United Kingdom Information Tribunal including the National Security Appeals Panel

 


IN THE INFORMATION TRIBUNAL

IN THE MATTER OF THREE CONSOLIDATED APPEALS TO THE INFORMATION TRIBUNAL UNDER SECTION 48(1) OF THE DATA PROTECTION ACT 1998

BETWEEN:

THE CHIEF CONSTABLES OF WEST YORKSHIRE, SOUTH YORKSHIRE AND NORTH WALES POLICE Appellants

AND

THE INFORMATION COMMISSIONER Respondent

JUDGMENT

Introduction

1. There are three appeals before the Information Tribunal ("the Tribunal") arising from the service of three enforcement notices under section 40 of the Data Protection Act 1998 ("the 1998 Act"). The notices require the erasure of conviction data held on the Police National Computer (the "PNC") relating to three specific individuals whom for reasons of anonymity have been referred to since an earlier stage in these proceedings by the initials of the three police forces involved, namely SY, WY and NW.

The three appeals have been consolidated but the Tribunal has made it clear throughout and the parties agree that each case should be treated on its own individual merits and facts. Notwithstanding that, it is also generally accepted that the three cases raise matters of considerable wide-ranging importance which clearly transcend the circumstances surrounding each individual enforcement notice.

2. The central issue raised by each enforcement notice is a reflection of the assertion by the Information Commissioner ("the Commissioner") that he is satisfied that in continuing to process the relevant conviction data the three Chief Constables of the forces in question as data controllers have contravened the Third and Fifth Data Protection principles.
3. Although the 1998 Act will be set out in further detail below it is important to set out the relevant principles in their full terms at this point. They are contained in Schedule 1 Part 1 to the 1998 Act and provide as follows, namely:
<
>

"3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

***

Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes".

5. Put shortly the central question for the consideration of the Tribunal is whether the three sets of convictions pertaining to the data subjects who feature in the enforcement notices should be totally deleted or expunged from the PNC mindful not only of an alleged contravention of the Third and Fifth Data Protection principles but also taking into account Article 8 of the European Convention on Human Rights ("the Convention") taking further account of the fact that in accordance with his mandate under the 1998 Act the Commissioner has properly considered that continued contravention has caused or is likely to cause any person, namely here, the data subjects, damage or distress.

Summary of conclusions

6. The Tribunal has concluded that in the light of all the evidence and the extremely full submissions which it has heard that it is appropriate to amend the three enforcement notices issued by the Commissioner so as henceforth to allow retention of the data in question to be available in effect to police users alone subject to the rules in the ACPO Code of Practice for the reasons more fully set out in the remainder of this judgment. The forms and terms of the amended Notices can be found at paragraph 218.

The facts

7. Although at an early stage of these proceedings at an oral hearing for directions the Tribunal with the consent of the parties ruled that the data subjects in question should be referred to by the initials above indicated together with a direction that the sex of each data subject not be referred to, SY has been represented by solicitors both at the directions hearing in question and during the hearing of this appeal by Counsel on the latter occasion in relation to a noting brief. SY by SY's solicitors has also communicated with the Tribunal and thereby with the parties in an attempt to draw the Tribunal's attention to what has been described as "a significant inaccuracy" alleged to have "slipped into" the evidence given by the Assistant Information Commissioner, Mr David Smith, during the course of the appeal in relation to SY. The facts surrounding SY's conviction will be set out below. The conviction data as such constituted facts which on any basis the Tribunal feels cannot be contradicted and as will be seen are fairly sparse in content. The Tribunal has noted the reservations expressed on behalf of SY with regard to the oral evidence which was given and to which reference will be made below. The reservations were communicated to the Commissioner and there clearly emerged a difference of view on a particular factual aspect of the information gleaned with regard to the case of SY. The Tribunal feels that the matter need not be pursued further save to say, as will again be indicated below, that the exchanges in question show not only the sensitivity which will invariably be felt by a data subject in respect of facts such as are revealed in the present cases but also the inevitably unsatisfactory way in which a true picture of the facts surrounding any particular conviction can ever be obtained at least without full disclosure ideally supported by cross examination or some form of testing of the evidence produced.
8. At the directions hearing which occurred on 27 January 2005, SY by SY's solicitors expressed a willingness to provide a statement to assist the Tribunal of the relevant facts. This invitation was declined largely for the reasons set out above. In any event the Tribunal feels that it can reach a conclusion upon the substance of the appeals without embarking upon the kind of factual inquiry which contested versions of events are bound to lead to.
9. The Tribunal accepts that the allegation which Mr Smith's evidence has prompted is one of a possible or actual significant inaccuracy. The Tribunal therefore proposes to recite the facts of these cases without alluding to the part of Mr Smith's evidence with which issue has been taken.
10. A related matter concerns the enforcement notice surrounding WY. After the conclusion of the evidence before the Tribunal in which extensive reference was made to the facts of WY's convictions, a party referred to during the proceedings as XX wrote to the Tribunal's Secretariat requesting that should there be any reference to the facts of WY's case in the Tribunal's determinations the "exact dates of conviction" were not to be used on the basis that there could be said to be or thought to be "potential identifying details when combined with geographical area". The Tribunal feels it is impossible now to redact the content of evidence which was given during the course of the hearing. However, in an attempt to lessen the concerns felt by or on behalf of WY, this judgment will refer as far as possible to any relevant dates by referring only to years and at most to months relating to any specific year as distinct from specific dates attaching to any of the events which pertain to WY.
11. In the case of SY, SY was born in 1964. SY was convicted of an offence of assault occasioning actual bodily harm as a result of which the court imposed a conditional discharge of 12 months on 21 December 1979. A Request for Assessment form was lodged and filed with the Commissioner on or about 7 May 2002 bearing a stamp of that date. The circumstances surrounding the way in which SY's conviction emerged are not without interest since they did not represent the way in which the Tribunal feels such conviction data would often be provided, namely pursuant to a search made on the PNC either by the data subject himself or herself and very often in connection with an application for employment.
12. SY had at some time prior to May 2002 made a formal complaint about a neighbour who was a serving police officer of the Nottinghamshire Police Force. The ensuing conviction led to the disclosure of the conviction data to the Police Complaints Authority. SY contended in SY's Request for Assessment form lodged with the Commissioner that on contacting the Police Complaints Authority the Authority had written back expressing that they do not require PNC checks on "complainents" (sic). SY contended that since the conviction in 1979 which SY characterised as a juvenile conviction SY had had no further convictions and indeed went on further to say in the assessment form that SY had never been "accused and/or questioned in relation to a criminal act". The Tribunal pauses here to say that in its opinion this assertion whether true or not is clearly incapable of being verified independently or at least in any proper or established way, not least by the Commissioner but also by this Tribunal. Moreover the Tribunal feels it is certainly not incumbent upon it as an appellate tribunal to conduct any form of fact-finding examination in cases of this sort given the inevitable tensions referred to above (see paragraph 6) which cannot in any proper sense be properly resolved between the anonymity justifiably sought by the data subject on the one hand and the understandable need of the Commissioner to discover the true facts prior to the issuance of an enforcement notice on the other.
13. SY not unnaturally expressed in the complaint extreme distress and further claimed that the Nottinghamshire force "are ignoring directives regarding disclosure".
14. On receipt of the complaint the Commissioner responded to the Data Protection Officer of the Nottinghamshire Police reminding the Officer that under section 42 of the 1998 Act such complaints were treated as requests for assessments of processing. A number of questions were raised including queries as to whether SY's record on the PNC had been searched following the making of the Police complaint and whether on such search being conducted details of any previous convictions were passed to the Complaints Authority. By a reply dated 21 August 2002 the Data Protection Officer of the Nottinghamshire Force confirmed that the PNC had been searched but that the said search had been conducted "not … merely as a result of receiving the complaint but as part of the file assembled as part of the investigation into the complaint". The Data Protection Officer confirmed further that it was "standard practice to forward the PNC record of the police officer under investigation and the complainant". This practice was said to be routine in all cases where allegations were made against serving officers. The letter went on to state, however, that enquiries of related forces show that enquiries of related forces showed that "most" were using the same methods as Nottinghamshire and further went on to admit that there was "some confusion of doubts surrounding this issue". The Tribunal pauses here to note that although no evidence has been presented on this matter of differing practices it is perhaps regrettable that the arbitrary nature of the practice caused the prior conviction to emerge in circumstances which might have been different had another police force been involved.
15. Towards the end of 2002 the Commissioner entered into further exchanges with the Data Protection Officer of the Nottinghamshire force, the Commissioner's Office claiming that the PNC record of SY had not been weeded in accordance with guidelines then and still in force, namely those propounded by the Association of Chief Police Officers ("ACPO") to which further reference in detail will be made below. For the moment it is sufficient to refer to the fact that the Commissioner claimed that there had been an infringement of the Code of Practice for Data Protection prescribed by ACPO, in particular the so called General Rules for Criminal Records Weeding on Police Computer Systems. That was an overstatement since as will appear in the part of this judgment dealing in more detail with the general weeding rules, the police force in question, namely that of South Yorkshire, was in fact entitled under the rules then and now applicable not to delete the conviction data here in question.
16. It is, however, important to note the way in which the conviction of SY appeared. In a letter sent by the Nottinghamshire Data Protection Officer of Nottinghamshire Police to the Commissioner dated 26 November 2002 it was stated that the conviction being the subject of complaint by SY had appeared on the PNC "because of another offence that was committed in 1998 but subsequently dropped (for reasons not known or researched by myself)". There was also the statement that in 1998 SY appears to have created an alias, a fact appearing on the face of the print out and the letter went on to say that during the "process" for the incident in 1998 a PNC record was created, the letter going on to state as follows:

"… hence the 1998 PNC – ID and at the same time the 1979 assault was noticed, I assume by the South Yorkshire police checking their local system. A "back record conversion", from their local system was made thereby transferring the record onto the live PNC. This would have been as a result of someone noticing that this record should be on PNC in accordance with the weeding rules". (Emphasis in original).

17. The Tribunal quotes this letter for reasons which have already been touched on as well as for matters which will be dealt with below. The reason already referred to is the inherently unsatisfactory way in which an investigation can be conducted not simply by this Tribunal but also more particularly by the Commissioner into both the circumstances surrounding the original convictions and any matters which might have occurred since, at least without infringing the rights of the data subject. Moreover, the evolving nature of the technology which underpins the PNC system is clearly demonstrated by the quoted passage. The Tribunal was shown a copy of the print out relating to SY's conviction. If only for this reason the Tribunal feels it is entirely appropriate to note the events that are commented on as having occurred in 1998 and the record also contains a 1998 PNC ID since the first page of the print out refers specifically to a last known address as at 2 April 1998. It is, however, equally important to note that the print out (which was suitably redacted to accord with the directions issued by the Tribunal and as accepted by the parties) is not at all instructive about any information other than the absolutely bare facts of the original conviction save to give a numerical reference to the underlying arrest and/or summons together with a related numerical reference to the Court hearing or file. Evidence elicited during the course of the appeal before the Tribunal showed that despite attempts made by the parties to locate the Police file, if not the Court file, no relevant documentary files or records were found.
18. By early 2003 it was clear to all concerned that South Yorkshire Police was responsible for the weeding of the records and that the issue had crystallised into, according to the Commissioner, an unwarranted reliance upon the weeding rules criteria for extended retention. Not unnaturally the Commissioner relied upon the fact that only a conditional discharge had been ordered by the Juvenile Court in support of an argument that in the light of a conviction sustained 23 years ago there was every justification for claiming that the Fifth Data Protection principle had been violated. The Commissioner then served a preliminary enforcement notice on the South Yorkshire force on 11 July 2003 indicating that he was considering exercising his powers under section 40 of the 1998 Act to serve an enforcement notice requiring the Chief Constable to take steps to comply with the Third and Fifth Data Protection principles by deleting the relevant conviction data within 28 days and secondly within 3 months to carry out such changes to internal systems, procedures and policies necessary to ensure that all similar cases were weeded out of the PNC database.
19. The issuance of the preliminary enforcement notice coincided with exchanges which were then continuing between the Commissioner's Office and ACPO with regard to an ongoing review of data protection matters, in particular under the aegis of a group known as the PNC Data Quality Implementation Group. By a letter dated 20 August 2003 Mr Smith as Assistant Commissioner wrote to Deputy Chief Constable Readhead of the Hampshire Constabulary noting that the Group above referred to had been given the task of producing a new code of practice on PNC data quality by April 2004 under the Police Reform Act 2002. The letter was also the occasion for Mr Smith to express the Commissioner's "grave concerns" about the retention period specified in the current weeding guidance. Mr Smith noted that conviction and related data were held for two purposes on the PNC, namely first for what he called "traditional policing purpose" and also for the purpose of what he called "employment vetting". Mr Smith then noted that compliance with data protection principles had to be judged in relation to both those purposes and accepted that if data was to be retained which might otherwise be regarded as excessive for employment vetting but that the same data was to be retained because there was a policing need "that need must be sufficiently pressing to override the potential harm continued retention could cause to the data subject".
20. Mr Smith then voiced one possible solution, namely to reduce the standard retention periods for some or all categories of PNC data within the then existing legislative framework adding:

"For example, it might be that some data could be held in a way that makes them available to the police for their purposes but not to employers via the CRB"

The reference to the CRB was, of course, a reference to the Criminal Records Bureau hereafter called the "CRB". He therefore floated the idea of what he called "some form of partial weeding", as a possibility. He also noted that given the recent inclusion (largely prompted by decided case law) of DNA and finger print information which could properly be retained the Commissioner was "strongly of the view that increased retention of DNA and finger print information should not lead to increased retention of conviction information on the PNC". He added, however, that there was still a recognition on the part of the Commissioner "that the retention of such information in isolation will be of little value without further details to assist identification".

21. Mr Readhead responded formally to Mr Smith by letter dated 26 August 2003 pointing out that the work of the Implementation Group already referred to was being undertaken principally by Detective Chief Inspector Gary Linton (as he then was) who gave evidence before the Tribunal. Mr Readhead himself did not provide any evidence before the Tribunal but added in his letter that he had "no doubt that there are a number of cases that must always remain on PNC owing to the seriousness of the offence".
22. There then followed an oral hearing held on 2 September 2003 (a procedure which the Tribunal was informed in fact seldom occurs in practice). The Commissioner himself, Mr Richard Thomas, as well as Mr Smith and his colleagues, attended together with the Data Protection Officer of the South Yorkshire force, Miss Gill Bower-Lissaman. Miss Bower-Lissaman gave evidence before the Tribunal. In addition Mr Readhead and his Data Protection Officer, ie the officer attached to the Hampshire force were also in attendance. At this hearing the parties in effect set out their principal positions. First, it was claimed on the part of the Chief Constables that there is no discretion in the weeding rules, the rules being what were called "a stand alone document" which were not subject to paragraph 8.2 of the Code of Practice. Paragraph 8.2 reflected the terms of the Fifth Data Protection Principle which has already been quoted and prevailed upon persons responsible for data collections, ie largely the Data Protection Officer acting on behalf of the relevant Chief Constable to ask certain questions as to whether any particular items of personal information should be deleted, such questions being why the data were currently held, what purpose they served, were the data still relevant, were they up to date etc.
23. At the meeting the Commissioner was reminded that he had been fully consulted when the weeding rules were formulated and then great stress was placed on the need for consistency, a factor which was reiterated by Counsel on behalf of the Chief Constables in this appeal. The Chief Constable for South Yorkshire acting by Miss Bower-Lissaman also made a point that it was difficult to see how CRB checks could make any difference "because information relating to previous convictions would be required in any event for certain occupations". Reference was made to the fact that to amend data on the PNC a reference would have to be made to the National Identification Service known as the NIS, part of the Metropolitan Police, and finally it was acknowledged that the weeding rules had been subject to review and that ACPO was aware that it was "a dynamic process". In the light of the meeting the Commissioner himself decided to postpone a decision as to whether to serve an enforcement notice until January 2004 "pending discussions on a national level with ACPO". The Commissioner also agreed that he would limit any subsequent enforcement action to simply the deletion of SY's conviction data and not require review of the internal systems, procedures and policies. An enforcement notice was eventually served on 27 July 2004 requiring the Chief Constable to erase the relevant conviction data relating to SY. By that time discussions continued between the Commissioner's Office and ACPO and by the Autumn of 2003, the facts surrounding WY's case had already emerged.
24. With regard to WY, WY's date of birth is 1960. In April 1978 WY was sentenced in relation to 4 offences, being theft from a motor vehicle, taking a motor vehicle without the owner's consent, driving without insurance and driving whilst disqualified. For the offence of theft the Court imposed a 2 year probation order and made a compensation order in the sum of £150. With regard to the offence of taking a vehicle without the owner's consent the Court imposed a fine of £10 and disqualified WY from driving for a period of 18 months. In relation to the offence of no insurance and driving whilst disqualified WY was fined £10 and £5 respectively. In February 1979 WY was convicted of an offence of theft from a motor vehicle, driving whilst disqualified, driving without due care and attention, without insurance, without no test certificate, failing to stop after an accident, failing to report an accident and a further offence of driving whilst disqualified. For the offences of theft and driving whilst disqualified, WY was sentenced to 3 months in a detention centre, such sentences to run concurrently and disqualified from driving for 18 months. In respect of the other offences WY was fined. A request for assessment form was sent on behalf of WY dated 18 April 2003. WY maintained that it was not until early January 2003 that WY was and/or those acting on WY's behalf were informed by telephone that WY's record would be held for 100 years "as the custodial sentences in the record are aggregated together rather than being counted concurrently". This is a reference to the weeding rules to which reference has already been made and which will be reviewed more fully below. On 3 March 2003 a request was made to the West Yorkshire Police Force Data Protection Officer to exercise what was regarded by WY at least, a discretion "implied in the Code" to remove the record earlier than the recommended period "having regard to all the circumstances of the case". That request was declined by telephone and then by letter on 6 March 2003.
25. WY in the relevant portion of the Request for Assessment form stated that WY went to live in the United States in 1989 after winning a green card in what was described by WY as a "lottery system set up by the US Government". WY remained in employment, claiming to have a "highly responsible job" until November 2002. At that stage WY lost the employment in question and was informed that WY could not be re-employed "unless [WY] becomes a US citizen". WY therefore maintained that any success with regard to an application for such citizenship would be "likely to be seriously prejudiced". WY reiterated that the prejudice took the form of criminal behaviour committed at the age of 18, 24 years prior to the date of the assessment form. Of particular concern to WY was what WY called "the policy of aggregating the sentences".
26. The Tribunal was shown a print out provided by the PNC as of January 2002. The details set out above are there provided with no other material information, at least insofar as the same might otherwise explain the circumstances in which the offences were committed.
27. There was no evidence before the Tribunal that the revelation of the conviction data has in fact precluded or has yet to preclude WY from becoming a citizen of the United States although the same was maintained in the Appellants' skeleton argument.
28. An echo of the unfortunate factual uncertainties and complications which to some extent arose in the case of SY is reflected in the case of WY. A handwritten letter sent by a family member was provided no doubt to the Commissioner, if not earlier to the Data Protection Officer of the relevant force. In that note much more background was provided about the circumstances surrounding the incidents which led to the convictions. The Tribunal feels, as indicated above, that it is utterly impossible for it to make any determination about the accuracy or otherwise of the observations made. It is enough to repeat the point made earlier that the same problem invariably presents itself starkly to a Chief Constable who must in any given case irrespective of the weeding rules determine whether it is appropriate for any particular set of conviction data to be expunged. It is not difficult to imagine cases where it would be invidious for a Chief Constable to contemplate deleting a record faced on the one hand with the no doubt sincere expressions of family recollections as to what may have happened in a given court eg a Magistrates Court by those who acted for or on behalf of a data subject and on the other with a file or files, when such file or files, if there be one, might otherwise remain silent on the matter. For all the above reasons the Tribunal is not minded to revisit the contents of the commentary provided on behalf of WY with regard to the circumstances surrounding the original incidents leading to WY's convictions.
29. Not unnaturally the response by the Data Protection Officer of the West Yorkshire force was to rely upon the weeding rules which have been referred to.
30. Equally not unnaturally, the Commissioner in his exchanges with the Data Protection Office of the West Yorkshire force relied upon the fact that offences were committed at a time when WY was about 17 or 18 years of age with a 25 year time gap. The Commissioner relied on the apparent absence of any re-offending since 1979 adding that bearing in mind the nature of the offences that:

"… it would appear highly unlikely that there would be repeat offences of a similar nature and consequence of the relevance of retaining this data for 100 years would appear to be somewhat questionable".

