In short

Five chief constables appealed enforcement notices requiring them to delete old minor convictions from the Police National Computer after the Information Commissioner found retention breached the third and fifth data protection principles. The convictions of five individuals — including a 1984 shop theft, a 2001 juvenile reprimand, and offences from the 1970s and 1980s — had been disclosed through Criminal Records Bureau certificates or subject access requests, prompting complaints that the police's abandonment of ACPO's earlier weeding policy was unlawful.

The Information Tribunal upheld the Commissioner, confining its analysis to narrow 'core' police operational purposes and rejecting the police evidence that even very old convictions could assist investigations. The tribunal ordered deletion, with ramifications that could affect around a million convictions if applied consistently.

The Court of Appeal allowed all five appeals and quashed the enforcement notices. Waller LJ, Carnwath LJ and Hughes LJ held that DPP3 and DPP5 must be judged against all registered policing purposes, including supplying conviction records to the CPS, courts and CRB, not core purposes alone. On DPP1 fairness in SP's case, Waller LJ and Hughes LJ quashed the notice; Carnwath LJ would have upheld the tribunal's finding that retention was unfair after an assurance the reprimand would be removed at age 18.

Decision

Appeals by five chief constables allowed. [51]
Enforcement notices quashed. [51]

Issues

In applying DPP3 and DPP5 to PNC conviction data, must the Information Commissioner and Tribunal judge retention only against narrow 'core' police operational purposes?
No. The data controller determines the purposes for which data is processed; there is no statutory basis to confine assessment to core operational purposes and exclude assisting the CPS, courts, CRB and other agencies from the purposes for which convictions are retained. [66]
Did the registered policing purposes include retaining conviction data so it could be supplied to the CPS, courts and CRB?
Yes. The Chief Constables' registration covered policing purposes including vetting and licensing, with recipients listed as employers, courts and law enforcement agencies; a complete record of convictions is required for those purposes. [36]
Was the Tribunal wrong to substitute its own assessment of the utility of old minor convictions rather than accept the police's rational operational judgment?
Yes. The Commissioner should review, not replace, police judgments about operational needs; if senior officers rationally believe even old minor convictions may assist investigations, statistical re-offending analysis does not justify requiring deletion. [99]
Does mere retention of a conviction record on the PNC engage Article 8 of the European Convention on Human Rights?
No. The bare fact of conviction is not private information engaging Article 8; even if engaged, retention in a complete official register is in accordance with law and necessary in a democratic society. [81]
Was retention of SP's juvenile reprimand after her 18th birthday unfair under DPP1 because police had assured her it would be removed if she stayed out of trouble?
No (majority). Applying the current retention policy equally after a policy change is not unfair; section 29(1) may also exempt conviction retention from the fairness requirement of DPP1 where deletion would prejudice crime prevention. [105]

Reasoning

Retention complaints in practice flow from disclosure risk, not retention alone; Parliament's Rehabilitation of Offenders Act exceptions govern when old convictions may be revealed. [44]
The purpose of maintaining a complete conviction register is not negated by showing one particular record has no identifiable utility in an individual case. [98]
Retention of conviction data cannot be held unlawful under DPP3 and DPP5 merely because future disclosure might infringe those principles; each processing operation must be assessed separately. [57]

Written by AI from the judgment on 23 August 2026. Each ¶ links to the paragraph it came from. Read those before relying on it.

▶Statutes Cited26

▶Case Law Cited3

▶Cited By19

Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor [2009] EWCA Civ 1079

[2009] EWCA Civ 1079

Case No C1/2008/2124

IN THE SUPREME COURT OF JUDICATURE

COURT OF APPEAL (CIVIL DIVISION)

ON APPEAL FROM THE INFORMATION TRIBUNAL

John Angel, Chairman

EA/2007/0096,98,99,108,127

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 19/10/2009

Before

LORD JUSTICE WALLER

LORD JUSTICE CARNWATH

LORD JUSTICE HUGHES

Between

Chief Constable of Humberside PoliceAppellants

Chief Constable of Staffordshire PoliceAppellant

Chief Constable of Northumbria PoliceAppellant

Chief Constable of West Midlands PoliceAppellant

Chief Constable of Greater Manchester PoliceAppellant

David N Jones (instructed by Greater Manchester Police) for Appellants

Timothy Pitt-Payne (instructed by Information Commissioner’s Office) for Respondent

Jonathan Swift and Cecilia Ivimy (Treasury Solicitors) for Intervening Party

Hearing Hearing dates : 22 nd– 24 th June 2009

Judgment

Lord Justice Waller

[1]The issue on this appeal is whether by virtue of the principles (referred to as DPP) under the Data Protection Act 1998 (the Data Protection Act) the Police are bound to delete certain old convictions from the Police National Computer (the PNC). The appeal is concerned with the convictions of five individuals, details of which, as provided in appendices to the appellants’ skeleton, are annexed hereto. The complaint in each case follows the disclosure of the convictions pursuant to a request by the Criminal Records Bureau (the CRB) or, in one case, a request by one of the individuals herself, and it is important to emphasise at the outset that the complaint about retention flows in reality not from the retention itself but from the fact that, if retained, disclosure may follow. In respect of each of those convictions the Information Tribunal (the IT) has upheld the view of the Information Commissioner (the IC) that they should be deleted. However the ramifications are far wider than these five cases since, if these convictions must be deleted and if the police are to treat people consistently, the application of any viable system of weeding would probably lead to the deletion of around a million convictions.

[2]There was a time when the Police and the IC were able to agree the appropriate policy in relation to the way old convictions recorded on the PNC should dealt with, to accord with the Data Protection Act principles. The Data Protection Act section 51(4)(b) provides that any trade association may submit a code of practice to the IC and presumably the Association of Chief Police Officers (ACPO) did so. My reading of Deputy Chief Constable Ian Readhead’s statement would lead me to think that ACPO (without consultation with, for example, the CPS or the courts) were persuaded that data protection principles should lead them to have what was termed a “weeding policy” which resulted in certain convictions being removed after a certain period without further convictions. That was acceptable to the IC, who indeed endorsed the Codes of Practice for Data Protection produced by the Association of Chief Police Officers (ACPO) in 1995, 1999 and 2002. However, following an inquiry held by Sir Michael Bichard (as a result of Ian Huntley’s conviction in December 2003 for the murders of Jessica Chapman and Holly Wells), and a review of the duties of the Police, resulting from a number of matters, e.g.(a) legislation relating to retention of DNA and fingerprints and

(b) legislation relating to the admissibility of bad character in criminal proceedings, and

(c) obligations to the court and the CPS, ACPO have taken the view that the weeding policy was not consistent with the purposes for which the records of convictions were retained on the PNC. Although they are prepared to “step down” certain convictions rendering them “for Police eyes only”, the Police view became that no convictions should be deleted except in exceptional circumstances. They have further construed exceptional circumstances as being limited to such matters as convictions being established as wrongly obtained, i.e. very narrowly.

