigation. 

 

[44]     At paragraph [234] of the judgment Mann J says:

 

“[234] The question of whether the existence of a police investigation into a subject is something in relation to which the subject has a reasonable expectation of privacy is not something which has been clearly judicially determined, though it has been the subject of judicial assumption and concession in other cases.”

 

[45]     Having reviewed the authorities he concludes at paragraph [248] as follows:

 

“It seems to me that on the authorities, and as a matter of general principle, a suspect has a reasonable expectation of privacy in relation to a police investigation, and I so rule.  As a general rule it is understandable and justifiable (and reasonable) that a suspect would not wish others to know of the investigation because of the stigma attached.  It is, as a general rule, not necessary for anyone outside the investigating force to know, and its consequences of wider knowledge had been made apparent in many cases (see above).  If the presumption of innocence were perfectly understood and given effect to, and if the general public was universally capable of adopting a completely open - and broadminded view of the fact of an investigation so that there was no risk of taint either during the investigation or afterwards (assuming no charge) then the position might be different.  But neither of those things is true.  The fact of an investigation, as a general rule, will of itself carry some stigma, no matter how often one says it should not.”

 

[46]     He goes on to acknowledge that he does not find that there is an invariable right to privacy in these circumstances.  However, he concludes at paragraph [251] that:

 

“But in my view the legitimate expectation is the starting point.  I consider that the reasonable person would objectively consider that to be the case.”

 

[47]     In relation to the third qualification identified by Laws LJ, although it is a separate consideration, it turns primarily on the relationship between Articles 8(1) and 8(2) and the question of justification.  The question of justification is something which I will consider in detail later in the judgment. 

 

[48]     It is true that most of the authorities in relation to this issue relate to the actual publication of material.  In the case of Richard, Mann J was dealing with prominent and extensive television coverage, something which has not happened here.  Dr McGleenan argues that such disclosure as has occurred in this case is insufficient to meet the “level of seriousness” anticipated by Laws LJ. 

 

[49]     I am satisfied that the applicant has established that by providing the personal information referred to in paragraph [34] above (his name, his address, that his premises and car were to be searched and that he was a suspect in the murder of a named individual which was the subject matter of a live investigation) to the Production Company, his Article 8(1) rights have been engaged and an interference with those rights has been established.  The applicant clearly has established the starting point for the ambit of protection provided by Article 8.  In my view the fact that someone is a suspect in a murder case and subject to an ongoing investigation is a serious matter and one in which a suspect has a reasonable expectation of privacy.  It meets the “level of seriousness” anticipated by Laws LJ.

 

[50]     In relation to the filming of the applicant the court was referred to a number of authorities concerning the taking of photographs or the filming of individuals.  It is clear that each particular case will be fact sensitive.

 

[51]     That said a number of principles emerge.

 

[52]     Returning to the case of Wood, the court was considering photographs taken by police of the claimant in the street as he was leaving a hotel where a trade fair had been organised in respect of the arms industry.  The claimant was seeking judicial review by way of a declaration that the police actions were unlawful and a violation of his rights under Article 8 ECHR.

 

[53]     In that case there was no question of the photographs being published.  The court posed the question can the plaintiff sustain a claim that the mere taking of the pictures, irrespective of the use made of them (a claim he vigorously pursued), engages Article 8(1)?  Laws LJ answered the question in the following way:

 

“[34] I would certainly acknowledge that the circumstances in which a photograph is taken in a public place may of themselves turn the event into one in which Article 8 is not merely engaged but grossly violated.  The act of taking the picture, or more likely pictures, may be intrusive or even violent, conducted by means of hot pursuit, face-to-face confrontation, pushing, shoving, bright lights, barging into the affected person’s home.”

 

[54]     He acknowledges that scenario was very far from the facts being considered by him.

 

[55]     He goes on to say at paragraph [35]:

 

“It is no surprise that the mere taking of someone’s photograph in a public street has been consistently held to be no interference with privacy.  The snapping of the shutter of itself breaches no rights, unless something more is added.”

 

[56]     It seems to me that in this case “something more” has been added.

 

[57]     The applicant did not consent to being filmed.  At no stage during the search, arrest, his conveyance to the police station and his time in the police station was he a free agent.  At all times he was under the control of the police.  Taking photographs or filming someone walking along the street is very different from filming someone who is being arrested on suspicion of murder, whose house and car is searched, who is being handcuffed in a police land rover and questioned in a police station.  Subject to the issue of potential justification the interference in those circumstances in my view clearly meets the requirements of the level of seriousness and reasonable expectation of privacy identified by Laws LJ.

 

[58]     That the filming of an individual, even in public, is capable of engaging Article 8 is apparent from other cases, albeit recognising that there are differences in the factual backgrounds of each case.  In JR38 the police had filmed an individual committing a criminal act. 

 

[59]     At paragraph [39] of the Supreme Court’s judgment Lord Kerr quoted from Reklos v Greece [2009] 27 EHRC 420 to the effect that:

 

“A person’s image constitutes one of the chief attributes of his or her personality as it reveals the person’s unique characteristics and distinguishes the person from his or her peers.  The right to the protection of one’s image is just one of the essential components of personal development and pre-supposes the right to control the use of that image.  Whilst in most cases the right to control such use involves the possibility for an individual to refuse publication of his or her image, it also covers the individual’s right to object to the recording, conservation and reproduction of the image by another person.  As a person’s image is one of the characteristics attached to his or her personality, its effective protection which pre-supposes, in principle and in circumstances such as those of the present case …, obtaining the consent of the person concerned at the time the picture is taken and not simply if and when it is published.  Otherwise an essential attribute of personality would be retained in the hands of a third party and the person concerned would have no control over any subsequent use of the image.”