31. The West Yorkshire Data Protection Officer responded that the weeding rules applied given the fact that against a total of 13 convictions, 3 were for theft of which 2 were dealt with by way of custodial sentences, the second of the 2 further separate occasions being in respect of driving whilst disqualified, leading to a yet further custodial sentence. In the circumstances no discretion arose.
32. A preliminary enforcement notice was served on the Second Appellant on 3 September 2003 with an indication that the Commissioner was inclined to serve an enforcement notice requiring deletion of the relevant conviction data in 28 days. Following the representations from the Second Appellant an enforcement notice was served on 27 July 2004 requiring the Appellant to erase the data conviction material. An appeal against the enforcement notice was lodged on 25 August 2004. The same occurred 5 days after the First Appellant served a notice of appeal in respect of SY's data conviction.
33. NW was born in 1949. The Request for Assessment is stamped 20 October 2003 and is dated 15 October 2003. The facts are relatively straight-forward. An Enhanced Disclosure was effected in respect of NW confirming not simply the date of birth but the following conviction details, namely: in February 1967 NW was convicted of stealing or attempting to steal under the Larceny Act, section 16 and fined £5. Further on 14 August 1967 three further offences were noted being first taking and driving away a motor vehicle without the owner's consent coupled with simple larceny under the Road Traffic Act 1960 and receiving also under the Larceny Act 1916 for which a probationary order was ordered for a 3 year term in respect of all three offences with restitution in the sum of £5. The third conviction occurred in August 1967 and also consisted of taking and driving away a motor vehicle without the owner's consent under the Road Traffic Act 1960 for which a conditional discharge of 12 months was imposed. The fourth offence concerned a conviction in July 1968 regarding simple larceny for which a fine of £5 was imposed and finally the fifth conviction was dated January 1969 consisting of three offences, the first being taking and driving away a motor vehicle without consent for which a 3 month disqualification was ordered coupled with simple larceny for which 3 months imprisonment was imposed. It was rightly pointed out in NW's request for assessment that the length of time that had elapsed was the best part of 34 years. The overall effect of the convictions noted above was to impose a term of imprisonment of in excess of 6 months of which it seems NW served 2 months according to NW's own request.
34. In such a case where aggregates are taken into account of periods in excess of 6 months, convictions remain on the PNC until the subject dies or until the age of 100 is reached, the reason being that very often it is impossible to know of the fact of death in an earlier period. By a letter dated 26 November 2003 the Commissioner's compliance officer wrote to the data protection co-ordinator of the North Wales Police claiming that the case of NW in these particular circumstances led to the assessment by the Commissioner that processing of the data was a breach of the Fifth Data Protection Principle requirements.
35. By a further exchange of 11 March 2004 emanating from the Chief Constable's office the assistant Chief Constable asserted that the particular request "has been considered on its own merits; on a case by case basis". The letter went on to say that the personal data in respect of NW was obtained "for the policing purpose and has been retained since that time for that same purpose." That purpose was described as including "the prevention of crime" with, it was said, "vetting" being a form of crime prevention "and therefore [it] sits well within our Policing Purpose". A further letter of 21 May 2004, again from the Assistant Chief Constable pointed out that there were in fact 8 offences committed over a period of 3 years under the reference of 5 different arrest summonses and mindful of the then current ACPO retention guidelines, the data would be retained. In the case of NW, written representations were drafted on behalf of the Chief Constable of the force in respect of a preliminary notice that was then issued dated 3 August 2004. There is little point in citing these since they were overtaken and amplified by the submissions in due course made on the part of the Appellants. In due course an enforcement notice in respect of NW was served under cover of a letter dated 5 October 2004.

The Weeding Rules

36. ACPO issued its first code of practice for police computer systems in December 1987. Much of that first edition is reproduced in subsequent editions. The then Data Protection Registrar, Mr Eric Howe wrote a Foreword which stressed the fact that as a result of exchanges between his office, ie what is now the Commissioner's Office on the one hand and ACPO on the other, the code of practice was duly fashioned. Under paragraph 1.2 the scope of the code of practice was stated in terms to be "a general statement which does not set out detailed rules for operating computer systems". Each of the data protection principles was then the subject of specific commentary. The present third data protection principle was then principle 4 and no interpretation was provided other than first an observation in general terms that adequacy was required, and secondly that with regard to relevance chief officers should give clear guidance on what procedures were to be adopted and reiterating the fact that data was not to be excessive. It is fair to say that stress was placed on the particular systems which each individual force might set up. With regard to the present fifth data protection principle, then principle 6, again it was stressed that forces should have procedures to ensure that personal data which were processed automatically should be "periodically reviewed and data no longer required are removed (weeded) from data collections." The commentary at paragraph 2.6.2 stressed that it was "not possible to lay down absolute rules about how long particular items of personal data which form part of a collection should be retained". However, the same paragraph stressed that in determining particular questions as to why data was held and what purpose it might serve etc, what had to be taken into account included three principal matters, namely first the individual concerned and the circumstances with regard to the information recorded, secondly the age of the data and thirdly to what extent the data was used and therefore required. The commentary went on to stress that even where a general policy was not adopted "the need remains for all personal data to be kept under review".
37. With regard to convictions for what were called reportable and non-reportable offences it was stressed that records would not be deleted in four instances, being first indecency offences, secondly where the aggregate sentence exceeded 6 months in custody, thirdly where there was a trace of mental ill-health and fourthly with regard to offences of homicide.
38. The next edition bore a copyright date of 1995. The same format was applied and this time the foreword was signed by Elizabeth France, the then Data Protection Registrar. She stressed as was stressed by the Commissioner in the present appeal that the "recommended retention period can only ever be a benchmark". She added "there may be cases where data should be held for longer, or indeed shorter, periods than those recommended". There had clearly been further exchanges between ACPO and her office although it is fair to say that the content of the commentary remained much the same with regard to the two data protection principles now in issue.
39. The present code does not bear a date but clearly follows in the wake of the 1998 Act. Again Elizabeth France provided the foreword. She stressed that the 1998 Act was reflective of the European Directive to which reference will be made below and which "increased emphasis on the importance of codes of practice". She added as follows, namely:

"Particularly now that the [CRB] is operational the need for accuracy of personal information has never been greater. My concerns about the quality of data on the [PNC] are well known. I am encouraged by the efforts that are being made to bring about improvements but would emphasise that as modern day policing increasingly relies on sophisticated information systems there must be a strong commitment to properly maintaining those systems.".

40. Significantly she then goes on to say the following, namely:

"I am obliged to examine on its merits any request for assessment of compliance with the Act made to me. In doing so, I shall of course take into account the specified retention periods contained in the code but must also look at the particular circumstances of the case".

41. In section 3 of the present code in the section headed "Areas of responsibility" reference is made to the duties incumbent upon a force data protection officer. In particular it is noted that the role of that officer is to ensure that "information and systems comply with the data protection principle and that appropriate security arrangements exist to protect data …". In addition one particular aspect of the officer's duty is to liaise on all matters between his or her force and the ACPO Data Protection Portfolio Group together with the Information Commissioner's own office.
42. By this stage the Fifth Data Protection Principle had been republished and it is fair to say that the commentary under the relevant section dealing with retention of personal information with regard to that principle, namely section 8, reflects previous editions in substance, ie that the persons responsible for data collections have to ask certain specific questions including why the data is held, what purpose the data serves and whether the data is still relevant as well as similar questions. In paragraph 8.3 there is a section headed "Guidelines for the review and removal of personal information". It is recognised that it is not possible to formulate absolute guidelines and that when data has in fact served its purpose it should be removed. In paragraph 8.4 there appears the critical section headed "The General Rules for Criminal Record Weeding on Police systems". These paragraphs reflect numbering set out in accordance with the ACPO Crime Committee Policy circulated on 29 September 1999 and amended on 1 November 2000.
43. For present purposes the critical rules are in paragraph 5 under section 8.4 dealing with records including convictions for recordable offences. By sub paragraph 5.4 if the record contains a conviction for offences involving indecency, sexual offences, violence or the trafficking or importation of drugs etc, then the record is to be retained until death or until the subject reaches 100 years of age. Appended to the copy of the Code of Practice presently being reviewed, at least as presented before the Tribunal, are separate self standing Weeding Rules for criminal records endorsed by the ACPO crime committee on 23 September 1999. In effect the content of those weeding rules are reflected within the body of the Code of Practice itself and need not be repeated here. Attached to the Weeding Rules is a schedule headed "offences which will be retained for life". Here there is an extensive list of specified offences under the expected headings such as violence, indecency/sexual etc. Under the heading of violence and classified as offence code 1 is assault occasioning actual bodily harm and bearing the code or number 1.8.12.
44. The general weeding rules in particular those in paragraph 8.4 (which will be cited below) were also the subject of a recent review having been promulgated in accordance with a numbering prescribed by the ACPO Crime Committee Policy circulated 29 September 1999 as amended on 1 November 2000. Here there is a substantial change in the periods which are addressed by the new and present Code. If a subject has not been convicted for a recordable offence for a period of 10 years from the date of last conviction then unless the record contains 3 or more convictions for recordable offences (paragraph 5.2) the record is to be deleted after 10 years. The principal exception to this is in paragraph 5.1 which provides that if the record contains a total of six months or more imprisonment including suspended sentences on an aggregated basis then in accordance with paragraph 6 the record is to be retained until death or 100 years. For that simple reason under the present edition of the Code all three present cases are subject to the 100 year rule. In the case of SY, SY's data is retained on account of there having been a conviction for violence; in the cases of NW and WY, data is retained because the record in each case reflected a sentence of six months or more.
45. The Code has attached to it (at least as presented to the Tribunal) a separate document being the Weeding Rules for criminal records as endorsed by the ACPO Crime Committee in September 1999 referred to within the body of the Code. This is a separate document but is repeated verbatim within the body of the Code. According to the documents presented at the Tribunal the Weeding Rules have attached to them a separate schedule or separate schedules categorising particular offences which form the subject matter of the weeding rules.
46. Of particular relevance in the section headed violence (under a description known as offence code 1 under sub paragraph 1.8.12) is the offence of assault occasioning actual bodily harm the offence of which SY was found guilty. There are equally extensive sections dealing with indecency/sexual offences, criminal damage, theft, terrorism, drugs and fire arms.

A proposed new set of retention guidelines: current consultation

47. By a consultation paper issued by ACPO dated 9 February 2005 draft retention Guidelines for Nominal Records on the Police National Computer were issued by ACPO. The introduction takes up one point already made in this judgment. This is that in recent years "there have been some significant changes in terms of legislation and public expectation" calling for what the consultation paper called a "completely new and radical approach to this area of police activity."

One self evident development was the introduction of the CRB in 2002 which provided the disclosure service: the consultation paper observed equally self evidently perhaps, that use of the CRB was made by an increasing number of organisations and entities who had had a significant impact with more people becoming aware that data relating to them was and is held on the PNC. One example of the evolution of development of data in this area is also given in the introduction namely the extension of the issue of fixed penalty notices ("PND") for traffic offences to cover, under the extended scheme, on the spot penalties for disorderly behaviour, offences regarding drunkenness etc. So far as that scheme extends or is likely to extend to recordable offences such events are to be recorded on the PNC. Even though a penalty notice for disorder or PND would not as such be regarded as a criminal offence for court or employment vetting purposes, a nominal record would be retained and in the case of DNA and finger print samples links would be provided to those samples.

48. Of abiding concern at least according to this introduction is the desire on the part of the police to hold sufficient personal data to identify individuals in the event of those individuals leaving DNA or finger prints at a crime scene.
49. A Consultation Paper followed in the wake of the Bichard Inquiry Report and noted that one of the aims of the Inquiry was to produce a code on information management with the added intention that any future retention guidelines agreed between ACPO and the Commissioner would form part of that Code. As indicated above and as confirmed during the course of the appeals neither objective has at yet been achieved.
50. The critical potential change addressed by the Consultation Paper is the possibility that access to nominal records consisting principally of convictions, acquittals, penalty notices and CJ arrestees should be restricted to police users only. To quote the introduction:

"other users of PNC should be unaware of the existence of such records, save for those occasions where the individual is the subject of an Enhanced check under the Criminal Records Bureau vetting process. In those cases the data should be dealt with as intelligence and only disclosed on the authority of the Chief Constable or delegated authority."

Reference to a "CJ arrestee" reflects amendments introduced by the Criminal Justice Act 2003 to allow the police to take DNA samples and fingerprints from all those detained at a police station having been arrested for a recordable offence.

51. The Consultation Paper however stressed an aspect of the present appeal which was further emphasised during the hearing namely the need to make a clear distinction between on the one hand retention for operational police and related purposes and on the other the use that other users or recipients might make of the data. This in turn yields a suggestion in the Consultation Paper of what is called a step model or as it was sometimes put during the hearing a step down process, the concept of which was simply to restrict access to certain data fields to non police users of the PNC after set periods of time whilst allowing the police continued access in support of operational policing. The essence of the scheme was to ensure that so called clear periods would be articulated determining the time at which the offence history would step down in an effort to encourage rehabilitation. Should a subject re-offend within such a clear period then the clock would be, as it were, reset from that time and a further clear period begin. Specimen guidelines address the case of a young person receiving a custodial sentence in respect of an offence listed similar to the list of offences currently appended to the present weeding rules. In such a case a conviction history would, it was suggested, step down after a 30 year "clear period". In effect the same system will apply with regard to an adult offender receiving a custodial sentence in respect of an offence listed in a separate schedule where again a 30 year step down period will apply. It was suggested during the hearing that the latter category would apply were the circumstances translated into the proposed new regime to the cases of all 3 of the present appeals. Finally certain offences where the sentence was fixed by law or were otherwise defined as serious offences under section 109 of the Powers of Criminal Courts (Sentencing) Act 2000 were never to be deleted and only in exceptional circumstances outside the listed categories would chief officers be able to exercise their right to delete any other specific conviction.
52. Further detailed enquiries made after the conclusion of the hearing of these appeals on behalf of the Tribunal have further clarified the position as follows. In the case of SY, the offence would be regarded as so called Category C Offence, albeit a non-custodial one. Since at the time of the offence SY was 15 and thus a Young Person under the proposed system, the offence was stepped down after a clear period of 10 years by which time SY would have attained the age of 25. Thereafter the conviction history would be available only to the police for use in support of policing purposes.

WY was 17 at the relevant time, i.e. in 1978, at the commission of the first offence and would therefore also be treated as a Young Person. Again, the offence would be Category C and non-custodial. However in 1979, WY would have been an Adult, but again the offence would be Category C. The sentences totalled 6 months in custody. All offences including those from 1978 were stepped down after a clear period of 30 years by which time WY would attain the age of 48. Thereafter the conviction history would be available only to the police for use in support of policing purposes.

Finally in the case of NW, NW was 17 at the relevant time and thus a Young Person. The first sentence was non-custodial and the offence would step-down after 10 years. At the time of the convictions in 1967 and 1968, NW was 18 and an Adult. Again all the offences would be Category C. All offences including those from 1967 would step-down after a clear period of 12 years from about July 1968. At the time of the conviction in 1969, the offences would be Category C. All offences would step-down after a clear period of 15 years when NW would be 34. Thereafter the conviction history would be available only to the police in support of their policing purposes.

53. The Tribunal was also shown a Joint Report by the ACPO DNA and Finger Print Retention Project working in tandem with the Hampshire Constabulary, the author of which principally was Detective Superintendent Linton. This Report is entitled "Exploring Operational Policing Views Concerning the Retention of Conviction, Acquittal and Arrest History on the Police National Computer." The version shown to the Tribunal is dated 25 February 2005 and it is clear if only from the key findings of the research concerning the retention of nominal data that the fruits of this project went into the consultation paper which has just been referred to. Indeed one of the stated aims of the research is expressed as the need to explore the operational policing value in retaining nominal data on the PNC with regard to, among other information, conviction history. The Tribunal was to some extent sceptical if not critical of the somewhat anecdotal nature of this Report but mindful of observations which will be made below recognises that it represented a bona fide attempt on the part of ACPO to demonstrate that in the balancing act which needed to be addressed namely the importance to protect the rights of individuals against the need to protect society's interests there were arguable factors justifying a need to retain nominal data in the way reflected in the present weeding rules and in the proposed step down model.
54. It is perhaps sufficient for present purposes to focus on some of the key findings referred to. First the Joint Report included that all categories of data provided a clear indication that an individual had come to the notice of the police on a previous occasion or occasions. Secondly, the police service as a whole depended upon information in order to make value judgements about people with whom it came into contact. Thirdly emerging patterns of behaviour could more easily be identified by retaining data on the national system coupled with the usefulness of historical data as recent data in order to establish patterns of behaviour or to confirm an individual's identity. Other findings perhaps were predicated on the assumption that more information than the bare conviction data would in a normal case be retained, such of course not being the case in the present three appeals. Indeed it is fair to say that the Joint Report itself concentrated not simply upon conviction data per se but also what it called "an aspect of a person's character identified in previous offending" as often being relevant to pending or future criminal investigation. The Tribunal feels that in all the circumstances the Report is only a partial justification for retention of the form of data with which the Tribunal is presently concerned and that it would have benefited from greater empirical analysis of the precise use to which pure conviction data of the type considered in the three present cases might be put in the realm of operational policing purposes generally.
55. The Tribunal was shown a further Report of which Detective Superintendent Linton was also the author, again issued by way of a Joint Report by the ACPO DNA and Finger Print Retention Project together with the Hampshire Constabulary and being a subsequent version of the report just referred to. It is fair to say that the key points remain the same: it is also fair to say that both versions further stress the point made above namely that little research has been carried out in respect of the business benefits to the Police Service retaining what are called "minor conviction histories" on the PNC. There was some debate during the hearing as to the precise meaning of the phrase "minor convictions" in particular as to whether the three cases currently before the Tribunal on appeal that could probably be said to be regarded as such. On the basis of the evidence presented before it the Tribunal is not prepared to assume that the clear seriousness attributable to the three cases in question could in any meaningful sense be regarded as minor but in any event both versions of the Joint Report go on to state as follows namely:

"Similarly, given that the legislation, which requires the retention of arrest and acquittal information to be retained on PNC is recent, no research is known to exist in this area".