[3]In that context fresh guidelines have been produced which have not been endorsed by the IC. Prior to the complaints from the individuals, the subject of this appeal, there had been previous complaints in respect of which the IC sought to challenge the policy of ACPO. The IC issued enforcement notices which lead to an appeal and decision of the IT in 2005. On that occasion the IT ruled that an undertaking to “step down” was sufficient, but the IT’s view, and indeed the Police’s view, of what the result of stepping down would be, was inaccurate. It is unnecessary to go into the detail of that misunderstanding. I simply say that it seems that both the Police and the IT understood that the result of stepping down would be that in certain circumstances the CRB would not have access to “stepped down” convictions when preparing “standard disclosure certificates”(as opposed to “enhanced disclosure certificates”) under Part V of the Police Act 1997. It is now accepted that that is not accurate. Under Part V of the 1997 Act “stepped down” convictions are required to be revealed even on “standard disclosure certificates”, and thus although “stepping down” prevents disclosure in many circumstances to persons other than the police, it does not prevent disclosure by the police in many others including the circumstances under which disclosure was made of four of the convictions the subject of this appeal.

[4]Following the 2005 decision ACPO produced “Retention Guidelines for Nominal Records on the Police National Computer – incorporating the Step Down Model” - referred to as the 2006 guidelines. They have not received the endorsement of the IC. There have again been complaints from individuals as to the retention and then disclosure of old minor convictions. In the result in 2008 the IC issued five enforcement notices against five different Chief Constables, seeking to compel the deletion of the old minor convictions of the five individuals identified in the annex hereto. The five Chief Constables appealed to the IT under Section 48 of the Data Protection Act which resulted in a decision dated 21st July 2007, which ruled that the retention of the five convictions, even if they were stepped down, would infringe the principles of the Data Protection Act and thus that the convictions should be deleted.

[5]The five Chief Constables appealed that decision under section 49 on points of law to the Administrative Court where King J directed under CPR 52.14 that the matter should be considered by the Court of Appeal and under that provision the Master of the Rolls accepted the matter in the Court of Appeal.

[6]What the IT were concerned with in the main was whether two important principles under the Data Protection Act were being complied with; in short whether “excessive data” was being retained (DPP 3) and whether data was being “kept for longer than necessary” (DPP 5). In broad terms the reasoning of the IT was first that the purposes for which the data (the convictions ) were held were “core” police purposes, i.e. detection of crime, and second that the evidence given by the Police that these convictions had some value for those “core” police purposes, should be rejected. Mr David Jones, representing the five Chief Constables against whom the decision to delete has been made, has submitted before us as he did before the IT that to confine “purposes” to “core” police purposes finds no support from the provisions of the Data Protection Act and is to take too narrow a view. Thus, he submits, that insofar as it is a registered purpose to hold the information so that it can be supplied to others, e.g. a complete history of convictions to the courts and the CPS, there can be no question of the retention being held to be either excessive or being held for longer than necessary. In any event, he has submitted, it was wrong for the IT to take upon itself the role of deciding what was of value to the Police, even for “core” police purposes, unless the view of the Police could be shown to be perverse.

[7]Mr Pitt-Payne has sought to uphold the decision of the IT, arguing as he did before the IT that police purposes cannot include holding the information for others, and thus the question of compliance with the principles under the Data Protection Act should be tested by reference to “police purposes”, i.e. “their operational purposes”. He further submits that the role of the IC must be to bring an independent mind to bear on whether it is proportionate for the police to retain old minor convictions which have little if any value to police “operational purposes”.

[8]There are a number of issues that arise under the above stated broad points, and in order to obtain a proper understanding it is necessary to examine in some detail first the provisions of the Data Protection Act and the EC Directive from which it sprang; second the nature of old convictions and in particular the Rehabilitation of Offenders Act and the exceptions thereto; third the uses which the Police in fact make of the data stored on the PNC; fourth the purposes registered by the individual Chief Constables as the purposes for which the convictions are retained. I should then return to the questions whether the IT were correct in confining purposes in the way they did, and whether in any event they were right in their approach to the police evidence as to the value of old convictions, and finally deal shortly with Article 8. Directives 9. Article 1 Object of the Directive In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1. Article 2 Definitions For the purposes of this Directive:(a) ‘personal data’ shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(b) ‘processing of personal data’ (‘processing’) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (d) ‘controller’ shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law; (e) ‘processor’ shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller; 10. Article 6 1. Member States shall provide that personal data must be:(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; . . . (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. Article 7 Member States shall provide that personal data may be processed only if: . . .

(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or . . . (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1). Article 8 The processing of special categories of data . . . 5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. (my emphasis)

Directives

[9]Article 8(5) is important as recognising the importance of records of criminal convictions and recognising the safeguard of control by official authority. It is not disputed that the PNC is controlled by official authority.

The Data Protection Act

[10]Section 1 deals with the “Basic interpretative provisions” such as what data means, what is personal data, who data subjects are etc, and it is not in issue that what is stored on the PNC is personal data, and that the five persons who complained are “data subjects”. Indeed it is not in issue that convictions are “sensitive personal data” as provided for by section 2 (g) and (h).

[11]The definition of “data controller” in section 1 is important – data controller means (subject to subsection (4) not relevant for present purposes) “a person who (either alone or jointly or in common with other persons) determines the purpose for which and the manner in which any personal data are, or are to be, processed”.

[12]The Act has a number of fairly complex provisions but for our purposes it suffices to say that it is clear from all its terms as confirmed by the above definition that it is the data controller who determines the purpose for which data is processed. The Act is concerned to ensure that the purposes as determined by the data controller are registered so that any person can know the purposes for which data is being processed.

