The Divisional Court held that Article 8 was engaged. They considered that, like fingerprints and DNA, AFR technology enables the extraction of unique information and identifiers about an individual allowing his or her identification with precision in a wide range of circumstances, and that AFR-derived biometric data is information of an intrinsically private character. They said (at [57]) that the fact that the biometric data is derived from a person’s facial features that are manifest in public does not detract from that. They said (at [59]) that Article 8 is triggered by the initial gathering of the information and that it is sufficient if biometric data is captured, stored and processed, even momentarily.
The Divisional Court found that the interference with rights in Article 8(1) was justified by the conditions of Article 8(2). They rejected the Appellant’s primary argument that the use of AFR Locate by SWP was not “in accordance with the law” for the purposes of Article 8(2) because (1) there is no legal basis for the use of AFR Locate and so SWP does not, as a matter of law, have power to deploy it, and (2) in any event, any interference with Article 8 rights is not subject to a sufficient legal framework.
The Divisional Court held (at [75] to [78]) that using cameras with AFR technology to obtain the biometric data of members of the public in public falls within the common law powers of the police to obtain and store information for policing purposes, and that the compilation of the watchlists is both authorised under the Police and Criminal Evidence Act 1984 and within the powers of the police at common law. This is not an issue which we have to address in this appeal, since it is now common ground that SWP do have the power to deploy AFR Locate.
Having cited the general principles summarised by Lord Sumption in R (Catt) v Association of Chief Police Officers [2015] UKSC 9 , [2015] AC 1065 at [11] to [14] and R (P) v Secretary of State for Justice and Another (also known as In re Gallagher ) [2019] UKSC 3 , [2020] AC 185, at [16] to [31] applicable to the “in accordance with the law” standard for the purposes of Article 8(2), the Divisional Court held (at [84]) that there is a clear and sufficient legal framework governing whether, when and how AFR Locate may be used, comprising (in addition to the common law): (1) primary legislation, (2) secondary legislative instruments in the form of codes of practice issued under primary legislation, and (3) SWP’s own local policies.
As to primary legislation, the Divisional Court referred to the DPA 2018 (which they said they focused on rather than the DPA 1998 only for the sake of convenience). They said (at [85]) that it embeds key safeguards which apply to all processing of personal data, including the biometric data processed when AFR Locate is used. They referred, in particular, to the provisions in Part 3 of the DPA 2018. They observed (at [88]) that the requirements arising under the DPA 2018 are mirrored in the Code of Practice on the Management of Police Information, issued by the College of Policing under section 39 A of the Police Act 1996 , and that section 39 A(7) of the 1996 Act requires chief police officers to have regard to that Code.
As to the second element of the framework, the Divisional Court said (at [91]) that they agreed with the overall submission of the Surveillance Camera Commissioner that the Surveillance Camera Code of Practice, issued by the Home Secretary pursuant to section 30 of the PFA 2012 and to which a chief officer of police must have regard, provides a full system approach to the regulation of surveillance camera systems, as it provides the legal and good practice standard which the Government expects, as well as highlighting the broader spectrum of legislative requirements which apply.
As to the third element of the framework, SWP’s own policies as to the use of AFR Locate, the Divisional Court said (at [92]) that the three relevant policies are (1) SWP’s Standard Operating Procedure, (2) SWP’s Deployment Reports and (3) SWP’s Policy on Sensitive Processing.
The Divisional Court concluded (at [96]) that, drawing everything together, the cumulative effect of (1) the provisions of the DPA, (2) the Surveillance Camera Code of Practice and (3) SWP’s own policy documents, is that the interference with the rights in Article 8(1) which is consequent on SWP’s use of AFR Locate, occurs within a legal framework that is sufficient to satisfy the “in accordance with the law” requirement in Article 8(2); and that the answer to the primary submissions of the Appellant (and the Information Commissioner who supported him on this issue) is that it is neither necessary nor practical for legislation to define the precise circumstances in which AFR Locate may be used, e.g. to the extent of identifying precisely which offences might justify inclusion on a watchlist as a subject of interest or precisely what the sensitivity settings should be.
The Divisional Court then turned to the question of whether the interference of AFR Locate with Article 8(1) satisfied the four-part proportionality test in Bank Mellat v Her Majesty’s Treasury (No 2) [2013] UKSC 39, [2014] AC 700. Having accepted that it was appropriate, when applying the third and fourth criteria in the context of the facts of the present case, to apply a close standard of scrutiny, the Divisional Court rejected all the substantive submissions of the Appellant on this issue. They concluded (at [101]) that the use of AFR Locate on 21 December 2017 (Queen Street) and 27 March 2018 (Motorpoint Arena) struck a fair balance and was not disproportionate. The Divisional Court further said (at 108]), regarding any future use of AFR Locate, that, on the evidence before them as to the manner in which AFR
Locate was currently deployed by SWP, they were satisfied that there is no systemic
“proportionality deficit” such that it can be said that future use of AFR Locate by SWP would be inevitably disproportionate.
Data Protection claims
The Divisional Court recorded (at [109]) that, although none of the deployments by SWP of AFR in issue in the proceedings took place after the commencement of the DPA 2018 (25 May 2018), all parties had requested that the legality of the deployments of AFR Locate be considered as if they had taken place after 25 May 2018 and the Divisional Court were content to do so. The Divisional Court addressed the data protection claims under three headings: (1) the claim under the DPA 1998 , (2) the claim under section 35 of the DPA 2018, and (3) the claim under section 64 of the DPA 2018.
The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate entails processing personal data, SWP contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name. Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311 , [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.