56. The Joint Report in its two versions just referred to has been condensed into a summary proposal for consideration by the ACPO Council (again authored by Detective Superintendent Linton) in an undated document entitled "Retention Guidelines for Nominal Records on the Police National Computer: a summary of proposals for consideration by ACPO Council". This summary is a useful condensation of the materials which have already been described. Superintendent Linton summaries the key features of the proposed step down model but adds as at the date of the summary which is 5 October 2004 that the model then proposed had not then found complete favour with the Information Commissioner who took issue with the 100 year rule and who had also taken objection in a manner unspecified in the summary in respect of "links to conviction, acquittal and arrest history." Superintendent Linton's final comment is that as at October 2004 "a comprehensive Report" dealing with all the relevant issues was then in the process of being prepared by the DNA and Finger Print Retention Project.

The Bichard Inquiry

57. The Tribunal was provided with copies of the Bichard Inquiry Report. No evidence was produced orally before the Tribunal about the ramifications of the Bichard Inquiry upon the present appeals other than in the most general terms. The Bichard Inquiry issued its Report in June 2004. The background is well known and concerns the aftermath of the case of Ian Huntley who was convicted of the murders of Jessica Chapman and Holly Wells. The Inquiry was set up by the Home Secretary in particular "to assess the effectiveness of the relevant intelligence based record keeping, the vetting practices in [the relevant police forces] since 1995 and information sharing with other agencies and to report to the Home Secretary on matters of local and national relevance and make recommendations as appropriate".
58. The Tribunal however is sensitive to various matters which emanate from any sensible reading of the Report. First the Report was deeply concerned as to the way in which police officers of various levels were "alarmingly ignorant" of how records were created and how the relevant systems worked. The Huntley case involved a failure to assess or assimilate what has been called soft information i.e. non conviction data in the case of Ian Huntley and while the principal criticisms contained in the Bichard Inquiry Report were directed at "intelligence systems", the Tribunal feels that they clearly have ramifications as far as the issues directly involved before the Tribunal on the present appeals are concerned (see para 10 the Bichard Inquiry Report Recommendations).
59. Throughout the hearing before the Tribunal in the present case reference has been made to "weeding" and "review" and terms such as deletion or erasure. The Tribunal feels that there has not been a consistency of treatment with regard to the use of these expressions. No doubt the terms weeding deletion and erasure are intended to mean the same but the matter is not entirely free from doubt even on a semantic level. Nor has the Tribunal heard clear evidence as to the technological aspects of deletion although the suggestion was made by one witness that deletion would mean deletion for all purposes. Nonetheless even for the purposes of future debate, if such be the case between ACPO and the Information Commissioner the Tribunal respectfully suggests that a more unequivocal expression than weeding be employed if what is to be denoted is deletion (see Bichard Inquiry Report Recommendations para 11).
60. Even on the basis of the materials which have been described above in this judgment the Tribunal feels that better guidance is needed in relation to each aspect of information gathering i.e. collection, retention, deletion use and sharing. It has been seen that the ACPO Code of Practice refers to the function and purpose of the office of a particular Forces Data Protection Officer. Nonetheless reflective of the recommendations in the Bichard Inquiry Report the Tribunal also respectfully suggests that officers and staff at all levels be formally acquainted with a better understanding of all pertinent data protection requirements. (Bichard Inquiry Report Recommendations para 23).
61. The Bichard Inquiry Report was particularly impressed by progress made in Scotland (see Bichard supra para 51). Certainly it seems that the soft information system namely the system known as IPLX (as to which see paragraph 99 below) is in a more advanced state of development in Scotland than south of the border. The Tribunal feels that as a matter of common sense if nothing else it is desirable that experiences and lessons be exchanged and learnt across the border.
62. The Bichard Inquiry Report mentions at various points the delays which occurred in entering data on to the PNC generally. Again, the Tribunal has considered that it is clearly desirable that any data whether conviction data or not be entered as soon as reasonably practicable. On a broader note, the Tribunal is not entirely sure how the comments made by the Bichard Inquiry Report Recommendations (see in particular paragraph 68 and following) with regard to the need for a new national code of practice remain relevant and given the particular exchanges currently being in limbo between ACPO and the Commissioner. There would seem to be some needless duplication at least at face value between the national code of practice proposed by the Bichard Inquiry Report designed to cover record creation, retention, deletion and information sharing and any new edition that might be proposed or entered into between ACPO and the Commissioner.
63. Since the conclusion of the hearing of the present appeals, the Tribunal has learnt that the Code of Practice produced as a result of the Bichard Inquiry Report is due to take effect from November 2005. The Tribunal has read the proposed version of the Code and is of the opinion that it remains in many respects vague leaving much to be further agreed or established. If anything, the present Code of Practice appears more helpful in that it at least enters into greater detail and guidance. The Tribunal also feels that police forces are more likely to respond to provisions set out by way of Code or otherwise which have a degree of direction or instruction inherent within them as distinct from principles which are framed merely in terms of guidance. This point will be revisited later in this judgment.
64. One of the particular improvements suggested by the Bichard Inquiry Report Recommendations is a register to be introduced of those who wish to work with children or vulnerable adults. This is a key feature, it is claimed by the Appellants, of their police operational responsibilities. At paragraph 63 the Report states as follows namely:

"The register would be constantly updated, following the introduction next year of a new system (PLX) that will indicate when police forces hold intelligence on an individual. The register could be easily accessed – subject to security protection – by any employer, large or small, including parents employing tutors or sports coaches. Such a system would relieve the police of the responsibility of deciding what information should be released to employers and would simplify arrangements for employers. It could – and I think it should – incorporate an appeal process for applicants who were refused registration. It would also avoid information about past convictions being released to prospective employers without reference first to the individual concerned."

65. The Tribunal with great respect finds this paragraph particularly confusing and perhaps even unhelpful. It purports to address processes or procedures that are already in place but it is not contended that past convictions cannot already be disclosed with the authority of the individuals concerned. Of particular concern in this paragraph is a suggestion that responsibility for updating might be removed from the police which seems at odds if nothing else with the present state of play and the discussions between ACPO and the Commissioner.
66. At paragraphs 68 and 69 of the Bichard Inquiry Report Recommendations the following sections appear namely:

"Clear guidance on record creation, retention, review, deletion and the showing of information.

Although there is much advice and guidance already in existence, it is subject to local interpretation and leaves scope for confusion between the concept of "review" on the one hand and "deletion" on the other. In some circumstances, the guidance is unclear about the retention of conviction–related information and leads to inconsistent decisions about the retention of criminal intelligence (that is, non-conviction related information).

As a result, the possibility of valuable intelligence being lost prematurely is significant. I believe, therefore, that a new national code of practice needed, and that it should be made under the Police Reform Act to ensure that it is applied across the country. It needs to be clear and designed to help police officers in the front line. It should supersede all existing guidance and cover the capture, review, retention or deletion of all information (whether or not it is conviction related). The Code should also cover the showing of information by the police with partner agencies."

As referred to above, the Tribunal given the evidence presented before it on these appeals feels that the word "guidance" is to some extent misleading. The confusion that arises is amplified if nothing else by the Appellants' contention that the Weeding Rules provide almost a consistent and inflexible rule of practice going far beyond any form of guidance. The Tribunal feels that should ACPO and the Commissioner reinstitute a dialogue as to the way forward whether or not under the umbrella of a new national code of practice propounded by the Bichard Report, the Appellants if nothing else together with the other 40 chief police officers in England and Wales would clearly benefit from clear specific instructions as distinct from guidance. Indeed the parties themselves have at various points indicated that this sort of change might be in the end the best way forward.

67. Given the criticisms of the Humberside force made by the Bichard Inquiry Report it is perhaps not surprising that it found and confirmed that the Humberside police had not followed the ACPO Code of Practice for Data Protection (1995 version). This is a repetition of a point already made, namely that the way in which the Code of Practice has been interpreted has clearly varied widely from force to force so that any future edition again whether or not incorporated in the suggested Code of Practice or otherwise needs to ensure that each force applies any relevant instructions on a consistent basis.
68. At paragraph 2.49 of the Bichard Inquiry Report in a section dealing with Contacts, Recruitment and Vetting: the following appears namely:

"As a result of data protection legislation, there is a need for the police to periodically review intelligence and other records. There are two basic functions involved: review and, if appropriate, deletion. There is an obvious and critical distinction between the two."

Given the commentary upon the ACPO rules which has been made above the Tribunal feels that the quoted passage perhaps understates the position. The spirit and purpose behind the ACPO Codes of Practice even in their earlier incarnations show that review and/or deletion should represent ongoing activities under the aegis of the particular Data Protection Officer who is answerable to the Chief Constable. It is to be noted however that no reference is made to the concept of weeding and that subject to any technological impediment the Tribunal would agree that what should be aimed for in the wake of an ongoing review should be deletion in the sense of permanent removal and nothing short of that. The need for an ongoing review system is emphasised at various points in the Bichard Inquiry Report see e.g. para 2.104 where the Chief Constable of Humberside was said to have acknowledged in his report to the Inquiry that there "had been inconsistent review and deletion practices in the three main databases".

69. Nonetheless the Tribunal feels strongly that all decisions reporting the scope of operational policing should remain solely within the province of a particular police force. The Bichard Inquiry Report indicated how the Humberside Police Authority could not entirely escape responsibility for serious failings in systems and management in the Humberside area in the relevant period but the Tribunal does not interpret that criticism as being any way an endorsement by the Bichard Inquiry Report that a police authority in respect of any given area has the right to trespass upon operational police activity. The Tribunal respectfully suggests that the same demarcation should exist with regard to other entities such as the Information Commissioner but is fully aware that it has never been suggested on the part of the Information Commissioner that other than by virtue of applying the relevant protections prescribed in the 1998 Act the Commissioner could or indeed would seek to play any part in operational police activity.
70. The Tribunal regards the description set out in the Bichard Inquiry Report of the policing structure up to and past October 2002 as particularly instructive. It notes that at paragraph 3.29 reference is made to an organisation known as the Police Information Technology Organisation ("PITO") described as having a "strategic and technical role in the development, procurement and implementation of IT at a national level." Very little if anything was said about the role of PITO during the course of the appeal before the Tribunal, but mindful of the comments already made with regard to continuing evolution not only in the realms of legislation and policy but also in the realm of technology it is to be hoped and expected that the parties would in any future dialogue liaise with PITO to ensure that the most efficient and responsive systems are at least being considered given the dramatic growth of the PNC and of local systems. Of particular value is the reminder set out by the Bichard Inquiry Report that it is clearly desirable that any further developments in the dialogue between the Commission and ACPO be heeded if not absorbed not only by the 43 police forces in England and Wales but also by the further 8 forces existing in Scotland together with the police service in Northern Ireland and 3 off shore forces namely States of Jersey, Guernsey and the Isle of Man together with the British Transport Police. In addition there are 3 other forces namely the Ministry of Defence Police, the UK Atomic Energy Constabulary and the Port of Dover Police. The Tribunal is not entirely clear given the absence of evidence on this point as to whether these last three entities have been registered as data controllers but as a practical matter it is clearly desirable that any code of practice that is in future engaged upon be at least considered or canvassed before these additional forces.
71. The Bichard Inquiry Report refers to no fewer than five detailed Reports on issues arising since 1995 being the date when individual police forces first assumed responsibility for putting records on the PNC with regard to what the Bichard Inquiry Report called major and continuing problems, especially with the timeliness of record creation. The Tribunal has not been shown copies of these Reports being one by PITO in 1996, the second by a Home Office police research group as well as three by Her Majesty's Inspectorate of Constabulary but feels that the fact that such Reports were required shows that clearly much work remains to be done in establishing a workable system not only with regard to creation but also with regard to review and deletion. Of much greater importance is the specific recommendation made in paragraph 3.67 to the ACPO Code of Practice on Data Protection in 2002 to which reference has already been made. As this Tribunal has already noted and as the Bichard Inquiry Report itself confirmed, a 2002 edition "does little more than summarise the importance, highlighted by the data protection legislation of information being relevant, accurate and up to date. The experience of this

Inquiry indicates that there is a pressing need for clearer guidance in this area" (emphasis supplied).

72. The Tribunal notes with interest the description of the relationship between ACPO and the Commissioner at paragraph 4.5 and following. The Tribunal respectfully endorses the comments of the Inquiry to the effect that the relationship in question "needs to be close and constructive if confusion and uncertainty are to be avoided." The Tribunal wishes to state unequivocally that the apparent lack of harmony that occurred between the Commissioner and ACPO during the course of the Bichard Inquiry was in no way duplicated during the hearing of these appeals: rather the contrary. Indeed the Tribunal during the course of the hearing expressed its indebtedness to both parties for the courteous and cooperative manner in which the appeals were prepared and argued. On the other hand the Bichard Inquiry Report itself made patently clear at paragraph 4.6 that a clear delineation of function is required between on the one hand ACPO and on the other the Commissioner in the fulfilment of the latter's statutory obligations to challenge any and all decisions relating to retention of conviction information where it was deemed appropriate.
73. Equally the Tribunal endorses the comments made at paragraph 4.45 of the Bichard Inquiry Report with regard to the proposed new Code on Data Protection subject to the points made above as to the precise role which such a new Code is designed or was intended to fulfil. The Tribunal therefore is of the view that it could do no better than recite in terms the passages in question namely:

"4.45.1The police are the first to judge of their operational needs and the primary decision makers; the Information Commissioner's role is a reviewing or supervisory one

45.2 Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office "cannot and should not substitute [their] judgement for that of experienced practitioners". His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, "that should be the end of the story".

45.3 There is, at present, considerable latitude extending both to decisions about how long to retain records and about when to disclose information (under the Enhanced Disclosure regime, for example, in the employment vetting context).

45.4 It could be presumed to be reasonable if, after discussions with the Information Commissioner, certain categories of information were retained for specified periods, whilst still allowing the right of challenge in individual cases.

45.5 In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (and that is, disclosing) that information, and is correspondingly easier to justify."

74. The Bichard Inquiry Report was critical of the disclosure provisions set out in the Police Act 1997 to which brief reference has already been made. As will be explained below, section 112 of the Police Act 1997 provides for a "Criminal Conviction Certificate" which would reveal the convictions of a job applicant not yet spent under the Rehabilitation of Offenders Act (see Bichard Inquiry Report 4.67). However, just as was the case as at the date of the Bichard Inquiry Report itself, this section is not yet in force and would not in any event apply to applicants seeking jobs with children or vulnerable adults. The Report was however critical of the distinction drawn between standard and enhanced disclosures. As to the former disclosure it is regarded as appropriate if the job involves work in a so called "regulated position" i.e. jobs in an educational institution including not unnaturally teaching as well as the caring for training, supervising or being in sole charge of children or in the case of a further education institute where the normal duties involve regular contact with people under 18. Such disclosures will yield details of all spent convictions on the PNC together with details of any cautions, reprimands or warnings held at national level. The disclosability of such convictions in turn of course depends upon the application of the weeding rules which have been reviewed. In addition such disclosure will contain details of whether or not the job applicant appears on e.g. specified lists dealing with the protection of children under the Protection of Children Act maintained by the Department of Education and Science.
75. On the other hand, enhanced disclosure is treated as being appropriate where the job involves "regularly caring for training, supervising or being in sole charge of people aged under 18" (emphasis in original). As the Bichard Inquiry Report observes at para 4.72 and following, this particular form of disclosure provides the same information as standard disclosure together with any relevant local police intelligence held by forces whose areas cover the addresses provided by an applicant for the previous 5 years. The Inquiry was critical of the distinction created by use of the word "regularly" emphasised above. This was largely because different employers are likely to have different views about where the distinction lies yielding the distinct possibility of inconsistency. The acuteness of the problem was highlighted by the position for which Ian Huntley himself was vetted namely that of school caretaker. The Tribunal respectfully agrees with the observations made by the Bichard Inquiry Report so far as they are relevant to the present appeals. The issues before the Tribunal concern the breaches or alleged breaches of the Third and Fifth Data Protection Principle and demand close consideration of the manner in which and the duration according to which data is held. As such the criticism made by the Bichard Inquiry Report on this issue do not bear upon the issues which the Tribunal has to determine.
76. Next the Tribunal also endorses the observations made in paragraph 4.102 and following of the Bichard Inquiry Report to the effect that in the disclosure process whether standard or enhanced, all conviction or caution information will generally be revealed to an employer whilst judgements do need to be made about the disclosure of intelligence i.e. non conviction data held on local police systems at the time of the vetting. At para 4.105 the following passage appears namely:

"There was a clear consensus in the evidence, including that from ACPO, in favour of taking the decision about what information should, and should not, be disclosed out of police hands. That consensus is, in my view, supported by a range of compelling arguments:

105.1 The current system depends upon decision making by 43 Chief Constables… Inconsistency is inevitable even where the system is monitored or as it is by a former senior circuit judge Sir Rhys Davies.

105.2 Although I recognise that the purpose of vetting is crime prevention

– a core police task – the judgement about relevance for the disclosure of intelligence is a distraction from "normal" policing duties that a hard pressed police service can ill afford.

105.3 There is also a risk that the police will blur the decisions about whether information should be retained and whether it should be disclosed. These are different issues, not least because the relevance of Article 8 of the European Convention on Human Rights… is markedly different in the separate contexts. For example, it may be justifiable for a police force to interfere with a person's private and family life to the extent of retaining confidential information on him/her, but not justifiable to communicate that information to his/her employer." (Emphasis in original).

No similar stress was placed by the Appellants through their Counsel on the need to separate out these functions before this Tribunal but the Tribunal nonetheless recognises in line with its earlier observations about the critical distinction between retention and disclosure that it is clearly desirable that police forces' efforts be concentrated wholly if not exclusively upon policing purposes save insofar as the same bear upon employment vetting in the case of juveniles and vulnerable adults. This indeed was consistent with the arguments provided by the Appellants in these appeals.