 

[60]     Dr McGleenan is correct in his submission that Reklos is not authority for the proposition that in every circumstance the taking of a photograph or video will engage Article 8.  As Lord Kerr acknowledged having quoted Reklos in JR38 at paragraph [41]:

 

“Prima facie, therefore, the taking and use of a photograph of an individual will lie within the ambit of Article 8.  The essential question is whether it is removed from that ambit because of the activity in which the person is engaged at the time the photograph was taken and because the person could not have a reasonable expectation that his or her right to respect for a private life arose in those particular circumstances.”

 

[61]     Repeating the analysis set out above I do not consider that the activity of the applicant in this case removes him from the ambit of the protection provided by Article 8.  To the contrary, the fact that he is being filmed because he is a suspect in a murder case strengthens the case for the engagement of Article 8.  In the context of the case against the respondent I recognise that the filming was carried out by a third party.  Nonetheless, it is clear that the filming was anticipated and facilitated by the respondent.  In the course of the judgment, I will discuss the roles of the different parties involved in the context of alleged breaches of the applicant’s rights. 

 

[62]     To repeat, the filming of someone who is being arrested, searched and detained as a suspect in a murder is a serious matter and one in respect of which that person enjoys a reasonable expectation of privacy.

 

[63]     I am therefore satisfied that the applicant has established an interference with his Article 8 rights in respect of both aspects of his claim. 

 

Is the interference in accordance with Article 8(2)?

 

[64]     Turning to the second limb of Article 8 the decision of Lord Sumption in Re Gallagher [2019] UKSC 3 [2020] AC 185 sets out the relevant legal principles and in particular how the “in accordance with the law” test is to be met.

 

[65]     He says at paragraph 12:

 

“12. It is not disputed that article 8 is engaged. It confers a qualified right of privacy, subject to important exceptions for measures which are (i) `in accordance with the law’, and (ii) `necessary in a democratic society in the interests of … public safety … for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights … of others.’ Conditions (i) and (ii) impose tests of a very different character, with very different consequences. Condition (i) is concerned with the legal basis for any measure which interferes with the right of privacy. Any such measure must not only have some legal basis in domestic law, but must be authorised by something which can properly be characterised as law. This is an absolute requirement. In meeting it, Convention states have no margin of appreciation under the Convention, and the executive and the legislature have no margin of discretion or judgment under domestic public law. Only if the test of legality is satisfied does the question arise whether the measures in question are necessary for some legitimate purpose and represent a proportionate means of achieving that purpose. 

…

 

16. It is well established that `law’ in the Human Rights Convention has an extended meaning. In two judgments delivered on the same day, Huvig v France (1990) 12 EHRR 528, at para 26, and Kruslin v France (1990) 12 EHRR 547, para 27, the European Court of Human Rights set out what has become the classic definition of law in this context: `The expression ‘in accordance with the law’, within the meaning of article 8.2, requires firstly that the impugned measure should have some basis in domestic law; it also refers to the quality of the law in question, requiring that it should be accessible to the person concerned, who must moreover be able to foresee its consequences for him, and compatible with the rule of law.’ Huvig and Kruslin established a dual test of accessibility and foreseeability for any measure which is required to have the quality of law. That test has continued to be cited by the Strasbourg court as the authoritative statement of the meaning of `law’ in very many subsequent cases: see, for example, most recently, Catt v United Kingdom (Application No 43514/15, 24 January 2019).

 

17. The accessibility test speaks for itself.  For a measure to have the quality of law, it must be possible to discover, if necessary with the aid of professional advice, what its provisions are. In other words, it must be published and comprehensible. The requirement of foreseeability, so far as it adds to the requirement of accessibility, is essentially concerned with the principle summed up in the adage of the American founding father John Adams, `a government of laws and not of men’. A measure is not `in accordance with the law’ if it purports to authorise an exercise of power unconstrained by law. The measure must not therefore confer a discretion so broad that its scope is in practice dependent on the will of those who apply it, rather than on the law itself. Nor should it be couched in terms so vague or so general as to produce substantially the same effect in practice. The breadth of a measure and the absence of safeguards for the rights of individuals are relevant to its quality as law where the measure confers discretions, in terms or in practice, which make its effects insufficiently foreseeable. Thus a power whose exercise is dependent on the judgment of an official as to when, in what circumstances or against whom to apply it, must be sufficiently constrained by some legal rule governing the principles on which that decision is to be made. But a legal rule imposing a duty to take some action in every case to which the rule applies does not necessarily give rise to the same problem. It may give rise to a different problem when it comes to necessity and proportionality, but that is another issue. If the question is how much discretion is too much, the only legal tool available for resolving it is a proportionality test which, unlike the test of legality, is a question of degree.”