[13]Section 16 identifies “the registrable particulars in relation to a data controller” and provides that they mean:-(a) his name and address,

(b) if he has nominated a representative for the purposes of this Act, the name and address of the representative,

(c) a description of the personal data being or to be processed by or on behalf of the data controller and of the category or categories of data subject to which they relate,

(d) a description of the purpose or purposes for which the data are being or are to be processed,

(e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data, . . .”

[14]Section 18 imposes on the data controller the duty to notify the IC of the registrable particulars; section 19 imposes on the IC an obligation to maintain a register containing the registrable particulars; and section 20 imposes a duty to notify changes to ensure “so far as practicable that at any time:- “(a) the entries in the register maintained under section 19 contain current names and addresses and describe the current practice or intentions of the data controller with respect to the processing of personal data, . .”.

[15]The Act is then importantly concerned that data should be processed in accordance with the data protection principles contained and to be interpreted in accordance with schedules to the Act. Section 4 thus provides:- “(1) References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1. (2) Those principles are to be interpreted in accordance with Part II of Schedule 1. (3) Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply. (4) Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.”

[16]The DPP in Schedule 1 are:- “1Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. 2Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4Personal data shall be accurate and, where necessary, kept up to date. 5Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. 6Personal data shall be processed in accordance with the rights of data subjects under this Act. 7Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. 8Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

[17]The appeals relating to all five convictions are concerned with DPP3 and DPP5. There is a discrete issue in relation to the conviction of SP which involves consideration of DPP1, which I shall deal with at the end.

[18]Section 40 deals with enforcement:- “Enforcement notices(1) If the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve him with a notice (in this Act referred to as “an enforcement notice”) requiring him, for complying with the principle or principles in question, to do either or both of the following— (a) to take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified, or (b) to refrain from processing any personal data, or any personal data of a description specified in the notice, or to refrain from processing them for a purpose so specified or in a manner so specified, after such time as may be so specified.

(2) In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress. . . . (6) An enforcement notice must contain— (a) a statement of the data protection principle or principles which the Commissioner is satisfied have been or are being contravened and his reasons for reaching that conclusion, and (b) particulars of the rights of appeal conferred by section 48. (7) Subject to subsection (8), an enforcement notice must not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal. Rights of appeal are provided for under Section 48 and thereafter on points of law to the courts under Section 49. . . .

[19]Other provisions which are relevant are Section 7, which gives the “data subject” a right of access to personal data on a request in writing. The details of the section do not matter. Under this section a data subject is entitled to a description of the personal data, the purposes for which they are being processed, and the recipients to whom the data are or may be disclosed. The relevance to the issues on this appeal of this section is that in the case of one of the five data subjects, GMP, the retention came to light when GMP made a subject access request for her own records. That request was made in order to support an application for passport, residency and citizenship to the State of Lucia. It is right also to mention that because section 56 (which prohibits such conduct) has not been brought into force, certain employers as a condition of recruitment or of continued employment, do require a data subject to obtain and supply to them data to which the employer would not be entitled if they applied directly.

[20]Section 13 gives a right to damages and provides as follows:- “13Compensation for failure to comply with certain requirements(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if— (a) the individual also suffers damage by reason of the contravention, or (b) the contravention relates to the processing of personal data for the special purposes.

(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”

[21]Section 29 relates to “Crime and taxation” and by subsection 1 provides:- “(1) Personal data processed for any of the following purposes—(a) the prevention or detection of crime,

(b) the apprehension or prosecution of offenders, or

(c) the assessment or collection of any tax or duty or of any imposition of a similar nature, are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.”

[22]This sub-section emphasises the special position of data retained for the purpose of preventing crime. This sub-section will need a mention in relation to the discrete point raised by SP on fairness under DPP 1.

What is the PNC?

[23]The statutory authority for the PNC is provided by Section 27(4) of the Police and Criminal Evidence Act 1984 and the type of information that may be recorded is governed by regulations made under that section. Paragraph 18 of the decision of the Tribunal quotes the relevant provisions. As the Tribunal noted the language is not mandatory but is permissive but what may be recorded and is recorded are “convictions for, and cautions, reprimands and warnings given in respect of any offence punishable with imprisonment and any offence specified in the Schedule to these regulations”. The Tribunal points out that certain offences are not punishable with imprisonment and not specified in the schedule and thus, even if all recordable offences were recorded, the PNC would not be a complete record of all criminal convictions. That is no doubt true, but I am doubtful about its relevance.

The Rehabilitation of Offenders Act 1974 (the 1974 Act)

[24]Before turning to the uses made by the Police of the data retained it is convenient to refer to the position under the 1974 Act. The Act defines “rehabilitated persons and spent convictions”, its intention being to rehabilitate offenders who have not been reconvicted of any serious offence for periods of years and to penalise the unauthorised disclosure of those previous convictions. Section 4 is in broad terms and provides as follows:- “4 Effect of rehabilitation(1) Subject to sections 7 and 8 below, a person who has become a rehabilitated person for the purposes of this Act in respect of a conviction shall be treated for all purposes in law as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of that conviction; and, notwithstanding the provisions of any other enactment or rule of law to the contrary, but subject as aforesaid— (a) no evidence shall be admissible in any proceedings before a judicial authority exercising its jurisdiction or functions in Great Britain to prove that any such person has committed or been charged with or prosecuted for or convicted of or sentenced for any offence which was the subject of a spent conviction; and (b) a person shall not, in any such proceedings, be asked, and, if asked, shall not be required to answer, any question relating to his past which cannot be answered without acknowledging or referring to a spent conviction or spent convictions or any circumstances ancillary thereto.

(2) Subject to the provisions of any order made under subsection (4) below, where a question seeking information with respect to a person’s previous convictions, offences, conduct or circumstances is put to him or to any other person otherwise than in proceedings before a judicial authority— (a) the question shall be treated as not relating to spent convictions or to any circumstances ancillary to spent convictions, and the answer thereto may be framed accordingly; and (b) the person questioned shall not be subjected to any liability or otherwise prejudiced in law by reason of any failure to acknowledge or disclose a spent conviction or any circumstances ancillary to a spent conviction in his answer to the question.

(3) Subject to the provisions of any order made under subsection (4) below,— (a) any obligation imposed on any person by any rule of law or by the provisions of any agreement or arrangement to disclose any matters to any other person shall not extend to requiring him to disclose a spent conviction or any circumstances ancillary to a spent conviction (whether the conviction is his own or another’s); and (b) a conviction which has become spent or any circumstances ancillary thereto, or any failure to disclose a spent conviction or any such circumstances, shall not be a proper ground for dismissing or excluding a person from any office, profession, occupation or employment, or for prejudicing him in any way in any occupation or employment.