The evidence before the Tribunal

77. The Tribunal received two statements from Mr Smith, the first being a lengthy statement of some 35 pages in length. He was and is the Assistant Commissioner. Much of the statement is taken up with a reassertion of the Commissioner's view that in the case of SY there were no other convictions recorded about SY on the PNC since the time SY was a juvenile: equally in the case of WY no other convictions have been recorded about WY on the PNC since WY was about 18 justifying the Commissioner's view that there were "no reasonable grounds for considering that the conviction data remained relevant for policing purposes." (paragraph 41) In the case of NW the same contention was made in the light of the assertion at least as at the stage of the Enforcement Notice that "no persuasive argument" had been put forward by the data controller as to why continued retention of NW's data in particular was necessary for or would materially contribute to effective policing (paragraph 63).
78. Mr Smith relates the progress of the Bichard Inquiry Report. In paragraph 77 he confirms that a Draft Code had been produced as of the date of his first statement with members of staff of the Commissioner's office including Mr Smith himself being involved in this development the Draft Code being issued for consultation. No specific representations were made about the impact of the Code if any on the issues in the appeal. The misgivings regarding the Codes expected to take effect on November 2005 as already expressed by the Tribunal above are to some extent echoed by Mr Smith himself at paragraph 79 of his statement where he says:

"In particular, the Commissioner is concerned that when police information is considered for retention or deletion, the proposals set out in the Code do not have the necessary clarity and could mislead the police about the requirements of the law."

He goes on:

"When information is considered for retention or deletion it should then simply be a matter of reapplying the same test to check whether, after the passage of time, it is still necessary and proportionate for police purposes that the information remains recorded." (paragraph 79).

79. In paragraph 82 and as well as in oral evidence Mr Smith accepted on behalf of the Commissioner that the retention of DNA samples and finger prints alone "would only be of limited assistance and it is therefore necessary to retain some other identifying details alongside the DNA sample or finger print." This however in his view did not justify lifetime retention of all conviction records.
80. Overall Mr Smith in his first witness statement accepted that conviction data was justified largely by dint of the policing purposes i.e. operational policing but that there existed another related use made of PNC conviction data namely with regard to the vetting of applicants for certain types of employment.
81. At paragraph 94 Mr Smith accepted that with regard to non conviction information the practice amongst Chief Officers appeared to vary but that inevitably some Chief Officers might be inclined to err on the side of caution. Mr Smith also notes that despite the enhanced disclosure procedure prescribed by section 115 of the Police Act to which brief reference has already been made (and which will be set out later in this judgment) the Government currently proposed to produce a registration scheme that would be based on a register of those barred from working with children and vulnerable adults rather than, as the Bichard Inquiry Report proposed, a register of those for whom there was no known reason why they should not work with the client groups in question. The Tribunal pauses here to note that with regards to this potential development it should be consistent in overall terms with the desirability felt by the Bichard Inquiry Report clearly to reflect the ACPO viewpoint that the police should remain primarily if not exclusively concerned with policing leaving the question of employment vetting if at all possible to other interested parties and controls whether in the form of a register or otherwise.
82. A point developed more fully in oral evidence and in cross examination was the fact as Mr Smith pointed out at paragraph 98 of his first witness statement that in the year to 31 March 2004 against a backdrop of the CRB issuing more than 2.2 million standard and enhanced disclosures to over 12,000 organisations in the same period, the Commissioner's office received 66 requests for assessments from individuals in respect of the CRB, in relation to which in turn the Commissioners office made the assessment that compliance was unlikely in 12 cases.
83. Of particular importance as pointed out by Mr Smith in his written evidence particularly at paragraph 101 is what he called the "common practice" for employers to impose enforced subject access as a condition of confirming a job offer. Mr Smith explained that this practice is one whereby a third party requires an individual to exercise his or her right of subject access request under section 7 of the 1998 Act in the third party's interest and to present the third party with a result. This means that any criminal records held on police systems however old and whether spent or unspent under the rehabilitation regime would therefore be revealed to the third party in question. The estimate provided by Mr Smith was that the overwhelming majority of the 200,000 odd police subject access requests per year are currently enforced. With the onset of basic disclosures under Part V in the form of section 112 of the Police Act 1997 it is likely that the numbers of enforced subject access requests would decrease but on the other hand there are plans as Mr Smith put it "to partly outlaw the practice by bringing section 56 of the [Data Protection] Act into effect at the same time." The Tribunal feels that the fluidity of the position with regard to the possible restriction and/or prohibition of the subject access request procedure is one which as such does not bear upon the central issues in these appeals. However it notes as is accepted by Mr Smith at paragraph 104 that when it comes to visa applications "we may be unable to prevent foreign embassies from using enforced subject access." This has particular relevance naturally in the case of WY: it also arises because as again explained by Mr Smith such embassies are outside the remit of the Commissioner's jurisdiction and therefore immune to any enforcement powers that might be otherwise issued. Again although the Tribunal feels sympathy for the unfortunate way in which such information might be disclosed to foreign embassies using a technique which might in due course be outlawed, that of itself cannot be regarded as a decisive reason for determining the present appeals. It is true as Mr Smith himself puts it that "retention of conviction data on the PNC creates a liability to have those data disclosed to third parties." But against that must be measured the fact that the evidence which has been put before the Tribunal as to the continued justification for retention given within the existing weeding guidelines.
84. The Tribunal was provided with no forensic or empirical research on the part of the Commissioner in support of his contention that there was little if any value in conviction data of the sort herein question being retained for the periods of time prescribed by the weeding rules. The only exception is a reference made in Mr Smith's first witness statement at paragraph 106 and 107 to Home Office research entitled "Criminal Careers of Those Born between 1953 and 1978" a study conducted in England and Wales and dated 12 March 2001 by Prime, White, Liriano and Patel. The Tribunal was not addressed on this study in any stage during the hearing but has been provided subsequently with copies of the report. As Mr Smith himself recognises, the research provides the estimate that 33% of the male population born in 1953 and 34.5% of the male population born in 1958 have a criminal conviction by the age of 35. Mr Smith therefore proposes that this alone suggests that a single conviction would not be a "very good predictor" of who will and will not proceed to a life of crime. The Tribunal respectfully agrees but feels that it has to measure the content of this report and its statistical content in the context of all the evidence which it has heard including the evidence of the police witnesses of the Appellants to which attention will be turned shortly.
85. In any event the Tribunal does not feel having perused the document in the wake of the appeal that the study is particularly instructive. Paragraph 2.3 of the report states that in the 1960's only 10% of offenders were dealt with by way of a caution whereas in the 1980's 20% received cautions.
86. At paragraph 2.10 there are various comments made about the likelihood of someone desisting as increasing as the age of the offender increases. The Tribunal feels however that whilst re-offending rates appear to drop as individuals get older this is not necessarily an indication that offenders are less likely to commit crime. Indeed one of the points made consistently by the Appellants' witnesses in particular Superintendent Linton was that by definition the police will not know of an offender's propensity to continue to want to commit crime if the crime remains undetected. Put simply consistent offenders simply become better at avoiding detection or alternatively they might switch to crimes with lower detection rates etc. In the result the Tribunal does not feel reliance on this material in any way necessarily assists the Commissioner's contentions.
87. At paragraph 3.18 it is pointed out that the majority of male offenders have short criminal careers almost 55% having careers of less than 1 year in length and two thirds with a criminal career of less than 5 years in length. The Tribunal feels obliged to observe that none of the cases presently under consideration by way of appeal involves single offences other than that of SY so for that reason alone the document relied on by Mr Smith does not have the greatest of persuasive force.
88. During the course of his cross examination by Counsel on behalf of the Appellants (Day 1 page 58) Mr Smith appeared to accept that had what he called "clear grounds" been given as to why the information i.e. the conviction data on these three appeals been important for policing "then there would be a balance to be struck as to whether if you like the prejudice of the individual or the policing need was the greatest". Indeed shortly after that he recognised that to some extent at least the case presented by the police "had some merit to it", albeit again involving a balance between any potential relevance of the information to policing and the prejudice of the individuals. It is fair to say however that shortly after that (Day 1 page 64) he continued to maintain that he had not yet heard anything in the submissions at least as presented by the Respondents as to why the information on the three appeals i.e. the particular conviction details were important to operational policing.
89. The Tribunal was particularly struck by a point that has already been highlighted above namely as Mr Smith put it that recourse to the weeding rules being in effect what he called "a very blunt instrument to deal with what is a complex situation." The Tribunal respectfully agrees. Clearly the list of questions to be considered by Data Protection Officers as formulated in the preceding and present edition of the ACPO rules need to be amplified in an ideal world coupled with the extended suggestions stemming from the Tribunal's consideration of the Bichard Inquiry Report Recommendations mentioned above. Later Mr Smith was to put the appropriate balance in a slightly different way by suggesting that the equation involved an apparent failure to re-offend on the one hand in the wake of a conditional discharge ordered some 25 years ago as against what Mr Smith called "the harm the distress whatever you call it the damage to the individual that is caused by the continued retention of the information." The Tribunal would in broad terms agree. On the other hand the question of distress is simply one element in the overall consideration to be brought into account in the Commissioner's consideration in this instance of whether the issuance of an enforcement notice is justified and the Tribunal is principally if not exclusively concerned with whether there is shown to have been a breach of the Third and/or Fifth Data Protection Principles. As the Bichard Inquiry Report clearly indicates the critical issue is whether or not the purpose for which the data has been processed is no longer justified.
90. Of particular significance was the failure to accept on the part of Mr Smith the fact that an enhanced disclosure system would not be, as it was put to him, the route into other non conviction information being revealed (see day 1 page 111 and following).
91. Later in his oral evidence (which was given in two stages), Mr Smith suggested that the Commissioner took a relatively narrow view of the particular purpose for which Chief Constables are registered under the data protection regime namely that concerning the maintenance of law and order. He suggested that although there was on the face of things a relatively narrow meaning to be attributed to their expression, he did accept that there was a link between the maintenance of law and order and the philosophy behind that concept and the activities of the criminal court and to some extent the family courts e.g. in relation to past convictions.
92. The Tribunal will consider the importance of submissions made with regard to the criminal law and questions of evidence in due course but it is noteworthy to remark that at this point Mr Smith contended that the answers to such questions namely the examination of past criminal behaviour at least in terms of conviction did not necessarily justify the retention of such records for the period prescribed by the weeding rules although he accepted that in certain cases e.g. sexual offences such information might well be of relevance. Finally in the first round of his evidence Mr Smith contended that the last discussion which he and his colleagues in the Commissioner's office had had with the Superintendent Linton's project group was one referred to in his second statement dated 3 May 2005 the discussion in question being in October 2004. At that time as Mr Smith duly confirmed the relevant ACPO representative had "agreed to reconsider the position in relation to [the group's] proposed "step model" which at that time at least according to Mr Smith had not been regarded as sustainable in the Commissioner's view and that of two Home Office officials. The second statement also formally confirmed that the new step model i.e. that contained in the retention guideline consultation paper of 9 February 2005 containing a draft of the proposed model was on the subject of a further and for the time being final meeting held between the parties on 22 April 2005.
93. The Tribunal then heard evidence from Mr Vince Gaskell the Chief Executive of the Criminal Records Bureau i.e. the CRB. Mr Gaskell confirmed that there are some 13,600 organisations entitled to information in respect of standard and enhanced disclosure which number has been rising consistently since the creation of the CRB. As will be explained more fully below, each of those entities has to confirm to the CRB according to Mr Gaskell that he or she is able to ask questions and that he or she is exempted under the Rehabilitation of Offenders Act. The range of the parties and organisations able to access the CRB is clearly vast. Mr Gaskell however confirmed that in most cases the only person capable of making any judgement about the relevance of conviction data or indeed other data to the nature of the employment which might be applied for is, at the end of the day, the employer himself or itself.
94. Mr Gaskell was particularly informative about the actual workings of the CRB. He referred to the specimen certificate provided in the case of NW. Although it might have been inferred from what has been set out above that the form would normally contain the barest of information, there was a box in the case of NW marked "other relevant information". Mr Gaskell explained that such information may well contain the details of any current or recent local police investigations which the local police force might regard as being relevant to a potential employer with regard to the individual in question. Mr Gaskell confirmed that the Chief Police Officer seised of the matter and under guidance from ACPO would have to make a judgement about whether such information might be relevant to the employer in the particular case.
95. In addition the form bore two other boxes, one regarding matters concerning the Department for Education and Skills and one for the Department of Health. Mr Gaskell confirmed that both departments maintain lists of persons barred from working, in the case of the former, in schools and/or with children, whilst the latter department keeps a list of people barred from working with vulnerable adults. Such information is generally available and accessible to the CRB and if those people are barred from working with those individuals under either of those rubrics then the same would be recorded on the relevant disclosure. Once a person's name appears on either list and the list is available to the CRB then in the words of Mr Gaskell the information would be revealed and "the care home would be unable to employ that individual even if they wanted to".
96. Mr Gaskill also confirmed a matter again previously referred to namely the evolution of the CRB. There would shortly be added what he called "additional sources": hence provision has now been made to extend information sources pursuant to the recent Serious Organised Crime legislation to the Military Police, the British Transport Police and potentially foreign data sources. However he confirmed that as yet the last of these additional sources was not yet "on stream".
97. Mr Gaskell lent force to the contention made by the Appellants that deletion as sought by the Commissioner would lead to various anomalies; the principal anomaly that he focussed on was that in the event of the deletion sought by the Commissioner answers might be given to any one of the 13,600 organisations by or on behalf of interviewed applicants which would not tally with the record ultimately obtained from the CRB. He called that "one potential anomaly."
98. In any event he was concerned with maintaining consistency and avoiding what he called a "post code lottery" if deletion in the manner sought by the Commissioner were enforced. This was simply no more than a wish that any weeding rules and information recording rules be applied consistently and uniformly if at all possible.
99. Perhaps of more direct practical relevance is the fact that he confirmed the main purpose for which the CRB system is used was the protection of either children or vulnerable adults and that the same constituted "probably about 80% if not more" of the CRB's activities. He confirmed that per year the CRB would deal with about 2.6 million disclosures of which about 90% were enhanced disclosures.
100. Mr Gaskell also confirmed that local police systems which were described as the IPLX (Interim Local Police Cross Referencing System) or the interim PLX systems were not as such capable of being accessed by the CRB. Instead the CRB had access to a database that informed the CRB which local forces held such information so that in turn the CRB could approach the local forces and ask them to provide the relevant information. In other words the IPLX system was one which enabled the CRB to inform itself as to which local police forces it should approach for information held on the local bases. However out of the total number of enhanced disclosures referred to, less than 5% of enhanced disclosure applications triggered the need to consider the release of local police information. However, that figure as against a back drop of 2.3 million applications would still yield something over 100,000. Perhaps even more significantly he confirmed that those 100,000 applications would have to be dealt with on what he called a case by case basis. The Tribunal notes therefore that local forces, even spread over the 43 constabularies forming the total police activity within England and Wales would still be responsible for a substantial degree of individual checking given numbers of this magnitude. Inevitably he admitted that this led to some degree of inconsistency across local police forces yielding the need to develop guidelines under the auspices of what was called a quality assurance process i.e QAF namely a quality assurance frame work. Not unnaturally the Appellants also used this in support of their argument that consistency was necessary at least as far as non conviction data is concerned. However the Tribunal feels it must measure that desired state of affairs against the fact that as things presently stand there is a need to review on a case by case basis so called soft information which of itself might suggest the same exercise would not be too oppressive when applied to conviction data albeit subject to some form of weeding type regime whether stepped down or not. Finally Mr Gaskell confirmed that the IPLX system referred to above would be based on extracts as he called it of the personal details of individuals on the local system which details would then be put on the central database called the IPLX system. However, in answer to a question from the Tribunal he confirmed that in the main such information was non custodial information. It follows that though deletion of the conviction data might not as such adversely affect the operation of the IPLX system clearly less than a full picture would emerge of an individual's prior history were such data to be erased alongside say non custodial information which might relate to a period which was as old if not older than the conviction data which had been removed.
101. The Tribunal then heard from Detective Superintendent Linton. He had provided three written statements for the benefit of the appeals. Much of the content of the statements could hardly be regarded as controversial. There could and can be no doubt that conviction history forms an integral part of the investigative operations of the police force.
102. In his third statement he took issue with one very minor point already mentioned in relation to Mr Smith's first witness statement namely that the Project Group's proposals (Superintendent Linton being a member of the said group) had not been "sustainable" in the context of human rights legislation in the opinion of Home Office officials, Superintendent Linton remarked that

such was the view felt and expressed by one Home Office representative alone

not shared by other representatives of the Home Office with whom the project

team had to have contact.