 

[66]     Although not expressly referred to in the agreement between the respondent and the Production Company, or in any of the contemporaneous documents, Dr McGleenan argues that any infringement established by the applicant in this case is in accordance with the law, namely Part 3 of the Data Protection Act 2018 (“the 2018 Act”), read alongside sections 31A and 32 of the Police (Northern Ireland) Act 2000.  The statutory provisions are supplemented by the extensive public facing policy documents outlining how the PSNI complies with its obligations under the Data Protection Act 2018 and the General Data Protection Regulations (“GDPR”).

 

Data protection

 

[67]     In many respects, the key to the resolution of this case rests on analysis of the relevant data protection legislation.  The respondent relies on that legislation to support his contention that any interference with the applicant’s Article 8 rights in the circumstances of this case was in accordance with the law.  It is the data protection legislation which provides the legal protection of the Article 8 rights of the applicant and acts as a legal constraint on the respondent as a data processor in this case.

 

[68]     Furthermore, it is clear that in applying the principles enshrined in the relevant data protection legislation the issues of justification and the proportionality of any acts of the respondent are addressed.  Therefore, compliance by the respondent with his data protection obligations in this case overlaps with an analysis of the lawfulness of any interference with the applicants Article 8 rights. 

 

[69]     Before analysing the relevant data protection legislation I refer briefly to section 32 of the Police (Northern Ireland) Act 2000 (“the 2000 Act”).  It sets out the general functions of the police:

 

“(1) It shall be the general duty of police officers—

 

(a) to protect life and property;

 

(b) to preserve order;

 

(c) to prevent the commission of offences;

 

(d) where an offence has been committed, to take measures to bring the offender to justice.”

 

[70]     Section 32(5) initially required officers “so far as practicable, [to] carry out their functions in co-operation with, and with the aim of securing the support of, the local community.”  This was repealed by the Police (Northern Ireland) Act 2003 (section 20(4) and Schedule 4) and replaced in section 31(A) of the 2000 Act as follows:

 

“(1) Police officers and National Crime Agency officers shall carry out their functions with the aim—

 

(a) of securing the support of the local community, and

 

(b) of acting in co-operation with the local community.”

 

[71]     It is in this context that the respondent argues it felt it appropriate to agree to the making of the documentary.

 

[72]     Certainly this obligation is drafted in the broadest of terms.  The court is not in a position to gain say the assessment of the Detective Superintendent who made the arrangements for the documentary that this would contribute to securing the support of the local community in respect of policing.  As Rose LJ said in R v Marylebone Magistrates’ Court and others [1998] 162 JP 719:

 

“I fully understand the wish of police forces to inform the media about their activities, to draw attention to their successes and to explain their failures.  It is very much in the public interest that they do so and that the media should so report.”

 

These comments were, of course, qualified, something which is discussed below in the context of proportionality.

 

[73]     That said, it remains the case that the provision of any data relating to the applicant in the context of such a documentary remains subject to data protection legislation.  It is that legislation which is relevant to the “in accordance with the law” test, according to the respondent.  If the legislation applies, then there is a clear obligation on the respondent to comply with it.

 

 

The Data Protection Act 2018 (“the 2018 Act”)

 

[74]     The 2018 Act provides the legal framework in the UK for the processing of personal data. 

 

[75]     The Police Service is a registered data controller and must therefore comply with the data protection principles in relation to all personal data which it holds as a data controller.  The name, address and the fact that the applicant was the suspect in a murder investigation constituted personal data under the 2018 Act.  By providing this information to a third party the respondent was processing the data.

 

[76]     It is the respondent’s case that the processing of the applicant’s data in this case falls squarely within the regime under Part 3 of the 2018 Act.

 

Part 3 of the 2018 Act

 

[77]     Part 3 provides for the regulation of data processing for “law enforcement purposes” for which the respondent is a competent authority under section 30 of the 2018 Act.

 

[78]     Law enforcement purposes are defined in section 31 as:

 

“…the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”

 

[79]     Whether the processing of the applicant’s data in this case was for “law enforcement purposes” is very much in dispute.

 

[80]     In the case of JR38 the situation was clear.  In that case the police had arranged for the publication of the applicant’s photographs in local newspapers with the express purpose of identifying individuals involved in violent disorder. 

 

[81]     Here, the matter is less clear.

 

[82]     In my view it would be straining the words of section 31 to suggest that it includes the type of exercise envisaged in the production of this documentary.  Section 31 focusses on the prevention, investigation, detection or prosecution of actual criminal offences rather than broader issues of public interest including public confidence in the PSNI.

 

[83]     Notwithstanding this conclusion it is useful to consider the applicable principles under Part 3 which to an extent overlap with those which apply to Part 2 of the Act.  Assuming, for the moment, that Part 3 is applicable, it provides a framework for the lawful processing of data in that context.

 

[84]     Processing of personal data for any law enforcement purpose must comply with the six data protection principles set out in sections 35-40 of the 2018 Act (read with Schedule 8).

 

[85]     The first data principle set out in section 35 is that processing must be “lawful and fair.” 

 

[86]     Section 35(2) provides that:

 

“(2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

 

(a) the data subject has given consent to the processing for that purpose, or

 

(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.”

 

[87]     Assuming that the processing at issue in this case was for the performance of a law enforcement purpose, was the processing “necessary” for that purpose? 

