Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
YZ v Chief Constable of South Wales Police & anor [2022] EWCA Civ 683
The claimant sought to appeal a decision of the High Court dismissing his claim for judicial review.
YZ had expanded considerably the target of that judicial review between the hearing at first instance and the subsequent appeal. In the court below, YZ had sought to challenge South Wales Police’s (“SWP”) decision to refuse to delete data pertaining to his acquittal of serious sexual offences. However, at appeal, YZ attempted to obtain deletion of all personal data pertaining to him from all police records.
YZ’s problem was that he had never asked SWP to delete any data other than that specifically pertaining to his acquittal. Therefore, there was no decision refusing to delete records other than those relating to the acquittal that he could challenge.
Whilst the Court accepted that YZ could theoretically have mounted a challenge to the policies underpinning the retention of his data, he had expressly not called the policies’ lawfulness into question. Therefore, the Court of Appeal had to proceed on the assumption that the policies applied by SWP were lawful and compatible with Article 8 of the European Convention on Human Rights. That fundamentally undermined YZ’s challenge.
Unsurprisingly, Court dismissed the arguments proffered by YZ in respect of the deletion of all of his data, wherever held.
The Court held that the National Police Chiefs’ Council’s (“NPCC”) Guidance placed the burden for establishing compliance with the Data Protection Act 2018 (“DPA”) with the data controller, rather than placing an evidential burden on the applicant, as YZ contended. The relevant decision maker in SWP had had regard to all of the relevant information before him when deciding not to delete the information about YZ.
The Court of Appeal also concluded that the first instance judge had been right to decide for himself whether retention of sensitive data was strictly necessary. The Court held that the familiar rationality test had no application in a judicial review of the lawful basis for processing under Part 3 of the DPA because “the question [i.e. Is the processing strictly necessary?] admits of only one correct answer”.
The Court went on to conclude that the first instance judge had correctly applied the strict necessity test. The NPCC Guidance started from the position that it was strictly necessary and proportionate to retain information on the Police National Computer (“PNC”) unless there were exceptional factors present, such as strong public interest considerations or the records in question were inaccurate. No such factors were present, in the Court’s view.
Finally, the Court continued a trend in DPA cases by reaffirming that where the lawfulness of data retention is challenged, there will be no material distinction between the proportionality assessment required by the first and fifth data protection principles under Part 3 of the DPA and that required by Article 8 ECHR. Therefore, if retention was compliant with the DPA, it would be compliant with Article 8 ECHR. In this case, the Court concluded, the balance weighed in favour of retention.
Jason Beer QC, Alan Payne QC, Bobby Talalay and Amy Clarke appeared in this case. They did not contribute to this article.
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