103. He provided a further insight into the operations of the IPLX system calling it a "recognition" system. The system would work as follows namely when a request came in from CRB to a chief officer to give information about an individual then apart from the information already extant upon the PNC it may well be that the individual in question would feature upon one of the local databases. Superintendent Linton also accepted that there was a great deal of variation from force to force. However he confirmed to the satisfaction of the Tribunal at least that deletion of a conviction from the PNC would have no consequence at all for whether people were registered on the IPLX system.
104. One of the more telling features of his evidence before the Tribunal was the stress he laid upon the distinction between retention and disclosure factors. This has already been noted in this judgment. He recognised the need to impose what he called "more sophisticated criteria to our retention regime if you like". He made reference to greater categorisation in terms of age distinction, a point referred to earlier as well as to the fact and content and fact of any court decisions. The age categorisation he said was presently under consideration at least from ACPO but apparently not yet the subject of any considered exchanges with the Commissioner with regard to dividing the age criteria into three categories namely young people, adults and young offenders.
105. Not unnaturally consideration was also being given by his Group and therefore by ACPO to the further categorisation of offences taking as a starting point a tri partite division between serious, minor and what he called "all those in the middle." What he regarded as "very important" and "very useful" was not unnaturally the element of modus operandi together with acquittal and arresting information. It is fair to say that the latest thinking of ACPO was only produced in written form during the hearing of these appeals.
106. During his cross examination by Counsel on behalf of the Commissioner Superintendent Linton made a point already alluded to namely the changing perception both from the point of view of the police and of the public at large relating to particular offences. The example which was the subject of specific questioning was the conviction of which SY was found guilty namely assault causing actual bodily harm. It was accepted by Superintendent Linton that the charging criteria had changed so that the same relatively minor injury might now merely attract a charge of common assault and would not necessarily lead to the rejection of a candidate should that person then apply for employment by means of one of the disclosure systems. As indicated above there is simply no indication as to what level of injury was sustained in the case of SY's victim. Superintendent Linton accepted that the circumstances of the case were not known and that it could quite feasibly have been a case where it started out with injuries appertaining to grievous bodily harm as it might have been one in which there was a relatively minor infraction which today would only be treated as common assault.
107. Superintendent Linton was asked extensively about the content of SY's criminal record and there is no need to repeat the observations already made. The net result of this further scrutiny still yields a high degree of inconclusiveness. In an ideal case Superintendent Linton accepted that the information on a print out would normally pin point the place where local records were being kept e.g. in the form of a crime report but as he put it "there is an issue about when that might have been destroyed in a case this old" i.e. that of SY. The fact remains that the Tribunal remains unaware of anything other than the bare data of the convictions not only pertaining to SY but also to the other two data subjects featuring in these appeals.
108. One abiding theme in Superintendent Linton's evidence in cross examination has already been referred to. He made the point that simply because no further conviction data or other similar data appeared on the PNC record since data of the age apparent in these three cases, this might simply be because convicted people as he said "learn how to avoid detection and conviction and it may well be that they can go for considerable periods of time without coming to notice". It followed according to Superintendent Linton that on subsequent re-arrests the offender might well have a very old previous conviction which had not come to notice for "great periods of time." It has already been indicated (and the Tribunal has duly expressed its view accordingly) that the empirical evidence on this cessation was minimal if not non existent. Superintendent Linton accepted that he together with his colleagues had "started some work looking at the repeat rate of those who come to police notice and then are released without any further action over a historic period of time"; however that research was still underway and was due to finish in about September 2005.
109. When asked about the weeding rules in their present edition Superintendent Linton accepted that there was a manual process in reviewing the offences which forms part of the weeding regime. He accepted that as part of the continuing evolution regarding procedures, efforts were being made to institute a more automated process.
110. He also gave details about the proposed step down model. A spreadsheet was produced showing those non police users who would be barred from access to the PNC whilst leaving the latter open to police users alone. There remained he said some issues as to precisely which members of the police family would be included. The two practical possibilities under review depended upon whether the CRB itself could have access to the PNC or whether the CRB was allowed only to do so by means of what he called a section 115 route which will be dealt with in more detail below. He was adamant that the three cases forming these appeals would step down under the proposed model. This has already been dealt with above in paragraph 51. He emphasised that even if a step down model were imposed there would have to be some retained element of discretion vested in the Chief Officer as to whether the information should be erased altogether. This might still leave however an individual's name on the system in order for the same to be linked to any DNA or finger print samples. However he limited any exceptional cases to extreme cases and gave the example of one case in which a man had been convicted of rape upon a woman who in due course became his wife.
111. Finally Superintendent Linton reminded the Tribunal that it was at least in theory possible for case histories to be reconstituted but that the PNC remain the "key link" to such reconstruction. The Tribunal has not been acquainted with more than the bare facts as explained above. The one thing that Superintendent Linton suggested was that there would invariably be a case officer who would normally have kept a pocket notebook containing further information. In addition there were other references on the PNC record that might have yielded further information. However no such information was ever provided in any of the three appeals even though Superintendent Linton confirmed that traditionally pocket note books were kept for life.
112. The other evidence which the Tribunal heard and which had not been the subject of prior consideration by the Commissioner included evidence from Mr Nicholas Apps of the ACPO DNA and Finger Print Retention Project. He reported in his witness statement upon the results of a review taken across 19 focus groups in turn spread across 10 police force areas to obtain the views and comments upon the requested deletion in the case posed before the focus groups of an ABH conviction from the PNC. His witness statement contained a number of what were described as operational requirements in support of the contention made by the Appellants generally that there was a desirability in retaining convictions on the PNC at least with regard to ABH convictions. Without listing these findings in full many of which have already been alluded to, the gist of the review conducted by Mr Apps could perhaps simply be put in terms of the assistance which such conviction data provides when conducting criminal investigations generally. Nothing propounded by Mr Apps went specifically to the question of age of a conviction other than a general proposition that relevance and weight of past conviction data can only be assessed once it is available. One particular conclusion drawn by Mr Apps from his survey concerned the possibility of an individual having been in prison for 10 years with the previous crime having been committed 11 years previously which together would have been in his words "of interest" contrary to the situation in which had the previous conviction been 11 years old with no re-offending since then not unnaturally the relevance would diminish accordingly.
113. The Tribunal also heard from Mr Chris Archibald who has been employed by the Serious Crime Analysis section of The National Crime and Operations Faculty as a principal analyst since 2 April 2002. His speciality was the use of aspects of modus operandi information from previous convictions in the realm of what he called lesser offences as compared with other undetected offences with the overall aim of establishing similar behaviour patterns. The Tribunal felt that much of the information given by both these witnesses was largely anecdotal and concerned not unnaturally the more serious types of offences e.g. those involving serious violence including murder and sexual offences. Nonetheless Mr Archibald at least was prepared to concede that even in such serious offences there was very little analysis of cases where offences went back as far as 25 or 35 years with nothing having been recorded since that time and therefore Mr Archibald at least was driven to accept that there was simply an overall lack of knowledge as to the degree of recidivism in the case of such long standing conviction there having been no interim record of further offences.
114. The Tribunal then heard from Miss Gillian Bower-Lissaman, the Data Protection/Information Security Officer for South Yorkshire Police based in Sheffield. In her witness statement she confirmed that she had worked within the data protection unit of the force for over 17 years. In cross examination Miss Bower-Lissaman confirmed that she had had no personal involvement in any of the cases particularly that relating to SY. She accepted in cross examination that in the exchanges to which reference has been made regarding the circumstances leading up to the enforcement notice with regard to SY that the view had been taken that reliance should be placed purely upon the weeding rules. She confirmed that in fact no other information was held within the South Yorkshire force about the offence with which SY was concerned. A crime report had been looked for and her evidence was that it had been destroyed or no longer available.
115. The Tribunal also heard from Michael John McMullen, manager of the Hampshire Constabulary PNC Bureau and at the time of his witness statement on 30 March 2005 on secondment to the ACPO DNA and Finger Print Retention Project. He has been a serving police officer for 30 years prior to retirement at the rank of Detective Inspector to take up his present position in December 2000.
116. In his witness statement he describes the origins of the PNC which originally began as a simple stolen vehicle database and has developed in the way outlined above. In his witness statement he also confirms that what he calls "the most significant shift" in the PNC's development took place in 1995 when the system known as Phoenix was introduced which added to a names database extended information recorded about individuals to include modus operandi, personal habits, offence history and personal descriptive details amongst other matters. Since then as is perfectly clear from the descriptions made of the system above already in this judgment access to the PNC has widened considerably.
117. He explained that access to records on PNC is by way of a series of transaction codes known as hash codes so that for example a search for a specific name would be instituted by the operator using #NE i.e. a names enquiry code with similar enquiry codes being used for such things as vehicle enquiries i.e. #VE.
118. Even amongst police users he confirmed that there were broadly two groups of users namely those who enjoyed what he called read only access and those who had read and update access. So for example patrol officers would have the former whilst staff in control rooms would have access to a greater range of the hash codes referred. Other non police users of the PNC would have what he called "a greatly reduced level of access" so that by way of example the DVLA dealing with vehicle licenses would be able to access the PNC by use of only one transaction code thereby restricting the amount of data within the nominal record that the user could see. It is fair to say that the thrust of his evidence at least in his witness statement was to explain the infinite variety of information available particularly to police users through the basic dual divisions as outlined above.
119. In his oral evidence he was asked about whether in fact conviction data could

be erased in the way sought by the enforcement notices. Although it is fair to say that he believed that the deletion of a record or partial record could be effected it is fair to say that he added that he would "hesitate to say that it could not be done." He was also prepared to concede that some weeding might have taken place which should not have taken place.

120. It is fair to say that perhaps the significance of Mr McMullen's evidence is to point up the importance which has to be placed upon the record keeping. Initially his own force, Hampshire, had until recently retained a paper copy of every entry on the PNC some dating back as far as Mr McMullen was concerned to the 1930's or 1940's. Clearly that became as he put it untenable leading to the possibility which he was prepared to accept existed in fact that a person could have an entry on the PNC under various different names and that nobody had made the suitable connection between those entries. Even if there were a connection made on the PNC, local systems might not necessarily effect the same connection. Moreover a database forming part of the PNC called the Phoenix database contained a substantial number of microfiche subjects which had not yet been entered which in Mr McMullen's estimation amounted to as much as a million.
121. The Tribunal was shown a four page document describing the non police users of the PNC as at 29 April 2002. He was able to confirm that in many cases those non police users had very limited access to the PNC given the hash codes which had been described. A series of agreements involving both ACPO and PITO define the level of access that could be accorded to any particular organisation who sought access to the PNC. In round terms those who had access to Phoenix had access to some information but not necessarily all conviction data. So by way of example that the Office of Civil Nuclear Security which enjoyed a #NZ would in his words only be entitled to "very very limited conviction data.": in effect only names. The particular hash designation attributed to any particular non police user would yield a greater or lesser degree of detail but would not necessarily exclude conviction data in all cases. In short there was no foolproof way in which the system as set up could be reconstituted so that a particular individual's conviction data was not to be seen by non police users. However Mr McMullen was prepared to

concede that though at the moment technically the same was not feasible it might in future be technically possible to screen particular individual records particularly conviction data from non police users.

122. However, Mr McMullen was prepared to concede that it might at present be "technically feasible" to instruct the PNC not to return under a specific search any data that was older than a particular period e.g. 25 years, just as it might be technically feasible to instruct the PNC or design the PNC in such a way that it did not return any record that contained a specific form of offence or offences.
123. The fact remains that a non police user e.g. the Office for Civil Nuclear Security might always be in a position to obtain conviction data though they may be not provided with more details about the conviction and/or the person whose name they had entered into the system.
124. Insofar as the step down model to which reference has been made is concerned Mr McMullen accepted the technical changes to the PNC would need to be made for the step down to be achieved, but in his words "that is work that we have already engaged with PITO on and would be sometime in the future….".
125. As indicated above after this evidence had been given Mr Smith was recalled with the consent of both parties. The Tribunal was duly grateful for his willingness to attend as long as he did throughout the hearing.
126. Mr Smith was recalled largely for the benefit of the Tribunal. Out of a number of matters that emerged in his further attendance in giving evidence he confirmed that there was an intended policy of the Commissioner to seek what he called an independent right of access "unfettered by restraint by the particular data controller". It is fair to say that the Directive to which reference will be made in full below does not currently allow for such access rights but Mr Smith assured the Tribunal that the Government "may be sympathetic to change things" in that respect.
127. It is fair to say that Mr Smith expressed some surprise during the time of his being recalled to give evidence, at the length of the listed organisations to which reference has been made above who have access to the PNC. He asked the not unnatural question "Is it really necessary for all these organisations individually to have access?" An additional value of his having been recalled was to ascertain from the Appellants the fact that in the case of NW inquiries had been made as to whether additional information existed with regard to the convictions but that having checked the intelligence nothing was found. Insofar as WY was concerned the data protection officer who was at West Yorkshire at the time is no longer employed in that position so that the Appellants were not able to illuminate the Tribunal as to what the position was with regard to WY.

The legislative framework

128. The 1998 Act was enacted in the wake of the European Directive which has been mentioned several times above. The Directive which was given effect to on 24 October 1995 is entitled "On the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data".
129. Both parties were agreed that in interpreting the Act it is appropriate to look to the Directive for assistance. See generally Campbell v MGN [2003] QB 633. The Tribunal's attention was drawn to a number of recitals as well as various substantive provisions of the Directive. It is not necessary to set out these recitals in full. It is proposed merely to set out the gist of the relevant recitals. There is no doubt that the Directive addresses itself primarily to issues which concern the protection of personal privacy and of rights under Article 8 of the Convention. The terms of article 1 alone make that clear. It is equally clear that the basis of the Third and Fifth Data Protection principles are embodied in Article 6.1(c) and (e). Perhaps not surprisingly the Directive in recital 21 respects the principles of territoriality which apply in criminal matters. Of particular importance is the provisions of Article 8.5 which needs to be recited in full:

"Processing of data relating to offences, criminal convictions, or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the member state under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority."

Pausing here the Tribunal rejects the suggestions, if not the contention made on behalf of the Appellants that the above Article makes it clear that it is in some way mandatory for a Member State to retain a complete register of criminal convictions in effect without qualification. The Tribunal accepts the submissions made on behalf of the Commissioner that the true meaning and effect of the Article is to provide that a complete register will be unlawful unless it is kept under the control of official authority. It is clear that a total reading of the Article cited above shows that if a complete register is to be maintained then the same will be unlawful unless it is kept under the control of official authority, ie the appropriate body entrusted with such matters in the particular Member State.

130. Article 27.1 is also significant. Again without reciting the terms of the sub article in full it is clear that the Directive was designed, as it states, to "encourage" the drawing up of codes of conduct intended to contribute to the proper implementation of the appropriate national provisions.
131. It is equally clear that the heart of the Directive is the need to keep a proper regard for the force and effect of Article 8 of the Convention in respect of private life, having regard equally to the public interest in obtaining and collating data relating to the prevention and detection of crime. Both sides agree that this balance, which sounds throughout the data protection principles in play in these Appeals, is in keeping with the basic principles of transparency and certainty which run throughout part of European jurisprudence.
132. With regard to the 1998 Act it is important to bear in mind certain of the critical provisions.
133. As indicated already in this judgment both parties are in agreement that the Appellants are registered as data controllers for the purposes of section 16 of

the 1998 Act. The section provides that so called "registerable particulars" include by section 16(1)(d):

"… a description of the purpose or purposes for which the data are being or are to be processed;"

134. During the appeals the Tribunal was provided with the relevant entry details with regard to each of the Appellants. In the case of each Chief Constable the second purpose described in the entry is merely the descriptive term "policing". However, the purpose description following that description is as follows, namely:

"The prevention and detection of crime; apprehension and prosecution of offenders, protection of life and property; maintenance of law and order; also rendering assistance to the public in accordance with force policies and procedures."

135. In each of the Appellants' cases there is a further section headed: "Data Controller's Further Description of Purpose". For some reason which is unexplained this section repeats the purpose description which has just been cited but adds prior to the last stated purpose description, namely that of rendering assistance to the public the following additional description, namely: "vetting and licensing" and "public safety". The Tribunal was not informed precisely as to how it was that these additional qualifications or as it is suggested by the entry details, further descriptions of the initial purpose description come to be formulated other than having been informed in a general way that the entry details represented some form of standard form. Nonetheless it is not immediately apparent how vetting and licensing, for example, immediately finds reflection in any of the stated purpose of description cited above. What is clear, however, is that the concept of "administration of justice" which was regarded by both sides and particularly by the Appellants as being an arguable recharacterisation of the stated purpose "maintenance of law and order" is not as such set out in the entry details.
136. Section 2 of the 1998 Act deals with what is known as "sensitive personal data". This form of data is described as meaning personal data consisting of information as to:

"(g) the commission or alleged commission by him [ie the data subject] of any offence; or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings".

137. Although there was no debate on this it is clear that Article 8 of the Directive does not include criminal convictions within the terms of Article 8.1 being the Directive's equivalent of sensitive personal data, but nonetheless as reflected in Article 8.5 the Directive clearly requires a processing of personal data regarding offences and criminal convictions to be carried out under official authority and/or with the safeguards in place in the way indicated above. Of more importance, however, is the impact of the recitals in the Directive which identify as a special category of data, data which "capable by their nature of infringing fundamental freedoms of privacy". The importance of this principle and the operation of the Directive generally in this area is that such data needs to attract additional safeguards when the processing of such data is being considered. Under the 1998 Act such data, ie sensitive personal data, requires that certain conditions be met under both Schedules 2 and 3 before such data can be processed in accordance with the First Data Protection Principle. That principle prescribes in general terms that personal data should be processed fairly and lawfully and is not to be processed unless one of the conditions in Schedule 2 is met. Naturally, neither of the Third nor Fifth Data Protection Principles which are in issue in these appeals are relevant for the purposes of Schedule 2. In general terms there can be little doubt that the first data principle informs the way in which those two particular principles are to be regarded and interpreted. Schedule 3 mirrors the terms of Schedule 2 but the conditions in Schedule 3 are specifically addressed to the processing of sensitive personal data. Again, none of these conditions are directly applicable or relevant in the present appeals but attention was drawn by the Commissioner to the fact that if a piece of information has been characterised not simply as personal data but as sensitive personal data then there is at least a presumption that such data would engage Article 1 rights under the Convention.
138. Even if there were a breach of Article 8 of the Convention there is no doubt that this Tribunal still has to consider whether there has been a breach of the Third and Fifth Data Protection principles. On the other hand if the Tribunal were not to find that there was a breach the question of the breach or otherwise of the principles would still need to be addressed. The question of Article 8 will be dealt with below.
139. Reference was also made by the Commissioner, at least, to section 29 of the 1998 Act. Section 29(1) provides that personal data processed for "(a) the prevention or detection of crime; (b) the apprehension or prosecution of offenders …" are both exempt from the First Data Protection Principle except to the extent to which the latter principle requires compliance with the conditions in Schedules 2 and 3. In subsection (3) it is provided that personal data will be exempt from the non disclosure provisions as defined by section 27(3) and (4). The Tribunal feels that it is not called upon to make any determination about the operation of section 29 since section 29(3) relates to the disclosure of information and not to the question of processing generally. As was pointed out by the Commissioner, none of the Appellants has ever suggested that section 29(3) exempt him or them from the obligation to comply with the Third and Fifth Data Protection principles.
140. Section 40 of the 1998 Act deals with enforcement notices. There is no dispute about the operation of this provision. It enables the Commissioner on being satisfied that a data controller has contravened or is contravening any data protection principles, to serve a notice in which either or both of the following can be required , namely:

"(a) To take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified; or

(b) To refrain from processing any personal data, or any personal data of or description specified in the notice, or to refrain from processing than for a purpose so specified or in a manner so specified, after such time as may be so specified."

The present enforcement notices are addressed solely to the facts of each individual appeal. It was at one time mooted that convictions of a similar type be the subject of a direction to effect deletion or erasure but this has not been argued or pursued on these appeals. It follows that this Tribunal is concerned solely with the facts of these three particular appeals although it is conscious of the ramifications which follow from any determination it makes. The Tribunal's own jurisdiction is set out in section 49 of the 1998 Act. It provides as follows in relevant part, namely:

(1) If on an appeal under section 48(1) the Tribunal considers –

(a) that the notice against which the appeal is brought is not in accordance with the law; or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently;

(i) the Tribunal shall allow the appeal or substitute such other notice or decision as could have been served or made by the Commissioner; and in any other case the Tribunal shall discuss the appeal.

(ii) on such an appeal, the Tribunal may review any determination of fact on which the notice in question was based.

(iii) if on an appeal under section 48(2) the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal shall cancel or vary the notice."

