Data retention and human rights: The Supreme Court speaks

The Supreme Court has overturned the Court of Appeal decisions in the cases of R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland and R (T) v Commissioner of Police of the Metropolis. The judgment has significant implications for public bodies' data retention policies and practices.

The facts

The facts can be summarised quite briefly.

Mr Catt (C) was a 91 year old man who had attended a number of protests by a sometimes violent anti-arms trade protest group called Smash EDO, and other groups associated with it. It was accepted that C believed in and practised peaceful protest. Data about C (usually his name, date of birth and address) appeared in Information Reports maintained by the police about some of the protests in which he participated. Additional information (including a photograph of C) had previously been retained but had been deleted by the police in the course of periodical reviews of their database. 

Ms T was a housing association tenant who was alleged to have made a homophobic remark to one of her neighbours (an allegation which she denied). She was served with a standard form "harassment notice" which stated that an allegation had been made and that further allegations of similar conduct may lead to her arrest and prosecution. The policy of the police was to keep a copy of the notice on file for 7 years, and on the police CRIS information system for 12 years. In fact the notice was destroyed by the police after 2½ years in the course of reviewing its files in preparation for the court proceedings.

C and Ms T brought judicial review proceedings in which they argued that retention of their personal data amounted to a breach of their right to respect for their private life under Article 8(1) of the European Convention on Human Rights. Both were unsuccessful in the High Court. The Court of Appeal in Catt ruled that retention of C's data was unjustified because it had not been shown to have any value for policing purposes. In R (T) the Court of Appeal held that retention of the notice "for any period of more than a year or so" would serve no useful purpose and was therefore unnecessary, disproportionate and unjustifiable.

The judgment of the Supreme Court

The Supreme Court disagreed. In their judgment in Catt and R (T) v Commissioner of Police of the Metropolis [2015] UKSC 9, their Lordships ruled that although retention of the data interfered with the individuals' Article 8 rights, that interference was justified (Lord Toulson dissenting on the question of justification in Catt). There was no suggestion that retention was not in accordance with the law, and the court had no difficulty in finding that it pursued a legitimate aim, namely intelligence gathering to support the investigation and prevention of crime, and (in Catt) the study of the leadership, organisation, tactics and methods of protest groups associated with violence. The court noted that seemingly trivial pieces of data may acquire greater significance as a picture develops over time, and that this justified the retention of data that might appear irrelevant or trivial when seen in isolation.

In Catt, the court held that retention was proportionate for a number of reasons. Firstly the interference with C's private life was minor and not intrusive (compared to DNA or fingerprint retention for example). Secondly, C's activities took place in the public rather than private domain. Thirdly, the retention of the information did not carry any stigma of suspicion or guilt. Fourthly, the material retained could only be used or disclosed for police purposes, and that robust procedures were in place to restrict its use. And finally, the material retained was periodically reviewed in accordance with rational criteria and was deleted when those criteria were no longer satisfied.

In R(T), the court noted that retention of the notice for a period of time was important in order to determine whether the incident in question formed part of a course of conduct that could amount to harassment. It would be impossible to determine that unless records of earlier incidents were retained. On the facts of the case (in which there were no further allegations) the court held that a period of 2½ years was not disproportionate.

Their Lordships declined to say what would have been a disproportionate period. The infinite variety of incidents and circumstances that can give rise to a course of conduct amounting to harassment did not permit such a generalisation. Lord Sumption stated that 2½ years was "at the far end of the spectrum" and Lord Mance said that in the context of the case, 2½ years was not disproportionate. Lady Hale and Lord Toulson agreed with that assessment and noted that the flexibility of the policy – under which data was deleted when it no longer served a useful purpose – meant that it was not unlawful.

What does this mean for public authorities?

What is a proportionate period of retention will depend on a number of factors including the nature of the allegation, whether there have been subsequent allegations of a similar nature, whether retention is subject to review, and whether data is deleted when retention would serve no useful purpose.

Retention of data about neighbour disputes or low level antisocial behaviour, for example, may cease to serve a useful purpose in the absence of further similar incidents, or simply after the passage of enough time. A useful starting point in determining whether retention of a particular record is still proportionate would be to ask whether the incident in question would be relied on to demonstrate a "course of conduct" amounting to harassment or antisocial behaviour. If not then retention of the record may no longer be justified. Landlords should ensure that their policies and practices are sufficiently flexible to allow for retained data to be periodically reviewed, and deleted when no longer relevant.

Public authorities should:

• ensure that data retention policies are reviewed to ensure compliance with the law as it develops;
• provide training to staff on data retention and ensure that staff are familiar with your policy in this area;
• review the length of time that you keep personal data on file on a case by case basis;
• always consider the purpose for which you hold personal data when deciding if (and for how long) to retain it;
• securely delete personal data once it is no longer needed for that purpose;
• update, archive or securely delete information if it goes out of date.

And so to Strasbourg?

It has been reported that the claimants may now take their cases to the European Court of Human Rights so this may not be the last word on the matter. Watch this space!