First, Mr Beer referred to the Privacy Impact Assessment produced by SWP. At para. 1.9, in addressing the question whether there is a specific business purpose that requires the use of the information, the answer included the following in relation to those on the watchlist:
“These individuals could be persons wanted on suspicion for an offence, wanted on warrant, vulnerable persons and other persons where intelligence is required.”
While we can readily understand that the first three of those categories are objective, the final category is not. In effect it could cover anyone who is of interest to the police. In our judgement, that leaves too broad a discretion vested in the individual police officer to decide who should go onto the watchlist.
Matters are not assisted by the fact that the next document to which our attention was drawn, the DPIA produced under the DPA 2018, does not include that last category (of intelligence purposes) at all. That document (at page 5) says that the purpose of AFR is to identify and locate:
Individuals suspected of criminality and who are wanted by the courts and police.
Individuals who may pose a risk to themselves and others.
Individuals who may be vulnerable.
Mr Beer also drew our attention to what is set out in page 16 of that same document. That, however, seems to us not to be material in the present appeal, since that concerns the application of the Regulation of Investigatory Powers Act 2000 . As is common ground, covert surveillance is governed by that legislation and would require authority under the system of warrants created by that Act . Overt surveillance, in contrast, such as AFR Locate (as it was carried out by SWP on the facts of the present case) does not require such authorisation.
Mr Beer also drew our attention to what is said at page 20 of the same document:
“Concerns have been raised by privacy experts that an individual may seek to enquire as to whether they have been included in a watchlist outside of the 24-hours retention period. Therefore, it has been deemed appropriate to be able to reengineer watchlists. This can now be achieved via Niche RMS ‘back-end’ database by recording the nominal number of an individual extracted into a watchlist for on given date, this added functionality is available from October 2018.”
With respect, it seems to us that deals with a technical matter and does not govern the question of who can be properly placed on a watchlist.
Finally, in the context of who can be placed on a watchlist Mr Beer drew our attention to SWP’s Standard Operating Procedure, at page 6, where it is said:
“3. AFR Locate The system works by means of a pre-populated Watch List which will contain information and images of subjects and a pre-defined response should these subjects be located by the system. Watchlists will be both proportionate and necessary for each deployment with the rationale for inclusion detailed pre-event in the AFR Locate deployment report. Primary factors for consideration for inclusion within a watchlist will be watchlist size, image quality, image provenance and rationale for inclusion. The numbers of images included within a watchlist cannot exceed 2,000 due to contract restrictions but in any event 1 in 1000 false positive alert rate should not be exceeded. Children under the age of 18 will not ordinarily feature in a watchlist due the reduced accuracy of the system when considering immature faces. However, if there is a significant risk of harm to that individual a risk based approach will be adopted and rationale for inclusion evidenced within the deployment report. The decision for an AFR deployment wherever possible will ultimately be made by the Silver Commander with the DSD project team acting as tactical advisors. Wherever possible the deployment of AFR Locate should be detailed with the Silver Commanders Tactical plan. If a deployment does not feature a Silver Commander the rationale for deployment will be ratified by the Digital Services Division Inspector and be detailed within the AFR Locate Deployment Report.”
Again, it seems to us, that does not govern the question of who can be put on a watchlist in the first place.
So far as the location of deployment is concerned, Mr Beer really was not able to draw our attention to anything which specifies where AFR Locate may be deployed. He drew our attention to the (unnumbered) paragraphs 7-9 and 11 of the Standard Operating Procedure, again at page 6 of that document. He also drew our attention to page 21 of the DPIA, where it is said:
“As we are testing the technology South Wales Police have deployed in all event types ranging from high volume music and sporting events to indoor arenas.”
That simply underlines the concern that we have in this context. First, it is a descriptive statement and does not lay down any normative requirement as to where deployment can properly take place. Secondly, the range is very broad and without apparent limits. It is not said, for example, that the location must be one at which it is thought on reasonable grounds that people on the watchlist will be present. These documents leave the question of the location simply to the discretion of individual police officers, even if they would have to be of a certain rank (a “Silver Commander”). For the above reasons this appeal will be allowed on Ground 1.
Ground 2: Proportionality
Strictly speaking, it is unnecessary for this Court to consider Ground 2 in this appeal, which relates to the question of proportionality, since, if (as we have held) the interference with the Appellant’s Article 8 rights was not in accordance with the law, one never reaches the stage of asking whether that interference was proportionate.
Nevertheless, as we heard full argument on Ground 2, we will address it.
The Divisional Court addressed the question of proportionality at [98]-[108]. It set out the relevant principles for the objective justification of a limitation on a Convention right at [98] by setting out four questions which are now very familiar:
“If an interference with Article 8(1) rights is to be justified it must meet the four-part test in Bank Mellat v Her Majesty's Treasury (No 2) [2014] AC 700, namely: (1) whether the objective of the measure pursued is sufficiently important to justify the limitation of a fundamental right; (2) whether it is rationally connected to the objective; (3) whether a less intrusive measure could have been used without unacceptably compromising the objective; and (4) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. (See per Lord Sumption at [20]; and especially on question (3), per Lord Reed at [70] to [71] and [75] to [76]).”
As before the Divisional Court, so before this Court there is no dispute as regards the first two of those questions. Mr Squires did not make any submissions before us in relation to the third question either. What he did submit was that the Divisional Court fell into error in answering the fourth question, whether a fair balance has been struck between the rights of the individual and the interests of the community. The Court answered that question at [101] as follows: