The Divisional Court rejected, however, the Appellant’s case that SWP acted unlawfully under section 4(4) of the DPA 1998 by failing to comply with the first data protection principle, in particular that personal data must be processed lawfully and fairly. Given their conclusion on the Appellant’s Article 8 claim, the Divisional Court were satisfied that the use of AFR Locate in December 2017 and March 2018 satisfied that condition of lawfulness and fairness.
Turning to the requirement in section 34 of the DPA 2018 that SWP, as a “competent authority”, had to be able to demonstrate compliance with the provisions of Chapter 2 of Part 3 of the DPA 2018 concerning law enforcement processing, the Divisional
Court identified the issues in dispute as being: (1) whether (as the Appellant contended but SWP contested) the processing of the biometric data of members of the public whose faces are captured by the CCTV cameras entails “sensitive processing” as described in section 35(8) of the DPA 2018, and (2) whether (as the Appellant contended but SWP contested) AFR Locate failed to meet the requirements of section 35(5) . Those requirements are that: (a) the processing is strictly necessary for a law enforcement purpose; (b) the processing meets at least one of the conditions in Schedule 8; and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place. The Appellant contended that none of those requirements was satisfied.
On the first issue, the Divisional Court concluded (at [132] and [133]) that AFR Locate does entail sensitive processing within section 35(8) insofar as it involves processing biometric data of members of the public “for the purpose of uniquely identifying an individual” within section 35(8) (b).
On the second issue, the Divisional Court found that AFR Locate meets the first requirement of section 35(5) . They held (at [136]) that, for all the reasons given by them in relation to proportionality in the context of Article 8, the first of the requirements at section 35(5) , namely “the processing is strictly necessary for the law enforcement purpose”, was satisfied. The Divisional Court held (at [137]) that the second requirement of section 35(5) , that the processing must meet at least one of the conditions in Schedule 8 to the DPA 2018, was satisfied because of compliance with paragraph 1 of Schedule 8, the processing being necessary for the reasons given by the Divisional Court in the context of proportionality and Article 8, and the relevant rule of law being the common law duty to prevent and detect crime. As to the third requirement, that the controller has an appropriate policy document in place in relation to the sensitive processing in accordance with section 42, the Divisional Court said (at [139]) that they thought it was open to question whether the policy document relied upon by SWP, entitled “Policy on Sensitive Processing for Law Enforcement Purposes” dated November 2018 (“the November 2018 Policy Document”), fully met the standard required by section 42(2). They added the following at [141]:
“For the moment, we confine ourselves to the above observations. Given the role of the Information Commissioner and the prospect of further guidance, we do not think it is necessary or desirable for this Court to interfere at the present juncture and decide whether the SWP’s current November 2018 Policy Document meets the requirements of section 42(2) of the DPA 2018. In our view, the development and specific content of that document is, for now, better left for reconsideration by the SWP in the light of further guidance from the Information Commissioner.”
The Divisional Court turned finally, in respect of the Appellant’s data protection claims, to his claim that SWP had failed to comply with the obligation to undertake an impact assessment complying with section 64 of the DPA 2018. The Divisional Court rejected that claim on the grounds that at all material times the processing by SWP was supported by a relevant data protection impact assessment (“DPIA”) and that, approaching the matter on the footing that SWP had brought to bear a conscientious assessment, the impact assessment prepared by SWP did meet the requirements of section 64.
The PSED claim
The Divisional Court rejected the Appellant’s claim that SWP had failed to comply with its obligation under section 149 of the Equality Act 2010 because it did not, in its assessment, consider the possibility that AFR Locate might produce results that were indirectly discriminatory on grounds of sex and/or race because it produces a higher rate of positive matches for female faces and/or for black and minority ethnic faces. The Divisional Court said (at [153]) that there was no suggestion that, as at April 2017 when the AFR Locate trial commenced, SWP either recognised or ought to have recognised that the NeoFace Watch software it had licensed might operate in a way that was indirectly discriminatory, and even at the date of the hearing there was no firm evidence that the software did produce results that suggested indirect discrimination. The Divisional Court concluded (at [158]) that the Equality Impact Assessment prepared by SWP in April 2017 demonstrated that due regard was had by SWP to the section 149(1) matters.
The appeal
Permission to appeal has been given for all the following five grounds of appeal for which permission was sought:
Ground 1: The Divisional Court erred in concluding that the interference with the
Appellant’s rights under Article 8(1) of the Convention, taken with section 6 of the
HRA 1998 , occasioned by SWP’s use of AFR on 21 December 2017 and 27 March 2018 and on an ongoing basis, was/is in accordance with the law for the purposes of Article 8(2).
Ground 2: The Divisional Court made an error of law in assessing whether SWP’s use of AFR at the December 2017 and March 2018 deployments constituted a proportionate interference with Article 8 rights within Article 8(2). The Divisional Court failed to consider the cumulative interference with the Article 8 rights of all those whose facial biometrics were captured as part of those deployments.
Ground 3: The Divisional Court was wrong to hold that SWP’s DPIA complied with the requirements of section 64 of the DPA 2018. The DPIA is based on two material errors of law concerning the (non)engagement of the rights in Article 8 of the Convention and the processing of the (biometric) personal data of persons whose facial biometrics are captured by AFR but who are not on police watchlists used for AFR.
Ground 4: The Divisional Court erred in declining to reach a conclusion as to whether SWP has in place an “appropriate policy document” within the meaning of section 42 of the DPA 2018 (taken with section 35(5) of the DPA 2018), which complies with the requirements of that section. Having in place such a document is a condition precedent for compliance with the first data protection principle (lawful and fair processing) contained in section 35 of the DPA 2018 where the processing of personal data constitutes “sensitive processing” within the meaning of section 35(8) of the DPA.