 

[88]     The purpose is set out in the affidavit of the Detective Superintendent analysed already.  To repeat, that was to address what were perceived as low levels of confidence in policing and community support for police operations.  The anticipated documentary was commissioned with the purpose of helping the PSNI to secure the support and cooperation of the local community which aligns with the general obligation of the PSNI to carry out its functions in a way that secures that support and co-operation.  Part of the purpose of the documentary is for the PSNI to record and demonstrate in detail how it goes about investigating serious criminal offences.  As per Rose LJ, quoted in para [71] above, it is very much in the public interest that they do so.  The court is aware from general knowledge that such documentaries are a common feature in broadcasting schedules. 

 

[89]     The issue therefore is whether the processing in this case was a necessary way of achieving that purpose.  This, of course, aligns with the approach to an analysis of the applicant’s Article 8 rights as set out by Lord Sumption in Bank Mellat HM Treasury (2) [2013] UKSC 39 at para 20, discussed later in this judgment in the context of Article 8.

 

[90]     Whether the test is met depends on the precise context in which the relevant data was processed.

 

[91]     Turning to the circumstances of this case, it is important to distinguish the processing of information from the circumstances in the cases of Richard and JR38 discussed above.  The real harm in those cases was the very extensive publication of the claimant’s personal data.

 

[92]     In Richard the court was dealing with personal data that was broadcast on the main national broadcaster which gave prominent and extensive television coverage to the search of the claimant’s home as it was happening.  JR38 also involved very substantial publication.  In the case of R v Marylebone Magistrates’ Court [1998] 162 JP 719 the court was dealing with the search of the applicant’s premises and homes which were “executed in the presence of the media which gave rise to a blaze of national publicity adverse to the first and second applicants.”

 

[93]     I make it clear that had the material at issue in this case been disclosed to the Production Company with a view to it being broadcast at the will of the Production Company this would have been in breach of the first data principle and would not meet the test of being fair and lawful.  However, that is not what has happened here. 

 

[94]     In this regard the agreement between the respondent and the Production Company is significant.  Clause 9.1 of the agreement provides:

 

“Subject to the revision of Clause 10, BBC studios shall only use Filmed Material (including for the avoidance of doubt unused rushes) for the purpose of the Programme and related publicity and promotional purposes.  BBC Studios shall not use or allow Filmed Material to be used for any other series or programme, news item (except the news item as directly related to the broadcast of the Programme), archive or video in any format or any media anywhere in the world without the prior written consent of PSNI (such consent not to be unreasonably withheld or delayed).”

 

[95]     Importantly, Clauses 6.2 and 6.3 provides as follows:

 

“6.2 Except in respect of incidental inclusion of PSNI personnel, BBC Studios shall seek to obtain any necessary consent in advance or if that is not practicable at the earliest possible appropriate moment.  If consent is not forthcoming in such case and is required (to take into account reasonable expectations of privacy and editorial justification), BBC Studios will use standard editing techniques to conceal the individual’s identity.  This may include obscuring an individual’s face and/or distorting their voice.

 

6.3 In the case of Filmed Material captured of any individual who has been charged, but whose case has not yet been disposed of by the time of broadcast, BBC Studios will be mindful of its obligations under the Contempt of Court Act 1981 by not including in the programme any filmed material that at the date of delivery to commission would present a substantial risk of serious prejudice to court proceedings/trials.”

 

[96]     The court considers this to be a very significant provision in the context of assessing the lawfulness or proportionality of the respondent’s actions.

 

[97]     The effect of this clause is that the Production Company will not be in a position to publish any of the material relating to the applicant without putting him on notice.  This does not mean that the Company would not broadcast any material it has obtained in relation to the applicant.  What it does mean, however, is that he will first of all have the opportunity of consenting and, importantly, if he does not consent will be in a position to challenge the publication or broadcasting of his data in advance of such publication.

 

[98]     In the course of the hearing, Ms Doherty properly drew my attention to weaknesses and inadequacies in the relevant data protection policy of the BBC.  However, it is open to the applicant to challenge any risk of publication by the BBC of his private information relying, inter alia, on such inadequacies.

 

[99]     Specifically, in relation to the alleged inadequacy of the Production Company’s retention policy it is open to the applicant to challenge this and seek an order that any information they hold should not be retained.  The applicant has a number of remedies under the 2018 Act at his disposal in this regard.  The Act provides a comprehensive statutory scheme for the protection of rights relating to personal data.  In particular section 165 of the 2018 Act provides that a data subject may make a complaint to the Information Commissioner. 

 

[100]   To facilitate enforcement of section 165, section 166 provides the tribunal established under the Act with the power to make orders requiring the Commissioner to take appropriate steps to respond to the complaint.  The first tier tribunal has the power to certify an offence of contempt of court to the upper tribunal in relation to failure to comply with an order made under section 166.  The upper tribunal has the full range of powers to deal with the person charged with the offence as if it was committed in relation to the upper tribunal; section 202(3)(b).  The Act also makes specific provision for judicial remedies for a breach of the 2018 Act.  Section 167 provides for a compliance order to be made by a court.

 

[101]   In addition to orders for compliance under section 167, section 169 provides for damages for contravention of data protection legislation. 

 

[102]   It might be argued that this panoply of powers should have been used to challenge the actions of the respondent.  However, the court considered that the Article 8 issues raised in the application merited the granting of leave.