(4) The Secretary of State may by order— (a) make such provision as seems to him appropriate for excluding or modifying the application of either or both of paragraphs (a) and (b) of subsection (2) above in relation to questions put in such circumstances as may be specified in the order; (b) provide for such exceptions from the provisions of subsection (3) above as seem to him appropriate, in such cases or classes of case, and in relation to convictions of such a description, as may be specified in the order.”

[25]The breadth of section 4 is cut down by the Act itself by section 7 and in particular so far as the present proceedings are concerned 7(2) (as amended from time to time as shown by parentheses), which provides that:- “Nothing in section 4(1) above shall affect the determination of any issue or prevent the admission or requirement of any evidence relating to a person’s previous convictions or to circumstances ancillary thereto -(a) in any criminal proceedings before a court in Great Britain (including any appeal or reference in a criminal matter);

(b) in any service disciplinary proceedings or in any proceedings on appeal from any service disciplinary proceedings; [bb] in any proceedings under Part 2 of the Sexual Offences Act 2003, or on appeal from any such proceedings;] [(c) in any proceedings relating to adoption, the marriage of any minor, [or the formation of a civil partnership by any minor,] the exercise of the inherent jurisdiction of the High Court with respect to minors or the provision by any person of accommodation, care or schooling for minors; (cc) in any proceedings brought under the Children Act 1989;] [(d)in any proceedings relating to the variation or discharge of a supervision order under [the Powers of Criminal Courts (Sentencing) Act 2000], or on appeal from any such proceedings;] [(d) in any proceedings relating to the variation or discharge of a youth rehabilitation order under Part 1 of the Criminal Justice and Immigration Act 2008, or on appeal from any such proceedings;] (e) . . . (f) in any proceedings in which he is a party or a witness, provided that, on the occasion when the issue or the admission or requirement of the evidence falls to be determined, he consents to the determination of the issue or, as the case may be, the admission or requirement of the evidence notwithstanding the provisions of section 4(1).”

[26]The above exception directly affects the recording of convictions in that in a criminal case it is the duty of the prosecution to disclose the convictions however old of a witness. Furthermore it is the duty of the CPS to provide to any court responsible for sentencing the full record of the person appearing, however old and however minor the convictions, and it is the police who provide the same from the PNC.

[27]Second under section 4(4) the Secretary of State has made “The Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975” (the Exceptions Order). The Exceptions Order provides for many exceptions. Section 3 commences with the words “none of the provisions of section 4(2) of the Act shall apply in relation to”; there then follow a great number of subsections referring to a great number of schedules. As an example (a)(i) and (ii) relate to any question asked by or on behalf of any person in the course of the duties of his office or employment in order to assess the suitability(i) of the person to whom the question relates for admission to any of the professions specified in Part 1 of Schedule 1 to this Order, and eighteen different professions are set out in the Schedule; and

(ii) of the person to whom the question relates for any office or employment specified in Part II of the said Schedule 1, or for any other work specified in [paragraphs 13, 14, 20, 21, 35, 36, 37, 40 or 43 of Part II] of the said schedule 1, (Part II containing some 43 paragraphs). Thus the exceptions are numerous and indeed it was because of the exceptions that the convictions in four of the five cases with which this appeal is concerned were disclosed, i.e. those of HP, SP, WMP under enhanced disclosure certificates and NP under a standard disclosure certificate.

What use do the Police in fact make of the data retained on the PNC?

[28]The evidence before the IT covered many different uses and I shall attempt a summary:-a. Police operational use. There was before the Tribunal evidence from various officers as to the value of convictions however old and however minor to police operational activities. I refer for example to the statements of

(a) Detective Superintendent Gary Linton of the Hampshire Constabulary who dealt with old convictions generally and explained why the particular five convictions might be of value;

(b) Superintendent Lay of the Greater Manchester Police whose final paragraph reads:- “24. My concern is the potential for apparently minor or insignificant offences not being shown on the PNC. Over a period of time these may develop into an indication as to the level of behaviour which would give grounds for concern or when linked with information from other agencies. Equally, a single offence committed some years ago may well be significant dependent upon given circumstances such as access to children or when linked with information sharing with other agencies.” And

(c) Detective Sergeant Watson of the Humberside Police whose final paragraphs read:- “42. I have reviewed the five PNC records which are subject of this tribunal. These convictions must be retained and available for future reference. 43. The benefits of old convictions are not easily quantified. In a historical rape or child abuse case sometimes the only evidence placing an offender in a certain geographical area is their previous convictions. The nature of this conviction is immaterial. Shoplifting of a chocolate bar or murder makes little difference when attempting to prove an offender was in a certain area at a certain time, it is the actual conviction itself that assists. 44. With the advances of DNA evidence ‘cold case’ examination such as in the case of Snowden show the need for details of previous convictions from many years before to be available.” The evidence is very much, I accept, that the information might be of value in certain circumstances and of value when taken together with other information. Detective Superintendent Linton also emphasised another point in his evidence, which is that the police wish to operate the system fairly and thus if the five convictions were removed many others would also have to be and that would increase the risk of information not being available when it might have been useful.

b. Employment vetting and disclosure to the CRB. The effect of Part V Sections 113 to 114 of the Police Act 1997 is that standard and enhanced certificates have to be provided by the Home Office, who obtain the information through the CRB from the police – pursuant to Section 119. The CRB is an executive agency of the Home Office, which in practice carries out the Secretary of State’s functions under Part V. The certificates will contain details of spent convictions if and insofar as the employer requesting the same falls within the exceptions to the 1974 Act. This provides an important protection to employers who may ask a would-be employee or indeed an employee whether they have ever been convicted of dishonesty, where that employee is not protected by section 4 of the 1974 Act from revealing spent convictions. While the CRB can obtain the information from the PNC, the employee cannot conceal the fact from the employer. Indeed it might be important to an employer to know that the employee had attempted to do so by lying. A recruit to the police force is one of the categories of persons to which section 4 does not apply and in their own interests the police wish to have the information relating to any potential recruit to the police service. I should also mention that it is intended that the Independent Safeguarding Agency (ISA), created by the Safeguarding Vulnerable Groups Act 2006, will be likely to make use of the information when it comes into operation, as explained in paragraphs 49 to 64 of the IT judgment. Some emphasis is placed by Mr Pitt-Payne that no statutory obligation is placed on the police to retain data under the Police Act 1997, but on any view Part V of the Act seems to recognise that the data will be there to be provided.

