Three criticisms of the DPIA are made in Mr Squires’s skeleton argument. First, the DPIA’s analysis of the application of data protection principles contained no recognition that AFR entails the processing of the personal data (and still less the biometric data) of persons not on watchlists. Second, the DPIA did not acknowledge that the Article 8 rights of such persons are engaged. Third, the DPIA was silent as to the risks to other rights which are likely to be affected by the use of AFR: the rights to freedom of assembly under Article 11 of the Convention and freedom of expression under Article 10 of the Convention. There is no further elaboration of those points. The skeleton argument concludes, on this ground of appeal, that in the light of those three alleged deficiencies, the DPIA fell foul of the test specified by the Divisional Court itself (at [146]), namely:
“If it is apparent that a data controller has approached its task on a footing that is demonstrably false, or in a manner that is clearly lacking, then the conclusion should be that there has been a failure to meet the section 64 obligation”.
Mr Facenna’s skeleton argument made the following criticisms of the DPIA. First, the DPIA contained no assessment of the impact of the deployment of AFR on the protection of the personal data of members of the public who might be affected by the measures. Secondly, it contained no assessment of the risks to their rights and freedoms, so that, for example, there was little or no engagement with the fact that SWP’s use of AFR involved the collection of data on a blanket and indiscriminate basis, and it placed too little weight on the interference posed by the initial collection itself and the plainly ambitious scale of the collection, particularly bearing in mind that it involved the sensitive processing of biometric data. Thirdly, the assessment did not adequately address the risk that a false positive would result in innocent members of the public having their biometric data retained for longer periods and place them at risk of being subjected to more intrusive interventions by police. Fourthly, the assessment of the right to privacy under Article 8 of the Convention, privacy risks, and possible mitigation of those risks, was negligible at best, being more concerned with the technical operation of AFR.
In his oral submissions Mr Facenna said that the DPIA did not contain an assessment of privacy, personal data and safeguards. He said it contained no acknowledgment that AFR involves the collection of data on a blanket and indiscriminate basis and that the risk of false positives would mean a longer period of retention. He criticised the DPIA for failing to address the potential for gender and racial bias. Generally, he submitted that there was a failure in the DPIA to provide an assessment of the risks and mitigation of them, as required by section 64 of the DPA 2018. He said that the Divisional Court’s dismissal of the claim under section 64 has to be seen in the context of the conclusion of the Divisional Court that Article 8 was not infringed for non-matched members of the public.
Some of the criticisms now advanced by the Appellant and the Information Commissioner in respect of the DPIA fall outside the alleged two material errors of law specified in this ground of appeal. They include the point in Mr Squires’s skeleton argument that the DPIA does not refer to interference with the Convention rights to freedom of assembly and expression (Articles 10 and 11) and Mr Facenna’s arguments that a false positive would result in innocent members of the public having their biometric data retained for longer periods and place them at risk of being subjected to more intrusive interventions by police and that the DPIA failed to address the potential for gender and racial bias.
We agree with the Divisional Court that some of the criticisms of the DPIA made by Mr Squires and Mr Facenna are unjustified. The DPIA specifically acknowledged that AFR might be perceived as being privacy intrusive in the use of biometrics and facial recognition and that Article 8 of the Convention was relevant. It sought to explain that AFR would only avoid being in breach of Article 8 if it was necessary, proportionate, in pursuit of a legitimate aim and in accordance with the law but that all those requirements would be satisfied if AFR Locate was used in the manner set out. The DPIA explained how AFR Locate operates. It is obvious from that explanation that large numbers of the public would be caught through CCTV cameras used in the deployment. It specifically stated that: “It is the intention during each deployment to allow the AFR application to enrol and therefore process as many individuals as possible”. That the public at large was potentially affected was reflected in the statement that: “in order to ensure that the public are engaged in the use of the technology every opportunity has been taken to demonstrate its use, to include during Automated Facial Recognition deployments”.
This Ground of Appeal is, however, correct insofar as it states that the DPIA proceeds on the basis that Article 8 is not engaged or, more accurately, is not infringed. We have found, when considering Ground 1 above, that AFR Locate fails to satisfy the requirements of Article 8(2), and in particular the “in accordance with the law” requirement, because it involves two impermissibly wide areas of discretion: the selection of those on watchlists, especially the “persons where intelligence is required” category, and the locations where AFR may be deployed.
The inevitable consequence of those deficiencies is that, notwithstanding the attempt of the DPIA to grapple with the Article 8 issues, the DPIA failed properly to assess the risks to the rights and freedoms of data subjects and failed to address the measures envisaged to address the risks arising from the deficiencies we have found, as required by section 64(3) (b) and (c) of the DPA 2018.
For those reasons, we will allow the appeal on this ground.
Ground 4: Compliance with section 42 of the DPA 2018
The Appellant submits that one of the reasons why the use of AFR involves the unlawful processing of personal data is because SWP has failed to satisfy the requirements of the first data protection principle in section 35 of the DPA 2018. The Divisional Court held that the processing was for law enforcement purposes and was sensitive processing within section 35(3) . In the circumstances of the present case, this meant that the processing had to satisfy the requirements in section 35(5) , which included (in section 35(5) (c)) that, “at the time when the processing is carried out, the controller has an appropriate policy document in place”. Section 42 of the DPA 2018 sets out what such a document must contain.
As stated earlier, before the Divisional Court SWP relied on the November 2018 Policy Document. The Divisional Court thought that it was open to question whether that document, as then drafted, fully met the standard required by section 42(2) and said that ideally it should be more detailed. In paragraph [141] of their judgment, which we have quoted in full above, the Divisional Court said that the development and specific content of the document was, for the time being, better left for reconsideration by SWP in the light of further guidance from the Information Commissioner.