 

[103]   The court notes that Clause 6.2 applies the same test to be applied by the court to the assessment of whether Article 8 is engaged in a given situation, namely the subject’s “reasonable expectations of privacy.”  Therefore, the approach taken to the potential actual publication of identifying material is consistent with the case law on Article 8.  Thus, the legal principles governing Article 8 are embedded in the agreement between the respondent and the Production Company.

 

[104]   Furthermore, the delay in publication allows BBC Studios and PSNI to assess whether any publication of the applicant’s private information is lawful.  Consideration will have to be given as to whether public interest has been established.  Consideration will need to be given as to whether there was any risk of prejudice to an ongoing investigation.  All of these factors mean that the situation is very significantly different from the cases upon which the applicant relies. 

 

[105]   The applicant further relies on a breach of the second data protection principle set out in section 36(1) of the 2018 Act which provides:

 

“(1) The second data protection principle is that—

 

(a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and

 

(b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.”

 

[106]   Subsection 1(a) is not relevant to these proceedings.

 

[107]   In relation to 1(b) the information was collected for the purposes of investigation into a murder.  However, given the analysis above in relation to the purposes for which the documentary has been commissioned it seems to the court that securing public confidence in policing with the hope that it will increase public assistance in solving criminal investigations could not be said to be incompatible with the purpose for which the data was initially gathered. 

 

[108]   In relation to an alleged breach of the fifth data protection principle under section 39 of the 2018 Act which requires personal data processed for law enforcement purposes to be kept no longer than is necessary for the purpose for which it is processed, it is important to distinguish the retention of the material by the PSNI as opposed to the Production Company. 

 

[109]   Dr McGleenan makes the point that this issue was raised in an Amended Order 53 Statement without leave being obtained by the court.  However, the court is in a position to deal with this matter.  The court accepts that the respondent has an extensive records management policy and review, retention and disposal schedule.  These policies have been approved by the Court of Appeal in ASI’s Application [2021] NICA 55.  The court concludes that there is no basis for establishing a breach of the fifth Data Protection Principle by the respondent. The real complaint relates to the retention and management of the data by the Production Company.  As previously indicated the court shares the concerns expressed on behalf of the applicant in relation to the Production Company’s policies.  However, that is an issue that the applicant can take up with the Production Company.

 

[110]   The applicant further relies on a breach of the sixth data principle set out in section 40 of the 2018 Act which provides:

 

“The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “ appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).”

 

[111]   As is the case with the fifth data protection principle it is important to distinguish the separate roles of the respondent and the Production Company.  They are both in the possession of data relating to the applicant and have separate obligations to ensure that it is lawfully processed.  I have already dealt with how this material was processed by the respondent.  In relation to the comments already made I note that the crew in question were required to be security vetted to security cleared level.  At this stage there is nothing to suggest there has been any breach of security in relation to the material.  Importantly, in the event that there is any issue about the security of data processing by the Production Company that is a matter which the applicant can and should take up with that party.

 

[112]   The applicant also alleges breach of section 64 of the 2018 Act, which requires the data controller in certain circumstances to undertake a Data Protection Impact Assessment (“DPIA”).  Again, this was not pleaded at the leave stage but rather in an amended Order 53 Statement without leave and in respect of which the respondent did not have the opportunity to adduce evidence. 

 

[113]   Section 64(1) sets out the circumstances in which a DPIA is required:

 

“Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.”

 

[114]   On the material available to the court, I do not consider that it has been established that the processing involved here is likely “to result in a high risk to the rights and freedoms of individuals.”  The agreement with the Production Company which was in place in advance of filming ensured there were substantial protections for the article 6 and article 8 rights of individuals captured in any recording. 

 

[115]   This argument is reinforced by consideration of UKGDPR and recital 91 thereof which is entitled “Necessity of a Data Protection Impact Assessment” and sets out the circumstances in which article 35 applies (article 35 deals with when a DPIA is required).

 

[116]   It is clear from the text of article 35 that the making of the documentary in question does not fall into any of the categories envisaged by the recital. 

 

[117]   The applicant also relies on breaches of the General Data Protection Regulations (Regulation (EU) 2016 679) (“GDPR”) and, in particular, article 5.  These are set out in para [8] of this judgment.  In light of the analysis above they do not add anything to the assessment of this application.

 

[118]   The above analysis has been conducted on the basis that Part 3 of the 2018 Act applies.  However, as indicated, I am not satisfied that processing in this case comes within the ambit of law enforcement purposes.   

 

[119]   In that event, the processing in question is governed by Part 2 of the 2018 Act.

 

Part 2 of the 2018 Act

 

[120]   If Part 2 applies then the respondent must comply with seven principles which are largely consistent with the six outlined above in relation to processing under Part 3.  The difference is that there is no longer a “law enforcement” purpose.  In those circumstances the PSNI must be able to point to another lawful basis for sharing the data. 

 

[121]   In this regard, I am satisfied that the purpose of the documentary as set out in the Detective Superintendent’s affidavit, does constitute a lawful basis.  There is a clear public interest in informing the public how the PSNI Major Investigations Team conduct investigations.  The documentary was commissioned with the object of providing a solution to low levels of confidence in policing and community support for police operations.  The intention was to help the PSNI to win the support and co-operation of the local community which the respondent describes as fundamental to the success for the carrying out of its policing functions.  Therefore, the analysis whether it be under Part 3 or Part 2 does not make any difference to the outcome of this application.

