We are conscious that the police have long used techniques to gather information which are undoubtedly in accordance with the law. For example, they have the power to observe what they see in a public place, to record that information and to retain it in their files. Just as the human eye can observe a person in a public place, so the police have the power to take photographs of people.
We do not, however, accept the submission on behalf of SWP that the present context is analogous to the taking of photographs or the use of CCTV cameras. The following features of the present case lead us to conclude that it falls somewhere in between the two poles on a spectrum which are represented by S v UK on the one hand and Catt on the other.
First, AFR is a novel technology.
Secondly, it involves the capturing of the images and processing of digital information of a large number of members of the public, in circumstances in which it is accepted that the vast majority of them will be of no interest whatsoever to the police.
Thirdly, it is acknowledged by all concerned that this is “sensitive” personal data, within the meaning of the DPA 2018. That Act in turn reflects EU legislation. This represents an institutional recognition of the sensitivity of the data concerned, a feature which is not present for example for ordinary photographs.
Fourthly, the data is processed in an automated way.
We accept a large part of the analysis of the Divisional Court but not all of it. We consider that the legal framework which the Divisional Court regarded as being sufficient to constitute the “law” for the purposes of Article 8(2) is on further analysis insufficient.
The fundamental deficiencies, as we see it, in the legal framework currently in place relate to two areas of concern. The first is what was called the “who question” at the hearing before us. The second is the “where question”. In relation to both of those questions too much discretion is currently left to individual police officers. It is not clear who can be placed on the watchlist nor is it clear that there are any criteria for determining where AFR can be deployed.
The DPA 2018 and the relevant policies in substance require only that there has to be a proper law enforcement purpose. The use of the measure must then be considered to be necessary to achieve that purpose.
We would also emphasise that one of the elements of the system as operated in South Wales which is crucial, in our view, is that the data of anyone where there is no match with a person on the watchlist is automatically deleted without any human observation at all and that this takes place almost instantaneously. We would hope that that feature of the current scheme would not simply be set out in a policy document by way of description but that it would be made clear that such automatic and almost instantaneous deletion is required for there to be an adequate legal framework for the use of AFR Locate.
We would accept, and indeed it was common ground, that it is not for the Appellant or for this Court to design a particular set of policies in order for them to comply with the quality of law requirement. We are satisfied, however, that the current policies do not sufficiently set out the terms on which discretionary powers can be exercised by the police and for that reason do not have the necessary quality of law.
We make it clear that we would not wish to be unduly prescriptive as to the content of any new policies, for example the principle of “neither confirm nor deny” is wellestablished and would have to be respected.
It might even be that, once the “who” question can be satisfactorily resolved, that will give clear guidance as to the “where” question. This is because it will often, perhaps always, be the case that the location will be determined by whether the police have reason to believe that people on the watchlist are going to be at that location.
We now turn in more detail to each of the three elements of the legal framework which the Divisional Court found to be sufficient to have the quality of law in the present context: the DPA 2018, the Surveillance Camera Code of Practice and SWP’s local policies.
Data Protection Act 2018
As Mr Beer pointed out at the hearing before us, the present context is governed not simply by the general provisions in the DPA 2018 but by Part 3, which deals specifically with the subject of law enforcement processing.
Section 31 defines “the law enforcement purposes” in this context as:
“The purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”
Chapter 2 of Part 3 sets out the governing principles. Section 34 provides an overview and explains that the Chapter sets out the six data protection principles. The first data protection principle, set out in section 35(1) , is that processing must be lawful and fair.
Amongst the requirements of the first data protection principle, set out in section 35 , are the following. The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is “based on law” and either (a) the data subject has given consent to the processing for that purpose or (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority: see subsection (2).
In addition, where the processing is “sensitive processing”, it is permitted only in the two cases set out in sub sections (4 ) and (5). Of particular relevance in the present context is subsection (5), which deals with the situation where (a) the processing is “strictly necessary” for the law enforcement purpose, (b) the processing meets at least one of the conditions in Schedule 8, and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place in accordance with section 42.
Schedule 8, which sets out conditions for sensitive processing under Part 3, provides that the condition in paragraph 1 is met if the processing “(a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and (b) is necessary for reasons of substantial public interest.”
We accept, as did the Divisional Court, that the legal protections in the DPA 2018 form an important part of the framework in determining whether the interference with the Appellant’s Article 8 rights was in accordance with the law. That Act is not, however, sufficient by itself, nor was it suggested that it is.
Before leaving the DPA 2018 we should mention one further matter. In the skeleton argument on behalf of the Information Commissioner it was submitted that the Divisional Court had fallen into error by putting the cart before the horse in that it had addressed the question of the requirement of law in Article 8(2) of the Convention before considering whether there had been compliance with section 35 of the DPA 2018. In particular, it was submitted that the processing of the data in the present case was not “based on law” within the meaning of section 35(2) of the DPA 2018, interpreted in accordance with the EU’s Law Enforcement Directive and the Convention, because there was no legal basis for the processing that was clear, precise and foreseeable in its application. It was also submitted that the processing was not “strictly necessary” for the law enforcement purposes as required by section 35(5) (a) of the DPA 2018.