c. Disclosure to the CPS and the courts. As already indicated a full record of a person’s convictions is required to be supplied to the CPS for the purpose of disclosure if that person is a witness, and to the court for the purpose of sentencing. The PNC is the place where that information is stored comprehensively and the police wish to be able to continue to disclose the data to the CPS and the courts. As the Tribunal correctly record there is no statutory obligation to store the information for that purpose, but there is certainly an assumption that the information will be available; thus The Consolidated Practice Direction referring to “Spent Convictions” states at 1.6.5:- “After a verdict of guilty the court must be provided with a statement of the defendant’s record for the purposes of sentence. The record supplied should contain all previous convictions, but those which are spent should, so far as is practicable, be marked as such.”

d. Multi-agency work. The police wish to co-operate with other agencies such as the probation service, social services departments, health authorities and other agencies.

[29]Before the Tribunal and before us Mr Pitt-Payne submitted that only (a) was “core” police purposes. He accepted the police used the data for the other “purposes” but he submitted that did not turn those purposes, which he submitted were actually the purposes of the persons to whom the information was supplied, into police purposes. He submitted that the police could only justify retaining data by reference to their core purposes.

[30]Then directing his attention to purpose (a) he, as he had done before the Tribunal, relied on statistical evidence by reference to which he sought to establish that the old minor convictions with which the case was concerned were of little “value” to the police. This reference to “value” was to value as evidence as to the likelihood of a person with a spent conviction being likely to commit a further offence compared with that of a person without any convictions at all. I will return to this aspect below.

Meaning of purposes

[31]In my view Mr Pitt-Payne misconstrues the Data Protection Act insofar as he suggests that if the police register particulars then the only purpose for which data can be retained are “core” or operational police purposes. As already indicated, the data controller must specify the purpose for which data is retained. There is no statutory constraint on any individual or company as to the purposes for which he or it is entitled to retain data. I would accept that the purposes must be lawful in order to comply with DPP 1 but, that apart, a data controller can process data for any purpose. What the data controller must do, however, is identify the purpose or purposes in the public register so that people know what the data is being retained for and so that the IC and data subjects can test the principles under the Data Protection Act by reference to the purposes identified.

[32]It is thus important in this case to identify what purposes were registered. It is important that the full details of the particulars are looked at including the persons to whom the data would be disclosed in order to identify the purposes registered by the data controllers.

[33]The Data Controllers in this case were each Chief Constable. They each registered particulars but the particulars in each case were almost in identical terms and it is thus sufficient to take one set as an example. I should preface the next section with the advice from the Notification Guide book produced by the Information Commissioner’s Office which says this:- “Notification is the process by which a data controller informs the Information Commissioner of certain details about their processing of personal information. These details are used by the Information Commissioner to make an entry describing the processing in the register of data controllers that is available to the public for inspection. The principal purpose of having notification and the public register is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is carrying out the processing of personal information as well as other details about the processing (such as for what reason it is being carried out). Notification, therefore, serves the interests of individuals in assisting them to understand how personal information is being processed by data controllers. It is not, however, intended (nor is it practicable) that the register should contain very detailed information about a data controller’s processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing. More detail is only necessary to satisfy specific statutory requirements or where there is particular sensitivity.”

The purposes as registered

[34]The registration document starts by saying “This register entry describes, in general terms, the personal data being processed by: Chief Constable of Northumbria Police. It contains personal data held for 3 purposes detailed in the following pages:” There then are three headings under which details are given: 1 Staff Administration; 2 Policing; and 3 Data Controller’s free text Description of purpose. Under Policing the headings are “Purpose description: Data controller’s further description of purpose: Data subjects: Data Classes: recipients (1998 Act)”. Under “Purpose description” there is a list including “The prevention and detection of crime; apprehension and prosecution of offenders; protection of life and property; maintenance of law and order; also rendering assistance to the public in accordance with Force policies and procedures”. Under the “further description” there are repeated some of the above but added are “vetting and licensing”. Under recipients appear the following:

“Current, past or prospective employers of the Data subject . . . police forces . . . central government . . . local government . . . law enforcement agencies . . . regulatory bodies prosecuting authorities . . . defence solicitors . . . courts . . . approved organisations and people working with the police . . .etc.”

[35]If one looks at the above, it seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. “Rendering assistance to the public in accordance with force policies” clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include “Employers” “the courts” and “law enforcement agencies”.

[36]If one then poses the question whether the Data being retained is excessive or being retained for longer than necessary for the above purposes there is, it seems to me, only one answer, since for all the above a complete record of convictions spent and otherwise is required. That seems to me to be a complete answer to the appeal. Indeed it was a submission to this effect by Mr Jones in opening the appeal before the Tribunal which forced Mr Pitt-Payne to argue that purposes must be confined to Police “core” purposes. It was that submission which got the Tribunal off on the wrong foot.

[37]If one examines the reasoning of the Tribunal one sees that it is the submission of Mr Pitt-Payne, which they accept in paragraph 91, which leads them to say:- “91 . . .Therefore we find that we agree with the Commissioner that we must concentrate on the obvious or core police purposes which are easily understood. We would comment that one of the principal reasons behind the registration process is so that it is transparent and clear as to what purposes are being pursued by a data controller in order for it to be seen that there is compliance with the DPPs.92. It is clear from the evidence before the Tribunal, particularly that given by Mike McMullen, that a considerable number of other bodies use information held on the PNC for various purposes, although they do not necessarily have direct access. The 2006 Guidelines recognise this: hence the provision for certain convictions to be stepped down, and thereby protected from access by non-police users.

93. The Commissioner contends that the fact that such organisations are permitted to access the PNC and that the Chief Constables may work in partnership with other organisations does not mean that the purposes for which it does so are to be treated as policing purposes. This does not mean that all of the purposes pursued by the partner organisation should be treated as being police purposes. . . . 96. We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police’s core purposes. During the course of holding such data the police are under statutory obligations to allow access to or disclosure of such data to other bodies for their purposes. However we do not consider that Chief Constables are required under their statutory obligations to hold data they no longer require for core purposes. They are only required to provide data that they do hold at the time of the request for access. We heard evidence that Chief Constables in accordance with good management practice and/or other statutory requirements, like their data protection obligations, as envisaged by the 2005 Code and the criteria used in MOPI, delete conviction data or other intelligence from time to time, then in the Tribunal’s view there is no counter or overriding obligation on them not to delete that data.”