 

Sensitive data

 

[122]   At the hearing the issue of special category data or the sensitive processing of such data was raised.  Whilst there was some lack of precision on this issue it seems to the court that there are three potential categories of special category data which arise in this case.  The first relates to the applicant’s political opinions.  This would constitute special category personal data under Article 9(1) of the GDPR. 

 

[123]   The second relates to biometric data which is defined in Article 4(13) of GDPR as personal data:

 

“Resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person (individual), which are confirm(s) the unique identification of that natural person (individual), such as facial images or dactyloscopic (fingerprint) data.”

 

[124]   The third relates to criminal convictions or offences.  This is covered in Article 10 of the GDPR which provides that:

 

“Processing of personal data relating to criminal convictions or offences or related security measures based on Article 6(1) …”

 

[125]   This is echoed in section 11(2) of the 2018 Act which provides that references to personal data related to criminal convictions and offences and related security measures include personal data relating to:

 

“(a) The alleged commission of offences by the data subject or

 

(b) Proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings including sentencing.”

 

[126]   In the course of submissions Ms Doherty argued that the data shared between the PSNI and BBC Studios Productions Ltd related to his “political opinions”.  This is on the basis that it has been alleged that the applicant was the head of a dissident terrorist organisation.  As has been pointed out by Dr McGleenan this allegation is in the public domain and it is not something in respect of which the applicant enjoys a reasonable expectation of privacy.  This issue was not raised by the applicant in his affidavit and there is simply insufficient evidential basis to make such a claim.  In any event, it seems to me that an allegation that someone has been arrested under the Terrorism Act 2000 in relation to a murder does not relate to that person’s “political opinions”. 

 

[127]   In terms of “biometric data”, there is no evidence that the respondent provided any facial image to the Production Company.  Any filming in this case was processed by the production company and not by the respondent.

 

[128]   Therefore this leaves only the issue of data relating to criminal convictions and offences.

 

[129]   In the event that the processing in this case constitutes processing under part 3 of the 2018 Act, there are additional safeguards required for “sensitive processing”.  Schedule 8 of the 2018 Act provides that in relation to data processing for statutory purposes the relevant condition is met of the processing if:

 

“(a) it is necessary for the exercise of a function conveyed on a person by an enactment or rule of law.

 

(b) it is necessary for reasons of substantial public interest.”

 

[130]   In relation to public interest further assistance is found in Section 8 of the Act.  It provides that this includes that processing of personal data is necessary for:

 

“(a) the administration of justice.

 

…(c) the exercise of any functions conferred on any person by an enactment or rule of law.

 

…(e) an activity that supports or promotes democratic engagement.”

 

[131]   In view of the analysis above the court concludes that the condition for reasons of substantial public interest has been met. 

 

[132]   Section 42 of the 2018 Act provides further safeguards in relation to sensitive processing.

 

[133]   Section 42 provides:

 

“(1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).

 

(2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—

 

(a)   explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and

 

(b)  explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.”

 

Policy Documents

 

[134]   In his affidavit evidence the respondent has exhibited a series of documents which he says meets these requirements.  At the time of the documentary project the respondent had a public facing service instruction “Data Protection” which explains how the 2018 Act and GDPR applies to both law enforcement and non-law enforcement processing.  The policy directs officers both to the Authorised Professional Practice (“APP”) guidance issued by the College of Policing, and further PSNI policy and guidance on sensitive processing.  The guidance on sensitive processing explains how PSNI secure compliance with the Data Protection Principles, whether a reliance on consent or a Schedule 8 condition.  It also refers to the PSNI’s extensive and detailed system for records management.  This includes a review, retention and disposal schedule which provides for every possible category of record held by the PSNI, the period for which it should be retained, how and when the decision of retainment should be reviewed, and what the final action in respect of the record should be (for example, destruction or onward transmission to PRONI).

 

[135]   I refer to the affidavit filed by the Data Protection Officer within the PSNI which includes the following:

 

“3. With the coming into force of the Data Protection Act 2018 (“the 2018 Act”) and the General Data Protection Regulations in 2018, PSNI issued a new Service Instruction SI0518 (“Data Protection”) to set out the PSNI’s responsibilities to ensure compliance with the new laws.  This is publicly available on the PSNI website.  This was updated on 11 February 2019 and that remains the current version.  …

 

4. The Service Instruction contains a specific section on sensitive processing, which explains how sensitive processing is defined and what is required to demonstrate compliance within the 2018 Act.  It then goes on to state:

 

Where the PSNI carries out processing in relation to special category data in reliance of a Schedule 1 condition or sensitive processing based on the consent of the data subject, or based on another specific condition in Schedule 8 of the Data Protection Act 2018 the PSNI must put in place additional safeguards these include how we record such reliance.  The PSNI have developed additional guidance on how records/additional safeguards should be kept.

 

5. The additional guidance referred to include PSNI guidance document `Safeguards for certain types of processing of sensitive special category data’, which indicates on its face:

 

This document supplements the Data Protection Service Instruction and provides guidance on the requirements for processing special category data and sensitive processing relied on in certain conditions within the new data protection legislation.