141. There is no doubt that the Tribunal has an extensive jurisdiction, albeit in its appellate function. As is evidenced by these appeals it is clearly entitled to consider a range of factual material which may well go beyond and no doubt would normally go beyond the factual material considered by the Commissioner in his deliberations as to whether an enforcement notice should be issued. The Data Protection Tribunal (Enforcement Appeals) Rules 2000, in rule 22 provides that in any proceedings before this Tribunal relating to an appeal to which the rules apply (other than an appeal under section 48(3)) "it shall be for the Commissioner to satisfy the Tribunal that the disputed decision should be upheld."
142. It follows that in reviewing any determination of fact which must by definition include new factual material then the Tribunal can legitimately find that even though the Commissioner might have been said to have exercised his discretion properly at first instance in connection with the enforcement notice, on appeal the Tribunal would in all the circumstances be entitled to engage in any of the three outcomes addressed by the final words in section 49(1). 142. No argument was addressed on the proper meaning of the phrase "change of circumstances" in recognition of the fact that the Tribunal's jurisdiction was as indicated above. The Tribunal does not therefore propose to base any part of its decision on the provisions of Section 48(1)(b)(iii).
143. Reference was also made to section 51(4) of the 1998 Act. Again there was no dispute between the parties in any substantial way as to the meaning and operation of this provision. Under this subsection the Commissioner is under a duty to consider the encouragement of "trade associations" to prepare and disseminate to the members of such associations appropriate codes of practice for guidance as to good practice. There can be no doubt but that the ACPO Rules represent a set of guidelines properly falling within the ambit of that provision.
144. Reference was made at the outset of this judgment to the provisions of the Third and Fifth Data Protection Principles. Unlike the other data protection principles which attract commentary within the ambit of schedule 1 to the 1998 Act, there is no statutory commentary whatsoever with regard to the two principles here in play.
145. Section 27(4) of the Police and Criminal Evidence Act 1984 provides that:

"The Secretary of State may by regulations make provision for recording in police records convictions for such offences as are specified in the Regulations".

146. Section 4(a) makes it clear that "convictions" for this purpose includes cautions, reprimands and warnings.
147. In order to ascertain which offences can be recorded in the first place on the PNC reference must be made to the appropriate Regulations. The appropriate Regulations are SI 1985 No. 1941, namely The National Police Records (Recordable Offences) Regulations 1985. By Regulation 2(1) there is provided the following, namely:

"There may be recorded in the National Police Records convictions for offences punishable by imprisonment …".

There then follows a list of other specified offences consisting of offences connected with prostitution, the improper use of telecommunications and penalisation in connection with the tampering of motor vehicles. Further Regulations were enacted in 1989 adding further offences and in 1997 yet further Regulations were passed adding a large number of specific offences. Further Regulations still were enacted in 2000 adding yet more specific offences. The Tribunal was informed that the above set of Regulations constitutes a complete catalogue. The 2000 addition of the Regulations by Regulation 3(1) contains a specific reference to cautions, reprimands and warnings. This reflects the extended meaning given to the term "conviction" in the principal statute at section 27(4)(a). The term "recordable offence" is in effect an offence specified in the entire set of regulations as being one of the offences that may be recorded. Support for this understandable reading is provided in the Explanatory Note appended to the 1985 Regulations.

148. It is abundantly clear that both section 27 and the entire set of Regulations merely empower the police to record certain kinds of offences. There is no statutory duty to do so. Correspondingly it is not part of the Appellants' contentions that the erasure which has been sought by the Commissioner in all three enforcement notices could ever be a breach of statutory duty whether under section 27 of the same Act or under the Regulations. Such an approach could be said to be entirely in keeping with the letter and spirit of Article 8.5 of the Directive which has already been mentioned. As to vetting purposes that have been mentioned, the Appellants have laid much emphasis upon the fact that employment vetting represents if not a stated purpose within the purpose descriptions recited above in the case of each of the three Chief Constables then certainly a part of the so called "further description". Certainly, there was no dispute between the parties that employment vetting insofar as the same pertained to the protection of young people and vulnerable adults would clearly form part of the purpose attributable to the prevention and detection of crime as well as the apprehension and prosecution of offenders coupled with protection and life of property as well as arguably the maintenance of law and order. For this purpose it is necessary to consider the question to what extent the various purposes of all users of the PNC who had been demonstrated by the evidence to be capable of accessing the PNC are to be treated as in effect purposes of the data controller in these circumstances. This demands a consideration of the Rehabilitation of Offenders Act regime.
149. The principal Act is the Rehabilitation of Offenders Act 1974. The purpose of the Act is well known: it provides that if an individual has been convicted of an offence followed by the satisfaction of certain prescribed conditions and following the end of the rehabilitation period, that individual is to be treated as rehabilitated with the conviction treated as spent. Both parties agreed that here all data subjects in this case were subject to convictions which would now be regarded as spent for these purposes.
150. Section 4(1) provides that:

"Subject to section 7 and 8 below, a person who has become a rehabilitated person for the purposes of this Act in respect of a conviction shall be treated for all purposes in law as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of that conviction; …"

This subsection then goes on to provide that notwithstanding the provisions of any other enactment or rule of law or evidence regarding such spent conviction no evidence as to such conviction shall be admissible in any legal proceedings and such a person who is so rehabilitated shall not in any such proceedings be asked and if asked should not be required to answer any question relating to its past so far as a spent conviction is concerned. Subsection (3) subject to any order made under subsection (4) provides as follows, namely:

"(3) Subject to the provisions of any order made under subsection (4) below

***

(b) a conviction which has become spent or any circumstances ancillary thereto, or any failure to disclose a spent conviction or any such circumstances, shall not be a proper ground for dismissing or excluding a person from any office, profession, occupation or employment, or prejudicing him in any way in any occupation or employment".

151. The purpose of the above provisions is clear: in all material respects an individual benefitting from a spent conviction is to be treated in general as if the conviction had not occurred and shall not be bound to answer questions about it nor is he or she to be prejudiced in connection with any employment issue. Subsection (4) empowers the Secretary of State to modify that general provision by order.
152. Section 7 which is referred to in the cited portion above contains by subsection 2 an important qualification which needs to be set out in full, namely:

"(2) Nothing in section 4(1) above shall affect the determination of any issue, or prevent the admission or requirement of any evidence, relating to a person's previous convictions or to circumstances ancillary thereto –

(c) in any criminal proceedings before a court in Great Britain (including any appeal or reference in a criminal matter);"

153. The Appellants have maintained before this Tribunal that criminal proceedings occur in public and therefore criminal convictions are a matter of public record, thereby providing in effect an answer to the applicability for engagement of Article 8 of the Convention.
154. The Tribunal after the conclusion of the submissions by Counsel on behalf of both the Commissioner and the Appellants was shown representations made in writing by a letter from the solicitors acting on behalf of SY. Issue was taken in those exchanges with the way in which contentions have been made by both Counsel regarding the public or private nature of criminal proceedings. The Tribunal accepts that Counsel for the Appellants in the main argued that a court appearance was not private in arguing that Article 8(1) was not engaged. It is fair to say, perhaps, that Counsel on behalf of the Commissioner in responding to that allegation properly and understandably asserted that it was not necessary for him to contend that criminal hearings or proceedings were not public in nature, merely that Article 8(1) was engaged for the reasons set out above, ie largely if not exclusively relying upon the fact that such data constituted sensitive personal data under the 1998 Act. By a further exchange in writing sent by the Commissioner's office to the Tribunal's offices it was made abundantly clear that the Commissioner's position was that Article 8(1) of the Convention was engaged in respect of the retention on the PNC of all the conviction data with which these appeals are concerned. The letter adds:

"This is so whether or not criminal proceedings in question were held in public, and whether or not they were subject to reporting restrictions".

The Tribunal has not heard or received any further oral submissions on this point and is content to accept the contention that were proceedings to be held in private or were criminal proceedings to be subject to reporting restrictions (which is frequently if not invariably the case in juvenile proceedings) then these would be, in the words of the Commissioner, "additional considerations that support the Commissioner's contention that Article 8(1) is engaged".

155. In any event the Tribunal feels bound to reiterate that no information whatever was given in connection with any of these appeals as to the circumstances in which SY's case was heard, ie whether it was heard in private or indeed whether reporting restrictions were or were not lifted. The Commissioner states in his exchange with the Tribunal's officers that he is prepared to accept "however, that it is very likely that the hearing was in private and subject to reporting restrictions" but the Tribunal cannot make any specific finding in this respect on the basis of the formal evidence it has received and which has already been set out above.
156. The Tribunal, however, is prepared to accept that in the case of spent convictions insofar as the retention of conviction information is concerned, the fact of a spent conviction is clearly relevant in addressing to what extent Article 8(1) rights are engaged, ie an individual's privacy rights are clearly likely to be more adversely affected in the case of a spent conviction being retained as distinct from one that is not spent absent other considerations. The Commissioner conceded that he was bound to accept that Article 8 had to be considered taking into account Article 8(2) to which reference will be made below.
157. For present purposes, the critical question is the scope of the exceptions now prescribed by statutory instrument to the spent conviction regime. The latest expression of such exceptions is in SI 1975 No. 1023, namely The Rehabilitation of Offenders Act 1974 (Exceptions Order 1975) as amended. The Tribunal was provided with an updated copy but does not feel that it is necessary for present purposes to go through the specific exceptions in detail. It is enough for present purposes to revisit the evidence given by Mr Gaskell in relation to the operations of the CRB.
158. This leads to more detailed consideration of the disclosure regime which has already been mentioned at several points in this judgment. Reference must now be made to the specific provisions of the Police Act 1997 regarding disclosure. The relevant provisions are in Part V of that Act. Section 112 deals with criminal conviction certificates, the so called basic disclosure regime but the Tribunal is not concerned with those provisions. Section 113 deals with criminal record certificates, known as standard disclosure. Subsection (3) defines such certificates as follows, namely:

"(3) A criminal record certificate is a certificate which –

(a) gives the prescribed details of every relevant matter relating to the applicant which is recorded in central records, or

(b) states that there is no such matter."

By subsection (5) the expression "central records" is defined as meaning "such records of convictions and cautions held for the use of police forces generally as may be prescribed; …".

The same expression, namely "central records" is further explained by referring to the appropriate statutory instrument, namely the Police Act 1997 (Criminal Records) Regulations 2002 SI 2002 No. 233. By Regulation 9 the so called prescribed details of central records are described as follows, namely:

"Information in any form relating to convictions, cautions, reprimands and warnings on a names index held by the Police Information Technology Organisation for the use of constables is hereby prescribed as "central records" for the purposes of section 113(5) of the Act (including that provision as applied by sections 114(3), 115(6) and 116(3))."

As is clear from the earlier part of this judgment the same is in effect a reference to the PNC and PITO is the organisation referred to in the Regulation cited. Briefly PITO is the notional holder of the records but in reality as has been explained before the Tribunal, the CRB is the entity which has a right of access to the database principally for the purposes of employment vetting.

159. The next relevant section of the Police Act 1997 is section 115 which deals with enhanced criminal records certificates. By subsection (7) it is provided as follows:

"(7) Before issuing an enhanced criminal record certificate the Secretary of State should request the chief officer of every relevant police force to provide any information which, in the chief officer's opinion –

(a) might be relevant for the purpose described in this statement under subsection (2), and

(b) ought to be included in the certificate."

Subsection (2) reflects the reality of the enhanced disclosure system according to which an application under the section should be accompanied by a statement by the registered person that the certificate is required for what is known as an exempted question, meaning a question in relation to which section 4(2)(a) or (b) of the Rehabilitation of Offenders Act 1974 has otherwise been excluded under section 4(4). Section 115(7) is the basis on which the Secretary of State (but in practice the CRB) requests chief officers to provide non conviction soft information: section 115 is in other words the statutory basis on which such information is provided as part of enhanced disclosure.

160. The next and final area of legislation which is relevant to the issues before the Tribunal concerns the use to which past convictions are put in subsequent proceedings. The Tribunal had the benefit of an extensive written statement from Philip Geering, Director of the Policy Directorate of the Crown Prosecution Service ("CPS"). Mr Geering has held this position since January 2004 and is responsible to the Director of Public Prosecutions and Chief Executive of the CPS for guidance underpinning the case work, practice and procedures adopted by the CPS prosecutors. His witness statement was signed on 7 April 2005 and is a useful survey of the relevant legal provisions which apply in this area. However, for convenience and completeness, only a brief reference will be made to the provisions which featured in the submissions before the Tribunal.
161. It has already been shown above how the Rehabilitation of Offenders Act has in effect decided that for certain purposes many offences should be regarded as spent. Paragraph I.6 of the Practice Direction (Criminal Proceedings: consolidation) [2002] 1 WLR 2870 which reduces the disclosure of spent convictions in large part it does not of itself render evidence of convictions inadmissible. See R v Corelli [2001] Crim LR 913. In addition as was pointed out by Mr Geering, at para III.27.3 of the same Practice Direction it is suggested that previous histories prepared by the police with regard to sentencing should include all convictions and cautions whether spent or non spent. In the words of Mr Geering that paragraph demonstrates that the standard format of antecedents should include not just (presumably all) convictions but also recorded cautions where those are not shown on the PNC.
162. Of much more importance is the need to have regard to the requirements of chapter 1 of part 11 of the Criminal Justice Act 2003. Those provisions apply to any trial commencing after 15 December 2004 so that the CPS is now obliged in general terms to consider the relevance of bad character admissible under the new provisions. Put shortly section 101 of the 2003 Act provides that evidence of the commission of any offence counts as evidence of bad character whatever the nature of the offence. Such evidence is then admissible either by way of being adduced directly or by way of cross examination of a defendant should it pass what is known as one of the "gateways" in section 101(1) of which only gateways (d) and (g) are subject to judicial discretion under sections 101(3) and 101(4). The gateways for the sake of completeness are the following, namely:

"(a) all parties to the proceedings agree to the evidence being admissible,

(b) the evidence is adduced by the defendant himself or is given in answer to a question asked by him in cross-examination and intended to elicit it,

(c) it is important explanatory evidence,

(d) it is relevant to an important matter in issue between the defendant and the prosecution,

(e) it has substantial probative value in relation to an important matter in issue between the defendant and the co-defendant,

(f) it is evidence to correct a false impression given by the defendant, or

(g) the defendant has made an attack on another persons character."

163. The Tribunal was referred to a decision, namely R v Hanson [2005] EWCA Crim 824, a decision for the moment reported only in The Times, 13 May 2005, being a decision of the Court of Appeal (Criminal Division) in which guidelines were set out as to the admissibility of evidence of a defendant's bad character, in particular evidence of previous convictions in criminal prosecutions pursuant to the 2003 Act. Equally, in R v Bovell & Dowds [2005] EWCA Crim 1091, a decision again reported for the moment only in The Times, 13 May 2005, a further decision of the Court of Appeal (Criminal Division), it was noted that it was necessary for all parties to have the appropriate information in relation to conviction and other evidence of bad character whether in relation to a defendant or some other person. The court also recommended revision of the Code of Practice above referred to with regard to the retention of information under Part II of the Criminal Procedure and Investigations Act 1996.
164. The Tribunal was also referred to R v Nye (1982) 75 Cr App Rep 247 in which the Court of Appeal held that a defendant should not be entitled as of right to be able to put himself forward as of good character if in fact he had spent convictions but that the matter was ultimately one for ruling of the trial judge. Reference was again made by the Appellants to the provisions of section 101(1)(f) in this respect. If a defendant asserted he had never committed any offence or had never been convicted but in fact had been subject to the convictions of any of the data subjects in the present appeals then it would clearly be appropriate for a trial judge to correct that false impression.

Equally, it is well established that any witness may have his credibility impugned by way of cross-examination as to his character including spent convictions: see generally R v Evans (1992) Crim LR 237. Such matters are now governed by section 100 of the 2003 Act and involve in general a consideration of whether such material provides important explanatory evidence with substantial probative value in relation to any matter or issue which might be in question and which might be raised as having substantial importance in the context of the case as a whole.

165. Mr Geering's witness statement also makes it clear that despite the overall effect of the 2003 Act particularly in section 100 and following although it may be the case on occasion that courts would be unwilling to allow evidence of old and possibly spent convictions to be used as evidence relating to a propensity to commit a crime, this will not invariably be so, eg in the case of repeated previous convictions for such offences as burglary, theft and aggravated vehicle taking. Nonetheless, his statement makes it clear that it is clearly desirable, if not vital, that the CPS retain possession of old convictions in order to be able to put forward fully informed and accurate submissions. He points out that in relation to the other gateways, eg gateways (c), (e) and (f), there is no discretionary power to exclude such evidence and thus in his words "any erroneous impression caused by reliance by the prosecution or a codefendant upon inaccurate information will be bound to affect the evidence at trial, if the statutory conditions are met".
166. Reliance was also placed by the Appellants upon the need to retain as comprehensive a database of convictions as possible with regard to the imposition of appropriate sentences by the criminal courts. This reflects the provisions of section 143 of the Criminal Justice Act 2003 which obliges a court to treat each previous conviction as an aggravating factor, should it consider that it can reasonably so treat it, having regard to the nature and relevance of the conviction on time that has elapsed. Moreover, previous convictions could also be relevant to the issue of potential danger to the public from a defendant. In addition convictions can often provide evidence relating to the effectiveness of the particular method of disposal adopted, ie reflecting whether an earlier sentence had been successful or not.
167. Mr Geering also stressed the need to retain convictions with regard to the question of a court considering whether a defendant should be bailed, and if so on what conditions. In written submissions the Appellants relied upon the fact that the probation service depended on the comprehensive database "as part of their assessment of the pattern of past and possible future offending and the risk presented by that offending": that quotation appears in paragraph 3 of another witness statement presented to the Tribunal by Mr Rob Voakes, Assistant Chief Officer of the West Yorkshire Probation Board whose evidence was in a witness statement dated 5 April 2005. Mr Voakes was neither called nor cross examined.
168. Reference has been made during the course of these appeals to the European Convention and Article 8. It is clear from the enforcement notices that the Commissioner took account of the fact of whether there had been a breach of these provisions. Article 8 provides as follows, namely:

"1. Everyone has the right to respect for his private and family life, his home and his correspondence.

There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.".

The relevant provisions of the Convention are, as is well known brought into force in England and Wales by virtue of the Human Rights Act 1998.