[38]There is then an odd paragraph 100 in which the Tribunal appear to say that even if they were wrong with that approach when examining the other purposes for which the police process the data, the Tribunal’s conclusion would be the same. But when they deal with the other purposes, e.g. paragraphs 101 to 104 – the CPS and the courts, 105-106 Multi-agency and 107 to 109 Employment Vetting, they do so (accepting submissions on behalf of the IC) adopting the same wrong approach.

What if the principles must be judged by a narrower approach to police purposes?

[39]If a narrower approach were justified, my conclusion would still be that the Tribunal went wrong in this case. The Tribunal analysed the statistical evidence placed before them to consider the value of the retained data. As the tribunal put it in paragraph 129 “If there comes a point where the difference in the risk of future offending behaviour as between ex-offenders and non-offenders is of no practical significance, then the [IC] argues any justification for retaining the information in order to assess the risk of future offending behaviour is destroyed”.

[40]The Tribunal then examined the circumstances of each of the five convictions and applied the statistical evidence to the circumstances of those cases. In relation to HP having done that, the Tribunal recorded the submissions of the IC in these terms:- “135. The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that is it extremely unlikely either:(i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or

(ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5.” and then also said in paragraph 136:- “136. The general considerations in paragraphs 134 and 135 are also applicable to the analysis of the other data subjects.”

[41]Having applied the statistical analysis to each of the other five convictions the Tribunal said at paragraph 147 that the analysis was “helpful” and that “It clearly tends to the view, applying the necessity and proportionality tests referred to in paragraph 121 above, that retention of this information is an infringement of DPP 3 and DPP5”.

[42]In my judgment the approach of the Tribunal was wrong. The IC, when giving evidence to Bichard Inquiry, was recorded by Sir Michael Bichard as saying this about the approach to the Data retained by the Police:- “4.45. Data protection concerns are relevant but should not dominate the Code or any supporting manual. That said, some important messages for those drafting the Code emerged from the Information Commissioner’s evidence. He clearly and helpfully said that:4.45.1 The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner’s role is a reviewing or supervisory one.

4.45.2 Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office ‘cannot and should not substitute [their] judgement for that of experienced practitioners’. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, ‘that should be the end of the story’.

4.45.3 There is, at present, considerable latitude extending both to decisions about how long to retain records and about when to disclose information (under the Enhanced Disclosure regime, for example, in the employment-vetting context).

4.45.4 It could be presumed to be reasonable if, after discussions with the Information Commission, certain categories of information were retained for specified periods, while still allowing the right of challenge in individual cases.

4.45.5 In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify.” 4.45.1 The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner’s role is a reviewing or supervisory one. 4.45.2 Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office ‘cannot and should not substitute [their] judgement for that of experienced practitioners’. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, ‘that should be the end of the story’. 4.45.3 There is, at present, considerable latitude extending both to decisions about how long to retain records and about when to disclose information (under the Enhanced Disclosure regime, for example, in the employment-vetting context). 4.45.4 It could be presumed to be reasonable if, after discussions with the Information Commission, certain categories of information were retained for specified periods, while still allowing the right of challenge in individual cases. 4.45.5 In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify.”

[43]It seems to me that the approach described is the correct approach. If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter. The examination of statistics relevant only to the question as to the risk of reoffending was not to the point. Furthermore the fact that the statistics actually showed that the risk was greater than with non-offenders is not something I would pray in aid. It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police.

[44]I emphasise the word “retention” because if there is any basis for complaint by the data subjects in this case, it seems to me to relate to the fact that in certain circumstances this information will be disclosed, but that is because Parliament has made exceptions to the Rehabilitation of Offenders Act. What is more, the circumstances in which there will be disclosure are circumstances in which the Data Subject would be bound to give the correct answer if he or she were asked. It is not as it seems to me the purpose of the 1998 Act to overrule the will of Parliament by a side wind.

[45]I would thus allow the appeal and quash the enforcement notices on the points with which I have dealt so far.

[46]There however arises a separate point relating to SP. She alleges that as a result of the assurance she received in 2001 (that the reprimand would be removed from her record when she was 18 if she did not get into anymore trouble) the retention of the reprimand on the PNC after her 18th birthday was unfair under DPP 1.

[47]The Tribunal did not find that she was misled into agreeing to a reprimand in reliance on the assurance. But they were not convinced of the importance in the public interest of being able to retain this conviction for all the reasons they had already given and with which I have dealt above. They made their finding in these terms:- “165. The basis of the Appellants’ argument is that the 2006 Guidelines should be followed despite the representation made to SP because of the benefits the conviction data will provide to the wider public. As will be appreciated from our findings so far we are not convinced that will be so in SP’s case and certainly the 2006 Guidelines do not in our view provide that proportionate approach which leads us to accept the Appellant’s argument. 166. Janet Turner for Staffordshire Police in evidence was very unclear as to whether the question of fairness to SP had been considered when reaching the decision to retain the information. This leads us to the view that the personal data was processed unfairly.”

[48]Mr Jones argued before the IT that Section 29(1) applied so as to disapply DPP1 altogether. Before us he was inclined to submit that the questions whether there was likely to be prejudice to(a) the prevention or detection of crime or

(b) the apprehension or prosecution of offenders was very much intertwined with the question as to whether it was ‘fair’ under DPP 1 to continue to retain SP’s reprimand in the context of the fact that many others will be in SP’s position. The point being that SP will not be alone in having been informed of what was then the policy of weeding. To thus treat all equally would require the police to accept that they should delete all convictions in which the data subject has been told of the original policy when the reprimand or caution has been administered. It seems to me that if it is fair to retain convictions under the new policy it does not become unfair to do so simply because the data subject was told of what the policy then was when being convicted or reprimanded. Furthermore, the deletion of this reprimand leading (as it would have to) to deletion of many others would be likely to prejudice the prevention and detection of crime and the apprehension or prosecution of offenders. The court and the CPS need the full information, never mind the fact the police are of the view that for their operational purposes they need the same. It is in this context that I draw attention to article 8(5) of the Directive (see paragraph 9 above) which recognises, in my view, that “a complete register of criminal records may be kept” albeit only “under the control of official authority”.