 

6. The guidance explains when an `appropriate policy document’ is required under section 35 of the 2018 Act and what is required by section 42 of such policy documents.  It contains at page 6:

 

The PSNI have several policies in place which together with the guidance provide such appropriate directions and safeguards.  These include PSNI’s updated Data Protection Service Instruction as well as PSNI’s records management policy (presently under revision) and policy with respect to notebooks and journals (presently under revision).  PSNI has a Retention and Disposal Schedule in relation to its retention periods for information held.  This can be accessed via PSNI’s updated privacy notice which is available by 25 May 2018 on the PSNI website.  PSNI also has an Information Asset Register (`IAR’) which has been compiled as a part of our implementation for commencement of changes to the Data Protection Framework on the UK.  This is held and will be maintained by PSNI’s Records Management Unit in conjunction with information asset owners in PSNI Districts as IAR owners in PSNI District and Departments.  Detail within the IAR represents some of those records required to be held by PSNI under new Data Protection legislation.’”

 

[136]   After the events in question in this challenge the PSNI, on 1 November 2021, issued a dedicated guide for “sensitive processing for law enforcement purposes, under Part 3 DPA (2018)”.  There is also an equivalent guide for sensitive processing under Part 2 of the Data Protection Act 2018.

 

[137]   The PSNI also has a privacy notice which is available to the public on the PSNI website.  This explains in general terms, how the PSNI processes personal data, how it is protected, what rights individuals have regarding to personal data handling.

 

[138]   It is correct to say that the policies do not expressly deal with a scenario such as this.  It is therefore necessary to consider the access agreement entered into between the respondent and the Production Company to complete the picture in relation to compliance with Section 42.  Having regard to the analysis of this agreement set out earlier in the judgment I consider that taken together with the policy documents to which I have referred, the respondent has demonstrated compliance with its obligations under Section 42 of 2018 Act.  The processing of the sensitive data in question is for a specific and limited purpose.  In that context, I consider it appropriate that the respondent meets its obligations in this regard if it enters into a specific agreement tailored to the reasons for processing of the data.  That has been done in this case.  The court is not dealing with ongoing processing for an unlimited period to other bodies, something which may require a more specific policy.

 

[139]   I consider that the policy documents together with the agreement entered into between the respondent and the Production Company are sufficient in the context of the applicable legislative rubric.

 

[140]   In light of the analysis above in terms of substantial public interest and the policy documents, together with the access agreement, I am satisfied that there has been no breach established by the applicant under this heading.

 

Section 59 of the 2018 Act

 

[141]   The applicant alleges that the respondent is in breach of its obligations under section 59 of the 2018 Act. 

 

[142]   Section 59(1) provides as follows:

 

“(1)  This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.”

 

[143]   In my view the applicant’s argument is misconceived.  This is not a case where BBC Studios were contracted to process data on behalf of the respondent.  It seems to the court that this provision relates to the outsourcing or contracting out of processing to an outside organisation.  It is not directed to the scenario in this case.  What is envisaged under Section 59 is a situation where a processor  subcontracts elements of processing to another party.  It contemplates, in my view, the provision of a service in the processing or managing of data and is focused on technical and organisational measures.  By way of example, it provides for situations where data controllers purchase “off the shelf” packages to carry out their processing.

 

[144]   Having analysed the provisions of the Data Protection Act and having come to the conclusion that the respondent has complied with his obligations under that Act, for completeness I return to the question of the alleged breach of the applicant’s article 8 rights.

 

Interference with Article 8

 

[145]   I have already concluded that there has been an interference with the applicant’s Article 8 rights. 

 

[146]   I have concluded that it is in accordance with the law, namely the 2018 Act and sections 31A and 32 of the Police (Northern Ireland) Act 2000, together with the policy documents published by the respondent in relation to compliance with its data protection obligations.

 

[147]   I have concluded that it complies with the respondent’s obligations under the relevant data protection legislation.

 

[148]   In light of these conclusions I am satisfied that the respondent has established that the interference pursued a legitimate aim and was necessary in a democratic society. 

 

[149]   In short, it has met the test set out by Lord Sumption in Bank Mellat v HM Treasury (No.2) [2013] UKSC 39 at para [20]:

 

“… the question depends on an exacting analysis of the factual case advanced in defence of the measure, in order to determine (i) whether its objective is sufficiently important to justify the limitation of a fundamental right; (ii) whether it is rationally connected to the objective; (iii) whether a less intrusive measure could have been used; and (iv) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community.”

 

[150]   To repeat, I accept that the securing of public confidence in policing is a legitimate purpose and one of significant public importance.  Effective policing is a necessary component of the rule of law.

 

[151]   I accept that having regard to the affidavit evidence submitted on behalf of the respondent that the commissioning of the documentary was rationally connected to that aim.

 

[152]   The factual context in which this documentary has been produced is extremely important in the assessment of the intrusive nature of the measures employed by the police, the severity of the consequences and whether a fair balance has been struck between the rights of the applicant and the interests of the community.

 

[153]   In this regard, I am particularly influenced by the provisions of the agreement to which I have already referred.  These mean that there is no prospect of the scenarios in Richard, JR38 and Marylebone Magistrates occurring in this case.  At this stage the extent of the intrusion is of an extremely limited nature.

