The first request (no formal application being thought to be necessary) was made on behalf of the Information Commissioner to refer to two documents which have been issued by her since the judgment of the Divisional Court. The first of those documents is ‘The Use of Live Facial Recognition Technology by Law Enforcement in Public Places’ (31 October 2019). The other document is an ‘appropriate policy document’ template in relation to law enforcement processing under Part 3 of the DPA 2018.
Mr Beer did not object to our looking at these documents in general terms, although he did object insofar as reference might be made to any matter of fact which was not before the Divisional Court. While we found the first document interesting, it did not
affect our decision or our reasons in this appeal. We have considered the ‘appropriate policy document’ template in relation to Ground 4 for the reasons we set out in paras. 160 and 161 of this judgment, which reflect the decision of the Divisional Court in paras. [139]-[141] of their judgment.
The other procedural matter to be addressed is an application on behalf of the Surveillance Camera Commissioner to adduce fresh evidence in the form of a letter dated 4 December 2019 which was sent to the Secretary of State by, amongst others, the Surveillance Camera Commissioner. This was said to be relevant to an issue mentioned by the Divisional Court in its judgment, at [44], where reference was made to the fact that the Secretary of State has set up an Oversight and Advisory Board
(“the Board”), comprising representatives from the police and other bodies, including the Surveillance Camera Commissioner, “to coordinate consideration of the use of facial imaging and AFR by law enforcement authorities.” As we understand it, a disagreement has arisen since the judgment of the Divisional Court between the Surveillance Camera Commissioner and the Secretary of State as to the role performed by the Board.
On behalf of the Secretary of State objection was taken to the admissibility of this evidence by Mr O’Brien, although he was content that we should look at it on a contingent basis.
We need not take time over this procedural dispute. It seems to us that Mr O’Brien was right to submit that the setting up of the Board was at most a peripheral point, mentioned in passing in the Divisional Court’s judgment. It does not seem to us to have had any material impact on that Court’s judgment: in particular, that Court made no reference to the existence of the Board in its reasoning on the issue of whether the interference with Article 8 rights was in accordance with the law. In any event, it does not affect this Court’s conclusions or reasoning in this appeal. For that reason we refuse the application to adduce fresh evidence on behalf of the Surveillance Camera Commissioner.
Conclusion
For the reasons we have given this appeal will be allowed on Grounds 1, 3 and 5. We reject Grounds 2 and 4.
As to the appropriate remedy, we consider that declaratory relief to reflect the reasons why this appeal has succeeded will suffice. In the circumstances which have arisen, the parties agree that the only remedy which is required is a declaration but they have not been able to agree the precise terms of a declaration. Having considered the rival contentions, we have concluded that the declaration proposed by SWP more accurately reflects the judgment of this Court. We will grant a declaration in the following terms:
The Respondent’s use of Live Automated Facial Recognition technology on 21
December 2017 and 27 March 2018 and on an ongoing basis, which engaged Article 8(1) of the European Convention on Human Rights, was not in accordance with the law for the purposes of Article 8(2).
As a consequence of the declaration set out in paragraph 1 above, in respect of the Respondent’s ongoing use of Live Automated Facial Recognition technology, its Data Protection Impact Assessment did not comply with section 64(3) (b) and (c) of the Data Protection Act 2018 .
The Respondent did not comply with the Public Sector Equality Duty in section 149 of the Equality Act 2010 prior to or in the course of its use of Live Automated Facial Recognition technology on 21 December 2017 and 27 March 2018 and on an ongoing basis.
ANNEX A
LEGAL FRAMEWORK
Legislation
Data Protection Act 1998 (“ DPA 1998 ”)
Section 1(1) of the DPA 1998 defined "personal data" as:
“… data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller”.
Section 1(1) of the DPA 1998 defined "data processing" as:
“… obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data” [with a range of non-exhaustive examples given].
Section 4(4) provided that it was:
“… the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller” [subject to section 27(1) concerning the exemptions].
The data protection principles were set out in Schedule 1 to the DPA 1998 :
Principle 1 is that personal data shall be processed fairly and lawfully and, in particular, shall not be “processed” at all unless it is necessary for a relevant purpose (referred to in Schedule 2 below). In the case of the police, the relevant purposes are the administration of justice and the exercise of any other function of a public nature exercised in the public interest.