[49]Does it make any difference that, as the Tribunal found, Janet Turner did not consider the question of fairness to SP? In my view it does not because Janet Turner was applying the policy by then in force, which would have required there to be exceptional circumstances if the conviction was to be deleted. It might have been different if a request had been made while the former guidance was in place, as was the situation in relation to the Greater Manchester Police when they did delete a conviction as noted in paragraph 153 of the Tribunal’s judgment.

Article 8

[50]A further argument was addressed to the IT on Article 8 independently from the arguments on construction under the Data Protection Act. I am not persuaded that Article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure. Even if that were wrong, if my conclusions so far are right, the processing is in accordance with the law and necessary in a democratic society. I do not think any extra point arises by reference to Article 8 on its own and I mean no disrespect in dealing with this aspect so shortly.

[51]I would accordingly allow all five appeals and quash the enforcement notices. Lord Justice Carnwath : Overview

[52]I agree with Waller LJ on the resolution of the main issues under DPP3 and DPP5, but disagree respectfully on the application of DPP1 to the case of SP. I have not found the route to this conclusion entirely straightforward. I prefer therefore to set out my own reasoning, while adopting Waller LJ’s exposition of the relevant factual and legal background. The tribunal’s judgment is in many respects an impressively clear and comprehensive treatment of the voluminous material presented to them. However, I think that their task was made unnecessarily difficult by the way in which the cases were presented on both sides.

[53]At the heart of the debate before the tribunal was the application of the two principles relied on by the Commissioner in respect of all five cases DPP3:

“Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.”

DPP5:

“Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.”

Crucial to both principles was the identification of the “purposes” by reference to which the criteria were to be applied.

[54]In simple terms, as I understand it, the underlying purpose of the PNC is the maintenance of a complete record of convictions, subject to certain defined limitations, for the assistance both of the Police itself and of other agencies which legitimately require that information. I agree with Waller LJ that the Commissioner’s reliance on the concept of “core purposes” was misconceived and led to the tribunal “getting off on the wrong foot”. As a result, their treatment of the main issues was materially flawed. I shall return to this aspect below. However, part of the problem was the failure of the Police themselves to articulate clearly or consistently their own view of the relevant purpose or purposes. There was little congruence between the purposes relied on by the Police before the tribunal and the terms of the “specified” purposes in their registered particulars; and neither spelt out in unequivocal terms what I have taken to be the underlying purpose of the PNC. The tribunal was also faced with a surprising mass of oral and written evidence, from a total of 24 witnesses, which must have made it very difficult for anyone to see the wood for the trees.

[55]I found the most helpful analysis in the written submissions by Mr Swift and Miss Ivimy on behalf of the Home Secretary. They start from the proposition that the PNC is “the most complete and accessible database of conviction records”, and that the sharing of such information by the Police with other public bodies is “in principle wholly lawful and in the public interest”. They cite Sir Michael Bichard’s recommendation that there should be more investment by the Government to ensure the PNC’s future - “… given its importance to intelligence-led policing and to the criminal justice system as a whole”.

[56]Of the tribunal’s emphasis on the “core purposes” they say:

“This approach is misconceived and wrong in principle. There is nothing in the scheme of the DPA, nor the EC Directive it implements, to support the proposition that only the ‘core’ purposes of a data controller should be taken into account in assessing whether a given act of processing infringes DPP3 and DPP5. Moreover, the DPA contains no framework by which the Commissioner or the Tribunal could properly assess what is a ‘core’ and what is not a ‘core’ purpose of a given data controller. Fundamentally, it is not for the Commissioner or the Tribunal to specify for what purposes in considers a public body, acting lawfully, should or should not process data.”

[57]They also emphasise the need under DPP3 and 5 to have regard to “the particular processing which is sought to be impugned”, in this case “the simple retention of the data on the PNC”. They criticise the tribunal for at times confusing its analysis - “… by reference to the question whether other processing (such as the disclosure of the data to third parties, such as the CRB, the Courts social services etc) infringes DPP3 and 5… But the question whether any given act of processing breaches DPP3 or DPP5 must be determined separately, having regard to the purposes and particular circumstances of that processing. Retention of data cannot in principle be held unlawful under DPP3 and 5 on the basis, for example, that it might give rise in future to disclosure contrary to those principles.”

[58]They conclude their submissions:

“It is in principle legitimate for the police to retain conviction data on the PNC not only for the ‘core’ purposes identified by the Tribunal, but for all their registered purposes. The Tribunal should have analysed the need for retention of the conviction data on the PNC on that basis. In practice, therefore, holding that information for the purpose of assisting other public bodies who share common public policy objectives to perform their functions is lawful under the DPA.”

[59]As will appear, I agree essentially with that analysis. In what follows I will explain why I would reject the “core purposes” approach, and then identify what I believe to be the relevant questions and provide my answers to them. Finally I shall deal with the particular issue arising under DPP1. “Core purposes”

[60]As recorded by the tribunal, the Commissioner defined the “core” police purposes as – “… the prevention and detection of crime, the investigation and apprehension of offenders, and the maintenance of law and order.” (decision para 90) It was these “core” police purposes which, it was said, had to be taken into account in applying DPP3 and DPP5. This approach was contrasted with the position of the Police and the Home Office - “The Appellants and Home Office take a different view and contend that all the notified purposes must be taken into account in applying DPP3 and DPP5. These purposes should be interpreted widely and require providing criminal intelligence to other bodies…” (para 91)

[61]At paragraph 94 the tribunal described the four other purposes which had been relied on by the Police as potentially relevant: “(1) providing assistance to the Crown Prosecution Service (CPS) (or any other prosecuting agency) in the prosecution of an offence, and the courts in the administration of justice; (2) assisting organisations such as social services departments and probation services in multi-agency work to protect the public, in particular young and vulnerable persons; (3) disclosure of information in the context of employment vetting to the CRB; and (4) public safety and protection of life and property, for example assisting members of the public in discovering the whereabouts of missing persons.” (I will refer to these in this judgment as “the additional purposes”.)

[62]The tribunal did not accept that these additional purposes could be taken into account. They said:

“95. The Appellants maintain that they process information about the criminal records of individuals for each of these four purposes, and that each of these purposes should be taken into account in the present case in relation to both DPP3 and DPP5. “96. We consider the correct approach is that the police process data for what the Commissioner describes as their core purposes. In data protection terms this processing requires holding criminal intelligence on the PNC for so long as it is necessary for the police’s core purposes… 97. This reflects the position, in our view, that Chief Constables cannot be expected to incorporate other bodies’ purposes as part of their own even though there may be some common objectives, like the prevention of crime.”