169. The 1998 Act was brought in, in order to give effect to the EC Directive. That Directive clearly reflects Article 8 rights. This is clear, if nothing else, from certain paragraphs of the preamble, in particular paragraphs (1), (2) and (7). Given the fact that the Third and Fifth Data Protection Principles find their origin in the Directive, it appears to the Tribunal to follow that if there is breach of Article 8 rights then it would normally follow that there will be a breach of the data protection principles.
170. Section 6(1) of the Human Rights Act 1998 renders it unlawful for a public authority (which in the present circumstances clearly include police forces) to act in a way incompatible with Convention rights. It is perhaps self evident to say that the Tribunal has an overriding duty to construe the 1998 Act in a manner which is consistent with the Convention, insofar as it is possible to do so and in accordance with the equally significant provisions of section 3(1) of the Human Rights Act 1998 which provides that "[So] far as if it is possible to do so" both primary and subordinate legislation must be read and given effect to in a way compatible with Convention rights.
171. However, the above approach, though giving effect in a realistic sense to the operation of the Directive and the 1998 Act, is dependent upon whether or not Article 8(1) of the Convention is even engaged.
172. At the heart of these appeals is the determination by the Commissioner that the retention of conviction data was unlawful. In the context of the retention of finger prints and DNA samples, it has been held by the House of Lords in Rv Chief Constable of the South Yorkshire Police and R (Marper) v Chief Constable of the South Yorkshire Police [2004] 1 WLR 2196 (commonly called the "Marper case") that retention of finger prints and DNA samples under the relevant provisions of the Police and Criminal Evidence Act 1984 as amended did not constitute an interference with the appellants' rights to respect for their private lives under Article 8(1). However the Court held that even if that were not the case such an interference would be "modest" and would be objectively justified under Article 8(2) as being necessary for the prevention of crime and the protection of rights of others.
173. Insofar as it is relevant to the present appeals, the Tribunal agrees with the general proposition that as to Article 8(1) as it was put by Baroness Hale of Richmond in her speech particularly at paragraph 76 of the report in Marper the general tenor of the jurisprudence of the European Court and Commission of Human Rights is that the retention, keeping or storage of private information by state institutions is an interference with Article 8(1) rights. It seems difficult to escape the conclusion that the same would necessarily apply to conviction data of the kind considered here. The Tribunal finds support in reaching this conclusion having regard to the discussion set out above with regard to the fact that generally conviction data constitutes sensitive personal data under the 1998 Act.
174. During the appeals the debate if any took place over whether the disclosure of information would be an interference with Article 8(rights): see eg the Marper decision at paragraph 72 and compare R(Ellis) v Chief Constable of Essex Police [2003] EWHC 1321 reported at (2003) 2 FLR 566.
175. In the Marper decision the majority of the House of Lords held that DNA information and finger print information held on the database was not information that engaged Article 8(1). However, as indicated above it seems eminently clear to the Tribunal that conviction data constitutes the clearest form, if not one of the most vivid forms of personal history unlike DNA information which is stored simply for identification purposes alone.
176. The Ellis decision illustrates the balance to be adopted with regard to the application of Article 8(2). The Tribunal has already stated that there is a critical distinction between the implications regarding disclosure and those regarding retention. In the case of disclosure there would clearly be an intricate balance to be struck between the right protected by Article 8(1) on the one hand and the question of whether inference was proportionate to the aim sought to be pursued: see eg Ellis supra particularly at paragraph 28; and see also Marper supra at paragraph 38 per Lord Steyn.
177. The Tribunal is prepared to accept therefore that Article 8(1) would be engaged with regard to conviction data. However, the Tribunal finds that the data here falls within Article 8(2), since retention is clearly in accordance with the law and relates to the interests which are set out. In any event the two data protection principles here in play require a somewhat similar exercise which is at the heart of these appeals, namely balancing on the one hand the protection of the interests of individuals whose data is sought to be retained as against on the other hand the legitimate pursuit of the purposes of the type set out in Article 8(2), namely here in particular public safety and/or the prevention of disorder or crime as well as the general protection of the rights and freedom of others insofar as there is an overlap between those concepts.

The Data Purposes

178. These have been mentioned above. The lawfulness of any processing has to be determined by reference to the scope of the purposes. The Tribunal was shown the actual particulars lodged by each of the Appellants in this case. It is clear that there is no mention as such of administration of justice as being a specified purpose. Nonetheless the parties proceeded on the basis that their expression was arguably covered by one or more of the explicitly stated purposes.
179. Nonetheless the Tribunal is of the view that the critical question is for what purpose or purposes is the data processor in fact using the data in question. The data controller is here the Chief Constable. Initially the PNC database was one which was developed by the police for policing purposes in its early days and reference can be made to the history of this recounted in brief by Mr McMullen. Mr McMullen informed the Tribunal that the number of users has increased vastly and now numbers many thousands. The Tribunal feels there could be no question of the police maintaining the PNC directly or indirectly in order to provide a service for those other users. From a data protection perspective the focus must remain upon the purposes which are in the registered particulars. For want of a better expression the parties during the appeals used the term "police operational purposes" which is a phrase which could be said fairly to characterise the dominant purpose to which data was put by the Appellant. In addition the parties suggested two further overall descriptions of the purposes namely first the one indicated above, namely assisting a court in the administration of justice, in particular the criminal courts and secondly employment vetting or the facilitating of such vetting via the various disclosure systems.
180. There can be no doubt that as a matter of principle, retention of conviction data falls squarely within the concept of operational police purposes not to mention the specific purpose descriptions pertaining to the prevention and detection of crime as well as the apprehension and prosecution of offenders which feature in the Register of Particulars applicable in these three cases.
181. The Tribunal accepts that employment vetting is in certain respects linked to the registered purposes and both parties accepted that in effect what was being addressed here was the risks attendant upon employment being given to persons who would otherwise be dealing with young people or vulnerable adults. The Tribunal was shown during the course of the appeals a Home Office circular No. 5/2005 entitled "Criminal Records Bureau: local checks by police forces for the purpose of enhanced disclosures' issue date 1/2/2005: implementation issue date: 1/1/2005)." The purpose of the Circular was stated to be twofold being first to supplement guidance already issued by ACPO on how forces should approach the task of determining what information is relevant and should therefore be provided to the CRB and secondly in its words "strongly to reinforce the message" put out by ACPO that only in "very exceptional circumstances described in the legislation may information be provided separately to the Registered Body instead of being shown on the face of the CRB Disclosure itself." Of particular importance is paragraph 4 of the circular which reads as follows:

"Failure to observe relevant legal provisions and principles lays forces open to legal challenge, and possibly to action for damages. It is imperative, therefore, that those members of each force who are responsible for making such decisions clearly understand the principles under which they must operate, and that they observe those principles to the full. (It should also be kept in mind that the provisions of the Police Act 1997 do not alter the basis upon which forces retain soft intelligence. This should be driven by the operational requirements of the police themselves. Information should not be recorded by the police, or retained for longer than is necessary for police operational purposes, solely against the possibility that the information – for example about suspicion of an offence of theft – might be needed in order to respond to a request by the CRB at sometime in the future, should the individual apply for a job that involved handling money. Separate guidance is in preparation about the retention and management of information, in light of the report of the Bichard Inquiry into the Soham case). If the correct principles had been observed, and logged as having been observed, a court is likely to interfere only if it satisfied that the decision to disclose is unreasonable – i.e., beyond the range of responses open to a reasonable decision maker."

182. The circular is also of importance given that in a section headed "(a) Determining what is relevant and should be disclosed," the police are firmly reminded of the fact that in the final analysis it is for the employer to decide whether or not information is relevant to the issue of an applicant's suitability for the position in an individual case but so far as the police are concerned "information should only be disclosed if there is clear reason to believe that it might be materially relevant – i.e. not fancifully, remotely or speculatively relevant but materially relevant." The circular therefore proposes that the test of relevancy in the realm of enhanced disclosures is for the police force or its appropriate officer to consider whether there was, in the main "….a firm basis for considering

(a) that the information might be directly relevant to assessment of the person's suitability to work with children (or vulnerable adults); and

(b) that a reasonable potential employer of the applicant for a particular job or position might find the information had been material to his or her decision as to whether or not to employ that individual in that job or position having regard to the question of whether that individual would pose a risk to children (or vulnerable adults)"

183. The Tribunal finds that the circular is admirably clear in its purpose as a reminder to chief police officers of the proper approach to employment vetting. Mr Gaskell has, as has been indicated, accepted that an overwhelming percentage of the applications to the CRB were made for this purpose. The touch-stone to this analysis remains and can only remain the stated scope of the purpose or purposes registered by the data controller. It follows that in the present appeals only insofar as employment vetting touches and concerns the prevention and detection of crime as well as the apprehension and prosecution of offenders can a chief police officer justify retention of data on the PNC.
184. Insofar as the Third and Fifth Data Protection principles are concerned, the Tribunal is not minded to make any concrete determination as to their exact scope and effect if only given the fact that the legislation itself, as has been seen stops short of so doing in its explanatory treatment of the principle in Schedule 1 particularly Part 2 to the 1998 Act. However, it is clear and this was to a large extent accepted by both parties to these appeals that there is some degree of overlap between the two principles here in play. There was some debate during the appeals about the concept of relevance set out the Third Data Protection Principle and the Tribunal would agree that with regard to the subject-matter of these appeals the notion of relevance would clearly be a movable feast if only given the content of the data retained. So for example the fairly sparse conviction data featuring in each of these appeals will enjoy a diminishing degree of relevance as time goes by. To some extent that trespasses into the realm of excessiveness and indeed the latter term could justifiably be said to be correspondingly reflected in the letter and spirit of the Fifth Data Protection Principle. Data which has been kept for longer than necessary for any of the so called operational police purposes here could on any view be regarded as excessive.
185. Reverting to the rubric of administration of justice, the latter phrase does not find any form of direct reflection in the formal descriptions of the various purposes attributable to each of the data controllers here. Nonetheless the parties agree that with regard to the administration of the criminal trials described above, it is important that the police be in a position to be conscious of the fact that legislation and case law make it abundantly clear that past convictions play an important role in the prosecution of offenders if nothing else. Here the factors to be weighed in the balance in applying the Third and Fifth Data Protection Principles may have differing degrees of weight from those which would apply with regard to what were called operational police purposes. So again, for example, conviction data coupled with other data that might be available in a criminal trial (which former data might of itself otherwise be of minimal value with regard to policing purposes) might be of greater importance when assessing the previous bad character of a defendant or of a witness in criminal proceedings. Just as the purposes differ, so will the factors differ with regard to a proper consideration of whether the data is relevant and/or excessive and/or not kept longer than is necessary no matter what the purpose. Conviction data may well have a greater role to play in the criminal process e.g at the trial stage given the legislative constraints of the Criminal Justice Act than such data might do with regard to operational policing activities generally.
186. At the heart of both principles which are in issue in these appeals is the critical question of balance namely whether the interests of the data subject mindful of the purpose for which that data is retained can be said to outweigh the value of the data retained. It could be said as indeed was contended for by the Commissioner that the concept of necessity in the Fifth Data Protection Principle involves similar principles which apply in the realm of Article 8(1). The classic dilemma in the cases involving Article 8(1) as has been seen is whether the requirements of any particular social or public need are outweighed by the rights of the subject coupled with an examination of whether the interference caused by the prosecution of the public right is proportionate to the aim being pursued. e.g. R (Ellis) v the Chief Constable of Essex Police (2003) FLR 566 particularly at paragraphs 1, 3-4, 27-29.

The Commissioner's Secondary Position

187. During the course of the appeals the Commissioner by his Counsel though forcefully pursuing his principal contention that the appeal should be dismissed was prepared to concede at least that in the alternative some variant of the step down model might be a tenable position. This could perhaps be viewed as a natural extension of the exchanges which have been set out above between his office and ACPO with regard to the way forward and the possible step down variant to the existing weeding system. It is equally fair to say that the Tribunal had expressed its own interest in attempting to fashion a way forward that would be consistent at least with the spirit of those exchanges.
188. Put shortly as the appeals unfolded it seemed that there were two principal objections to the course by which only the present data controllers or as it was put at some point police users would have access to the PNC. This alternative course was resisted by the Appellants on the basis that primary legislation would be required and secondly that it was not clear in any event that members of the police family as it was put would be prejudiced in their existing rights to seek access to the PNC in the way detailed by Mr McMullen.

As indicated above the Tribunal was shown a list of users who were presently given various forms of access, largely limited and described by the various hash codes which Mr McMullen described; such users include such important bodies and departments as the Commissioners of Inland Revenue, Customs & Excise of the Royal Military Police and other bodies which could generally be said to have some form of policing concern. The Tribunal will revert to this below.

189. The Commissioner himself accepted by his Counsel that there were two potential barriers even to his secondary position. The first was technological and the second statutory.
190. Enough has been said in this judgment to date to show that the applicable technology is constantly evolving particularly in the way in which the PNC is operated. Enough was heard from the witnesses to satisfy the Tribunal that just as the kinds of data available to any particular user could be restricted (as is indeed the present position) then similarly it might not even now be beyond those operating the PNC to restrict access to one party or group of parties alone. The Tribunal sees no reason why given time this should not be achievable subject naturally to the rights of parties to reapply should this be beyond any form of sensible resolution.
191. Insofar as any legal impediment was concerned the Tribunal had the benefit of a number of skilful and illuminating submissions made by Counsel on behalf of the Commissioner as to whether as a matter of law it was feasible for this Tribunal to make an order that though conviction data was to remain on the PNC non police users were not to be permitted to have access, a form of order which was called during these proceedings a "Police Access Only Order."
192. From what has been set out above the Tribunal clearly has power by virtue of section 49(1) to vary the terms of an enforcement notice in suitable circumstances. Any enforcement notice issued by the Tribunal would in effect replace these enforcement notices issued by the Commissioner. The two specific legal impediments are the following: the first concerned the operation of section 29(3) of the 1998 Act and the second section 113 of the Police Act 1997 and following. Both these sections have been set out above.
193. Section 29(3) when read with section 27(3) excludes the Third and Fifth Data Protection Principles regarding disclosure of information processed for certain purposes, those purposes including the prevention and detection of crime as well as the apprehension and prosecution of offenders. Counsel for the Appellants suggested that a Police Access Only Order would constitute a restriction on the disclosure of information held on the PNC so that by making such an order the Tribunal would in effect be applying the Third and Fifth Principles to disclosures in relation to which those principles were in fact disapplied by virtue of section 29(3).
194. The Tribunal agrees with the Commissioner. The provisions of section 29(3) do not in any way address the question of disclosure: nonetheless those principles apply with regard to retention which is at the very heart of these appeals. Any Police Access Only Order would simply ensure that data be continued to be retained and thus not contravene the two principles in play. The Tribunal regards that as a convincing answer although the Commissioner went on to contend by his Counsel that in any event section 29(3) applied only if the application of the relevant data protection principles was likely to prejudice the purposes set out in section 29(1). Although as has been seen Mr Smith has made detailed comments as to why the conviction data in these three appeals might be said to be of little or no relevance with regard to the stated purposes particularly the prevention or detection of crime and the apprehension and prosecution of offenders, the Tribunal does not find it necessary to rule on this subsidiary limb of the Commissioner's arguments.

Of much more importance is the way in which section 113 of the Police Act and particularly section 115 are to be interpreted. As has been indicated section 113(1) requires the Secretary of State to issue criminal record certificates being so called standard certificate certain circumstances. The term "relevant matter" which appears both in section 113 and section 115 is defined as meaning convictions including spent convictions and cautions: see section 113(5). Again, as is also described above the expression "central records' is to be read in the light of section 113(3) as well as section 112(3) with regard to basic disclosures and a more pertinently Regulation 9 of the Police Act 1997 (Criminal Records) 2002 Regulations. Those Regulations also define the term "prescribed details".

195. An enhanced disclosure certificate should include the same information as a standard disclosure certificate and may even include (as is often the case) non conviction information so called soft information: see generally section 115(6)(a)(i) and (ii) as well as section 115(7).
196. The legal impediment proposed by the Appellants was that if a Police Access Only Order was made the CRB on behalf of The Secretary of State would then be prevented from giving details of every relevant matter recorded in the central records.
197. The key analysis is therefore how to construe the words "recorded in central records" as they find expression particularly within section 113(3). Counsel for the Commissioner suggested three possible approaches. The first was by reference to ordinary principles of statutory construction so that the expression could simply mean "lawfully recorded at central records" (emphasis added). Counsel contended that it could not have been the intention of Parliament to require the CRB to disclose information that was either unlawfully recorded on the PNC or was lawfully recorded but could no longer lawfully be retained. The solution has an obvious appeal but the Tribunal feels it unnecessary to second-guess Parliament's intention and to some extent the answer may be said to depend largely if not exclusively upon the Tribunal's own determination on the present appeals.
198. The second limb of Counsel's argument meant having recourse to the Directive. In other words section 113(3) should be construed to be compliant with the overall spirit and matter of EU law. Here domestic legislation as is abundantly clear deals with matters which are the subject of a clear EU obligation and where at all possible the courts and tribunals on a domestic basis should construe domestic legislation to ensure compliance with EU Directives see e.g. Webb v EMO (Air Cargo) Limited [1995] 4 All ER 577. Perhaps as an alternative to this but certainly as a third limb, Counsel also relied upon the Human Rights Act 1998 section 3 to which reference has been made. Put shortly the argument was that should the Tribunal consider that to prevent a breach of Article 8 it was necessary for the relevant conviction data not to be made available to the CRB in effect an echo of the balancing act implicitly reflected within the two relevant data protection principles, so that section 113(3) should be construed so as to allow for that result. In Ghaidan v Godin-Mendoza [2004] UKHL30 [2004] 2 AC 557 The House of Lords held that it was possible under the Human Rights Act 1998 particularly section 3 to interpret the Rent Act 1977 Schedule 1 paragraph 2 so that it was compliant with rights in the European Convention. In consequence the court was required to depart from the interpretation of the paragraph previously enunciated in an earlier decision namely Fitzpatrick v Sterling Housing Association [2001] 1 AC 27 in order to ensure that paragraph 2 should be read and given effect to as though the survivor of a homosexual couple living together was the surviving spouse of the original tenant, see generally paragraphs 26-33 of Lord Nicholls of Birkenhead's speech. Lord Nicholls approved the principle that once it was accepted that section 3 might require legislation to bear a meaning which departed from "the unambiguous meaning" the legislation would otherwise bear, it became:

"…. impossible to suppose Parliament intended that the operation of section 3 should depend critically on the particular form of words adopted by the parliamentary draftsman in the statutory provision under consideration."

Lord Nicholls also stressed in paragraph 33 that the meaning imported by application of section 3 "must be compatible with the underlying thrust of the legislation being construed" see also Lord Steyn at paragraphs 38, 43-44, and 48. The Tribunal respectfully adopts the same approach in the present appeals.

Conclusions

199. There are three distinct appeals. Each is to be treated separately. Each has its own set of facts and any determination regarding each of the appeals is not necessarily to be treated as a determination of any case that might at first blush look the same.
200. The Tribunal feels that the evidence presented by both parties to these appeals at the same time was both sparse and over generalised. This is a predominant reason why the Tribunal stresses that the three instant appeals do not necessarily form the basis or any useful basis for future cases which might on the surface appear the same. In the Tribunal's view there are a number of factors which need to be borne in mind. First, there is the inherently unsatisfactory nature of the process demonstrated by each of these appeals. This is not a criticism of the parties but a necessary consequence of the implication of enforcement notices in the area of conviction data. As the opening remarks in this judgment show in the absence of any expression of consent by the data subject his or her anonymity must be preserved for the obvious reason that the enforcement notice may prove to be totally unfounded to the clear prejudice of the data subject. Secondly, the nature of the process revealed by each of these appeals is of necessity one-sided. As each of these appeals demonstrates there is likely to be on the one hand at least a basic conviction data coupled perhaps with particulars of the offence, court findings etc as well as any other information which might appear on the print out but on the other hand (if only by virtue of the anonymity which is sought to be preserved by all parties) in the absence of detailed particulars of the type indicated of any commentary upon the nature of and circumstances relating to the conviction data, the underlying facts will be untested even at the stages leading up to and including the enforcement notice process.
201. As these appeals have also demonstrated, there should in most cases even for old conviction data be retained a set of case notes, court files or similar materials which will help elucidate the factual background. Here it seems and the Tribunal must accept accordingly, that there was no such material with regard to any of these appeals. This reality (or lack of it) demonstrates the need for there to be a case by case appreciation of conviction data by Chief Officers as data controllers at some stage of the relevant history. In the proposed step down model (with whatever variant is proposed) the Tribunal feels that this should take place at the absolute latest when some form of step-out process is engaged, ie after the data has been removed from the PNC and the accessibility it currently enjoys under the present system.
202. It is, of course, fair to say that in one case, namely that of SY the Commissioner undertook the fairly rare step, so the Tribunal was informed, of inviting oral representation but even here the Tribunal feels that the inherent risks mentioned above remain present. Certainly, any version of events, however relayed by an aggrieved data subject would ideally of necessity be required to be subject to the kind of scrutiny which the obtaining of police records, court files etc might otherwise provide.
203. The upshot of the above is therefore this: the only information which the Commissioner is able to adduce and which can safely be relied on as being unchallenged is the basic conviction data described in each of these cases and no more than that. This is not in any way to condone any practice whereby the data subject should be made a party to these proceedings since the Commissioner and only the Commissioner is charged with a discretionary duty of issuing an enforcement notice in appropriate cases. A balance is struck by virtue of the fact that the Appellants in these cases are clearly able to bring forward any material they might find but in the result further additional information has not been forwarded or presented by any of the Appellants in these appeals.
204. As against what the Tribunal feels is no more than basic conviction data, a number of reservations clearly emerge from the Appellants' evidence. As has already been noted, the Tribunal feels that it is not in any way an exaggeration to state that the evidence presented before the Tribunal on the appeals is more extensive than that canvassed before or by the Information Commissioner at any stage prior to the issuance of the final enforcement notices. This was, in effect, accepted by the Commissioner in the person of Mr Smith and by the Commissioner's Counsel. Equally it is fair to say that Mr Smith maintained, subject to the Commissioner adopting his secondary position outlined above, that the Commissioner would still have made the same decision with regard to the enforcement notices in each of the appeals even with the benefit of the evidence presented before the Tribunal.
205. The Tribunal feels, however, that there are a number of significant factors which emerge from the Appellants' evidence which has been summarised above but which for convenience's sake can be summarised more briefly as follows. First, the Tribunal finds that the Weeding Rules in their present form and edition demonstrate that there is some incontestable value in retaining conviction data dependent largely upon the nature of the offence. The Weeding Rules represent a considered exchange between the parties, ie the Commissioner on the one hand and ACPO on the other which has in the result forged some form of generalised understanding that after a given data, certain offences should be removed from the PNC. However, the Tribunal finds equally that the Weeding Rules do not and could not conceivably represent an unqualified and rigid code in the way largely maintained on the part of the Appellants. It is sufficient for this purpose to refer to the various Forewords which preface each edition including the present edition and to take stock and account of the appropriate statutory framework drawn initially from the Directive and thereafter from the 1998 Act. Secondly, not unconnected with this first observation, the Tribunal is aware and duly finds that the perception of any particular offence both from the police point of view as well as from the more generalised public point of view will alter over time. As again highlighted above, generalised reference was made throughout the appeals to what were called "minor offences" without any great precision of that term. Various forms of assault might in the past have been regarded as serious and might now be regarded as perhaps less serious given the development of the criminal law. Nonetheless the Weeding Rules could be taken to reflect an evolving state of development in this respect. Thirdly, and not unconnected with the previous points the parties have clearly come to some form of generalised understanding that there is sufficient seriousness regarding certain offences, particularly those involving violence not to mention the more obvious cases of homicide and sexual offences which deserve retention, at least for a period longer than less serious offences. Fourthly, and this emphasises an important point made in the Bichard Inquiry Report, the police should initially be the sole judge of the value of retaining conviction data. This, however, is clearly subject to the role of the Commissioner, more particularly amplified in the 1998 Act. Fifth, there is the obvious point emphasised by Superintendent Linton that offenders may escape conviction for substantial periods of time which would of itself suggest that conviction data should be retained in certain cases for what might otherwise appear to be undue periods of time.
206. The Tribunal therefore finds this evidence as a whole presented by the Appellants therefore did afford some demonstration that conviction data does tend to alert officers to other information and may even trigger specific recollection in individual cases.
207. Conviction data will in any event assist with what was called profiling and general investigative work carried out by the police in their enquiries as well as in the carrying out of their functions and by virtue thereof in fulfilment of the purposes for which they are registered as data controllers. Next, and again not unconnected with the previous point, conviction data has the particular value if not otherwise retained, in the possible maximising of the benefits to be drawn from the retention of soft information which is not otherwise subject to the Weeding Rules. Such information can for this purpose be coupled with DNA and finger print information evidence which case-law has shown should be regarded as pure identification evidence. In this respect the Tribunal was reminded of comments made in the Court of Appeal by Sedley LJ in the Marper decision reported as R v Chief Constable of South Yorkshire and others [2002] EWCA Civ 1275 [2002] 1 WLR 3223 at paras 83 and 84 in which the learned Lord Justice pointed out that "from a policing and law enforcement point of view the unconvicted population is not uniformly beyond suspicion …". In that case the learned Lord Justice said that there was no virtue in deleting DNA profiles following acquittals since that would put at risk the possibility of procuring an eventual conviction in the case of a rapist who had left his DNA on previous occasions but had nonetheless secured earlier acquittals. Next and perhaps as important as any other point is the stress placed by the Appellants on the value of past convictions in the criminal arena, a matter already dealt with above and explained at length by Mr Geering in his written evidence.
208. As against all the above points, the real risk as it appears that the Tribunal at least as manifested in the cases of SY and WY is the prejudicial risk of disclosure as distinct from retention. If there were in force some form of police access only regime subject to one important qualification, no such disclosures in those cases would have occurred relating as they did to police complaints activity and the enquiries of a foreign immigration service and consequently no distress would have been experienced by the data subjects as taken into account of such by the Commissioner. The qualification relates to the manner in which WY's data was disclosed, namely by virtue of a request to disclosure made via a subject access request. This has been mentioned above. In other words, irrespective of any "police only" regime, data would always be available to a data subject through any subject access provision in the 1998 Act.
209. With regard to the engagement of Article 8(1) the Tribunal has found that by virtue of the submissions made on the part of the Commissioner Article 8(1) was engaged. As Counsel for the Commissioner put it, retained conviction data is intrinsically private in nature and moreover also constitutes sensitive personal data under the 1998 Act. The true question in the view of the Tribunal is whether engagement under Article 8(1) is in any way qualified by the provisions of Article 8(2). This involves an appreciation as to whether or not the interference by the interests maintained by the police is necessary in all the circumstances. On the evidence summarised above and more fully set out in the earlier part of this judgment the Tribunal has little hesitation in finding that on balance the interference at least in the sense of retention of conviction data is justified and thereby qualified by virtue of the provisions of Article 8(2) of the Convention since it contributes to the achievement of the Article 8(2) purpose. Again the Tribunal relies in this respect and respectfully refers to the observations of Lord Steyn in the Marper decision at paragraph 38. Although the observations made by Lord Steyn in that paragraph pertain to finger-prints and samples in the event of a regime in which police access only is tolerated the Tribunal finds that on balance the retention of such data would not be disproportionate in effect.
210. The Tribunal heard submissions about the notion of distress which featured in the considerations be taken into account by the Commissioner prior to the issuance of the enforcement notices. The Tribunal is of the view that the emphasis which the Commissioner should hereafter place upon distress in the case of the retention as distinct from the disclosure of sensitive personal data, in particular conviction data should be tempered by the realisation that in most cases the distress will stem from the disclosure as clearly manifested by the two cases of SY and WY. Indeed, it could be said that with regard to WY, any distress felt by WY would in reality take the form of a belief that any application for citizenship would be denied if the convictions were disclosed. Although the Tribunal does not take issue with the exercise of the Commissioner's initial discretion of a finding of distress as such, it is clear that particular attention would need to be focussed in such cases upon an examination to what degree any distress complained of emanated from the fact of retention rather than from the fact of disclosure.
211. As indicated above quite apart from its findings with regard to the engagement or otherwise of Article 8(1) of the Convention, the Tribunal is bound to make a determination as to whether or not the Third and Fifth Data Protection principles have been properly applied. Overall the Tribunal takes the view that the Commissioner was entitled to issue enforcement notices on the material he then had on the facts of each of these cases but given the wider range of material put before it the Tribunal has now been able to review the underlying determinations of fact and thereby exercises its right to review the notice and if necessary substitute another within the provisions of section 49(1) and (2) of the 1998 Act.
212. In the circumstances and as observed above, in the absence of any direct submissions on this issue the Tribunal does not consider it necessary to find that the secondary position adopted by the Commissioner during the appeals constitutes a relevant "change of circumstances" under the provisions of section 49(3) which might equally entitle it to vary the notice or notices in question.
213. With regard to the Third Data Protection Principle the Tribunal finds that initially the Commissioner was entitled to take enforcement action on the grounds submitted namely, first that he was requiring the police to exercise a discretion which in each of these cases the Appellants were reluctant to do, secondly that the imposition of such a discretion and/or decision-making process was not an unreasonable matter to put before the Appellants and thirdly, that there was not necessarily any unfair distinction between the types of data subjects called during the course of these appeals active and passive.
214. As to the first point the Tribunal has made it clear that it does not and cannot regard the Weeding Rules as capable of any discretionary approach by the data controllers. Secondly, the evidence showed clearly that Mr Smith, speaking on behalf of the Commissioner was conscious of only some 16 or so cases which might be regarded as active set against the evidence from Mr Gaskell that over 100,000 cases per year raised the question as to whether non conviction data should be disclosed as part of the enhanced disclosure process, each necessitating a case by case approach. Thirdly, the Commissioner was entitled to take the view that it was to be expected that some data subjects would take a more active role in seeking to have their data removed than those who did not.
215. Nonetheless on the evidence considered by the Tribunal on the appeal with regard to SY the Tribunal finds that despite the content of the oral exchanges made between SY's representatives and the Commissioner, the more extensive materials put before the Tribunal demonstrated on balance that SY's record should not be deleted or erased although it should remain subject to police eyes only. The same applies with regard to WY. In the case of NW although it is true that NW's involvement was in connection with the application for a job as a caretaker thereby resulting in disclosure by means of an enhanced disclosure and failure on the part of NW to be offered the job, the Tribunal takes into account the fact that NW was convicted of eight offences appearing before the court on five separate occasions. The Tribunal recognises that NW's offences are the oldest of the three appeals dating from a period between 1967 and 1969. Overall the Tribunal is of the view that the taking into account the factors stemming from the Appellants' evidence as a whole as listed above it is appropriate to retain the conviction data in all 3 appeals but subject to a police access only regime.
216. The Appellants apart from contending that the appeals should be allowed in toto maintained with regard to the Commissioner's secondary position that there are a number of insuperable objections. The first was that of necessity any barring of the PNC to uses other than the police, ie the data controller, would be prejudicial to those parties' interests. The Tribunal proposes to make an enforcement notice subject to a reasonably generous period of implementation with an inbuilt right to review such implementation, as indeed it was invited to, by the Commissioner. Secondly, the Tribunal stresses that the treatment of these appeals is based on the particular circumstances of each case before it. In any other case both the Commissioner and any future Appellant would need to be conscious of the need to verify whether there existed other particulars to which added factual background to the conviction or convictions on the face of any record as well as the desirability of making enquiries of the force in question to see whether case notes, court records etc were retained. Next, it is said that the entire scope of reviewing conviction data even after a step-down period begins would be burdensome but as the Commissioner maintains and the Tribunal duly accepts, this exercise already exists with regard to soft information and no or no convincing evidence was produced before the Tribunal to show that that exercise has in any way been controversial or represented any form of impediment to the operation of forces generally. It therefore follows in answer to a further contention that there is no reason on the basis of the materials produced to the Tribunal to assume that any anomaly would necessarily result. Finally, the Tribunal was alerted in very broad terms by Mr Smith to the possible risk of there being an illegal market with regard to conviction data. There was very little, if any, evidence on this and in fairness no real reliance was placed upon this intention by Counsel on behalf of the Commissioner.
217. The Tribunal therefore decides in each of the appeals to amend the enforcement notices in the following manner namely:

"Within 6 months to procure that the Conviction Data relating to [each of SY, WY and NW] currently held on the PNC data base be retained on the PNC subject to the retention rules of any current ACPO Code of Practice or any equivalent thereof and not be open to inspection other than by the data controller or by any other data controller who is or represents a chief officer of police."

The Tribunal also directs any and all parties to file a written review as to be the progress regarding the achievability of the aim set out in the above notice as amended, if they so wish, within four months of the date of this judgment.

General Observations

218. The Tribunal was, as indicated above, in effect invited to consider the way forward mindful of the fact that subject to the qualifications made expressly in this judgment there may be in general terms similar cases where conviction data has been retained for a considerable period and where ostensibly no further conviction or even non conviction data has been processed.
219. Mindful of the evidence that has been heard the Tribunal has the following observations. First, there clearly needs to be a review of whether a more rigorous and detailed form of categorisation as to the purposes registrable in respect of police users should be considered. The Tribunal fully appreciates that not only for data protection purposes but also for the recent Code of Practice on the Management of Police Information made by the Secretary of State for the Home Department and dated July 2005, ie since the date of these appeals, police purposes are still characterised as relating to the protection of life and property, preservation of order, the prevention of conviction of offences, the bringing of offenders to justice and any duty of responsibility of the police arising from common or statute law. Those categories largely reflect the existing purposes recorded against each of the Appellants in this case but the fact remains that the parties were persuaded into adopting more general expressions such as operational police purposes and administration of justice when those expressions find no expression in any of the material put before the Tribunal quite apart from the confusion caused by the notion of vetting in the particulars of the purposes given by each of the Appellants in these appeals.
220. An equally loose use of language again remarked on in the Bichard Inquiry Report concerns the use of the word weeding. Observations have already been made on this matter. The term is likely to be unclear at least to those outside the police and related services in suggesting either a review and/or deletion or indeed some other form of editing. Evidence was heard about the nature of the deletion process and the possible technological implications but the Tribunal feels it may be safer if not clearer to use more immediately understandable expressions such as deletion in the sense permanent removal as reflected in the actual enforcement notices issued by the Commissioner.
221. Of more practical importance is a consistency of approach with regard to what was called "collateral" disclosure in the case of SY. It is clear that there is no consensus on whether disclosure of conviction data occurs consistently in the realm of police complaints. SY was certainly not assisted in his or her cause by the fact that the appropriate authority informed SY that it did not in fact require the relevant data. It is clear, however, that this unfortunate consideration does not bear in any way upon the critical issue of retention. The Tribunal therefore respectfully suggests that it would be appropriate for all police forces to agree upon a common disclosure policy in the realm of complaints.
222. Next it is to be hoped that if the parties do find a common accord over a future deletion or weeding system code the same should clearly take into account the Code of Practice on the Management of Police Information just referred to. In keeping with the philosophy behind the Bichard Inquiry Report Recommendations, the Code is clearly addressed largely to the management of soft information but not exclusively so. The Code was issued after the appeals had been heard but for the record it is sufficient to refer merely in general to the provision concerning retention and deletion of police information. The code envisages future guidance issued under the aegis of the code and by section 4.6.1 it is provided as follows:

"On each occasion when it is reviewed, information originally recorded for police purposes should be considered for retention or deletion in accordance with criteria set out in guidance under this code."

Section 4.6.2 goes on as follows:-

"Guidance will acknowledge that there are certain public protection matters which are of such importance that information should only be deleted if:

(a) the information has been shown to be inaccurate, in the ways which cannot be dealt with by amending the records; or

(b) it is no longer considered that the information is necessarily for police purposes".

In the Tribunal's view it is paramount that any such guidance should be reflected and if necessary complemented by any future guidelines or code of practice regarding conviction data and its erasure or weeding. The new Code clearly contemplates ongoing review and the Tribunal respectfully suggests that a regular course of review should be explicitly set out in the case of conviction data both before and after any date which is fastened upon as being appropriate for the purposes of stepping down and certainly well before any stepping out in fact takes place. This is a matter for negotiation but some degree of consistent and periodic review should be specified. In any event, as indicated above at paragraph 62, the Tribunal feels that any guidance should be transmitted in somewhat more stringent terms.

223. Next, it is clear from the comments made even in this judgment that the relevant technology is likely to improve considerably. Not only may it be possible for police only access to be achieved within a reasonably short time-scale but technology may also be available to other specified users to be granted access to conviction data on the PNC. For this purpose the Tribunal grants specific permission to the parties in the first instance to make application on notice first to each other and thereafter to the Tribunal for permission to be given in respect of other users who might be thought appropriate to be granted access to the data and who are not otherwise covered by the terms of the suggested amended enforcement notices. Such application should be made initially in writing to the Tribunal with leave on the part of the Tribunal to convene a hearing if thought appropriate or on being satisfied by the parties that such is appropriate, the parties demonstrating in particular that the existing purposes for which the Appellants are registered are being fulfilled on such application being made. It is clear that the police service as a whole, together with the Home Office and PITO should together seek to upgrade and update the PNC as quickly as reasonably possible. The proposed step-down model will clearly strike the right balance between protecting data dispute rights and safeguarding police purposes. At the very least, the Tribunal recommends that any design for a national database in the form of the PNC or otherwise, and whether in response to the Bichard Inquiry Report Recommendations or for any other reason, be flexible enough to allow for the following transactions to be included should ACPO or any other authorised body request them, namely:

(1) Proper deletion of data subject records.

(2) Limiting of access to those users who meet criteria specified by ACPO or any other authorised body with access being on an opt-in basis, rather than an opt-out basis, i.e. any default mode if such be the case should be on a no-access basis.

(3) Amendments to users' details that pertain to their ability to match the "access" criteria.

(4) Amendments to criteria to meet changes in circumstances.

(5) Automation of record culling process should use a variety of appropriate prompts along the lines already indicated above, e.g. age, conviction data, time elapsed, etc.

The Tribunal in particular respectfully suggests that the criteria for access as well as for deletion be arrived at independently if at all possible and be clearly documented so that there is, in effect, transparency to all parties concerned.

224. Finally, and reflecting the suggestions made above, the Tribunal feels that any code regarding weeding or deletion should be much more sophisticated in its designation of the applicable criteria and that such matters as types of offence, age of offender, modus operandi, length of retention period, nature and extent of any soft information as well as other appropriate items, some of which were canvassed in the hearing, should be specifically incorporated in any revised code. The Commissioner in the person of Mr Smith took the view that the present weeding rules constituted a "blunt instrument" and the Tribunal respectfully agrees. The Tribunal has already made comments and observations about the Bichard Inquiry Report and refers the parties equally to the manner in which police information under the new Code of Practice promulgated in July 2005 deals with the grading and recording of police information.

David Marks

Deputy Chairman of the Tribunal

12th October 2005

John Black Lay Member of the Tribunal

Jean Nelson Lay Member of the Tribunal