 

[154]   I have already referred to the judgment of Rose LJ in the Marylebone Magistrates’ Case.  There Lord Justice Rose confirmed the public interest in police forces informing the media about their activities.  He went on to qualify his remarks in the following way:

 

“but these informative and explanatory briefings should, generally speaking, take place after the relevant events have occurred and always in such a manner that prejudice to the innocent is avoided, possible tainting of the fair process of a trial does not occur and distress to obviously or potentially innocent members of the public is minimised.  Save in exceptional circumstances it does not seem to me to be in the public interest that legitimate investigative procedures by the police, such as the execution of search warrants, or, for that matter, the interviewing of suspects, which may involve the innocent and may or may not lead to prosecution and trial should be accompanied by representatives of the media encouraged immediately to publish what they have seen.  For my part, I would deploy a general practice by any police force of inviting the media to be present when investigative procedures are being undertaken. Although publication of accounts arising from such presence may on occasion defer witnesses coming forward, it seems to me to be equally, if not far more, likely that media presence of itself will generally impede proper investigation and cause unjustifiable distress or harassment to those being investigated.”

(my underlining).

 

[155]   It is clear that the concerns expressed by Rose LJ have been addressed in the arrangement between the respondent and the Production Company.  There is no possibility of interfering with any fair trial of the applicant.  There is no question of any material in relation to the applicant being published immediately.  The respondent here is not engaged in a “general practice”.  The arrangement is such that any distress or harassment to the applicant has been minimised.  The mischief identified in the Richard and Marylebone magistrate cases does not arise in the circumstances of this case.

 

[156]   In this regard the concerns of the applicant as set out in his affidavit are important.  He says at paragraph 8:

 

“I have found it difficult to believe that the PSNI would liaise with journalists to give details of my pending arrest, the time and location of the address and facilitate their filming my arrest, the search and my subsequent detention.  I objected at all stages of this process and my objections were ignored.  I fear for future interactions between the PSNI and journalists regarding private information the PSNI hold regarding me.  I also have concerns that any publication of the information could affect the fairness of any potential proceedings which could arise.”

 

[157]   In my view the fears expressed by the applicant have been addressed in the arrangement between the respondent and the Production Company.  The information was provided for a specific purpose, in accordance with the relevant legal constraints and with the applicant’s Article 8 rights and his Article 6 rights protected.  The disclosure in question was a targeted and proportionate way of achieving the purpose identified by the respondent.  It meets the “less intrusive measure” test. 

 

[158]   The real mischief in this type of interference is the risk of the relevant material being published and the extent of that publication. 

 

[159]   To date there has been no such publication.  There are important and significant constraints in relation to any potential publication already in place.

 

[160]   The applicant can engage with the Production Company to ensure that there is no unlawful retention or publication of the private material in this case. 

 

[161]   For these reasons and the reasons set out in more detail in the earlier part of this judgment when analysing the data protection issues, I am satisfied that the interference with the applicant’s article 8 rights by the respondent, which I accept has been established, is in accordance with law and meets the requirements of article 8(2) of the ECHR. 

 

Anonymity

 

[162]   It will be seen that the applicant has been granted anonymity by the court.

 

[163]   The court starts from the position that court hearings are in public, and that the media should be able to report those proceedings fully and contemporaneously.  This principle is well-established in common law and is reinforced by the provisions of article 10 of the ECHR and section 12 of the Human Rights Act 1998.

 

[164]   Therefore, any restriction on these usual rules must be based on necessity and fully justified.

 

[165]   This case relates to an alleged breach of the applicant’s private rights under article 8 of the ECHR.  As will be clear from the judgment the court has determined that there has been an interference with his article 8 rights.  The court has not found for the applicant on the basis that the interference by the respondent has been justified under article 8(2) of the ECHR and is in accordance with the relevant Data Protection legislation.

 

[166]   However, it has come to that conclusion in the context where there has been no publication of the material which would lead to the identification of the applicant.  That potential identification is something in respect of which he retains an expectation of privacy. 

 

[167]   In those circumstances the court considers that the applicant is entitled to anonymity so as to protect his article 8 rights.  It considers that an anonymity order is proportionate and goes no further than is necessary to meet the objective of protecting his article 8 rights. 

 

[168]   The court therefore confirms the anonymity order previously made.  The court directs that nothing should be published in relation to the applicant which would lead to his identification.

 

Summary of conclusions

 

[169]   (i)        The applicant has established that the actions of the respondent under challenge in this case interferes with his Article 8 rights.

 

(ii)       The interference in question is in accordance with the law namely the Data Protection Act 2018 read alongside sections 31A and 32 of the Police (Northern Ireland) Act 2000, together with the policy documents published by the respondent in relation to compliance with its data protection obligations.

 

(iii)      The interference established by the applicant meets the requirements of Article 8(2) of the ECHR.  Any interference with the applicant’s Article 8 rights has a lawful basis.

 

(iv)      The applicable regime to this type of data processing is Part 2 of the Data Protection Act 2018, and the respondent has demonstrated compliance with its obligations thereunder.

 

(v)       In the event that the court is wrong that Part 2 of the Data Protection Act 2018 applies, and that Part 3 applies, then the respondent has demonstrated compliance with its obligations thereunder.

 

(vi)      Additionally, the respondent has equally demonstrated a compliance with obligations arising under UKGDPR.

 

[170]   The application for judicial review is dismissed.