(emphasis added)

[63]This distinction between the core purposes of the Police themselves, and their function of assisting “other bodies’ purposes” is central to the tribunal’s discussion of the various categories. Thus, for example, of the argument that providing conviction data by way of disclosure certificate to the CRB was “for the prevention of crime”, they commented: “This is rather remote from the police’s main activities in relation to this purpose, but even if encompassed in the purpose it is difficult to accept that the police would then be required to provide more data to such a body than is required for their core needs…” (para 91)

[64]Similarly in relation to the provision of information to the CPS or the Courts, they say - “The Commissioner accepts that where the police hold conviction information for their own purposes then it is proper for them to provide that information for use by the CPS or the Courts; but it does not follow, the Commissioner argues, that information that no longer has a policing purpose can properly be retained by the police, solely to ensure that a fuller record of conviction information is available for use by the CPS or by the Courts… The Commissioner maintained that if the police forces are to be required to retain information that is no longer needed for their own purposes - because the CPS or the Court Service need it, or may need it, then there needs to be specific legal provision for this with proper safeguards as to who may use that information and for what purposes. We agree with the Commissioner’s contentions.” (para 102-4)

[65]They accepted that this approach might have “unfortunate consequences” for other bodies which require such information, but the solution lay with the legislature: “It seems to us that the PNC has evolved over the years and it is now regarded as the main source of criminal intelligence for a variety of organisations. However it has no proper statutory framework. It is not regarded as an entity in its own right with its own purposes serving a number of bodies and this is apparent from the fact that neither the PNC nor its various administrators, ACPO, NIS, NPIA, are registered as data controllers with the Commissioner. If the government wishes the PNC to have that role then it needs to legislate accordingly. This would provide the opportunity for Parliamentary debate as to how best to provide an appropriate and proper legislative framework so that there is a clear understanding of data ownership and obligations with proper safeguards.” (para 99)

[66]For the reasons given on behalf of the Home Secretary, I regard that approach as unsupported by the legislation. I can see no reason why the purposes for which the Police retain information should not extend to the provision of information to assist other bodies with similar aims. As long as it is lawful (which is not in dispute), I see no reason why it needs to be authorised by specific legislation. The Data Protection Act already provides an appropriate framework, in accordance with the Directive, for regulating data ownership and providing proper safeguards.

Three questions

[67]I prefer to approach the issues by asking three questions (even though I may be departing from the way in which the case was developed in oral argument before us): i) Was the maintenance of the Police National Computer for (inter alia) the purposes relied on by the Police in principle permissible under the European and domestic legislation? ii) If so, were those purposes within the scope of their specified purposes? iii) If so, was the retention of the data in the five cases justifiable by reference to those purposes in accordance in particular with principles DDP 3 and 5?

[68]The answer to the first depends on the terms of the applicable legislation, in particular the “DP Directive” (95/46/EC), the Data Protection Act 1998, and the Human Rights Act 1998. The answer to the second turns on the terms of the registration. Neither requires the identification of “core purposes”. The answer to the third question raises issues as to the correct approach to evaluation of the evidence. Although only the last question is raised directly by the Commissioner’s notice, it can only be properly addressed in the context of the answers to the other two. I will take them in turn.

(i) Permissible purposes

[69]There is little doubt, in my view, that the maintenance of the PNC for both the “core” police purposes and the four additional purposes was in principle permissible under the applicable legislation.

[70]The DP Directive provides the essential background to interpretation of the domestic law. The Preamble identifies as one category of lawful processing “the performance of a task carried out in the public interest or in the exercise of official authority” (recital (30)). In relation to such lawful categories, the main thrust of the Directive is not to restrict the purposes for which data may be processed, but to ensure that the purposes are “explicit and legitimate” and that processing are limited to what is required for or compatible with those purposes. Thus recital (28) of the preamble reads:

“(28) Whereas any processing of personal data must be lawful and fair to the individuals concerned; whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; whereas such purposes must be explicit and legitimate and must be determined at the time of collection of the data; whereas the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified.”

(emphasis added)

[71]As would be expected, that approach is reflected in the Data Protection Act 1998. Waller LJ has set out the relevant provisions. As he says, it is the data controller who determines the purposes for which data are to be processed, provided that they are lawful, and subject to the “principles” set out in schedule 1. In the case of “sensitive” data such as data about convictions (see s 2), those conditions require compliance with at least one of the conditions in Schedule 2 and one of the conditions in Schedule 3. I note that under schedule 2 it is enough that the processing is - “necessary… for the exercise of any other functions of a public nature exercised in the public interest by any person” (condition 5(d)) and under schedule 3 that it is - “necessary for the exercise of any functions conferred on any person by or under an enactment” (condition 7(1)(b)) No issue arises before us in respect of compliance with either of those schedules.

[72]I agree also with Waller LJ that Article 8(5) of the Directive is important. It recognises that the purpose of maintaining a “complete register of criminal convictions” is in principle compatible with the Directive, provided it is “under the control of official authority”, and there are “suitable specific safeguards… provided under national law”. The power to maintain a “complete register”, to my mind, logically encompasses power to maintain records of all convictions, without regard, for example, to age or relative seriousness.

[73]The tribunal accepted the Commissioner’s case that the mere retention of conviction information had “a significant adverse effect” on the individuals concerned because it might suggest to them and others “(rightly or wrongly)” that they were still of interest to the police, and there was always the risk of disclosure by way of an enforced subject access request, or by “inadvertence” (para 148). However, as I read the Directive, it is envisaged that these issues will be dealt with by “suitable specific safeguards”; they are not recognised as objections in themselves to the maintenance of a “complete register”. There may of course be room for argument about the adequacy of the safeguards relating to use or disclosure under the domestic rules, but that is not a reason to disallow simple retention.

[74]The tribunal identified the statutory authority for the PNC as section 27(4) of the Police and Criminal Evidence Act 1984, which enables the Secretary of State by regulations to make provision for “recording in national police records convictions for such offences as are specified in the regulations”. Regulation 3 of the National Police Records (Recordable Offences) Regulations 2000 (SI 2000/1139) provides that there may be recorded in national police records convictions, cautions, reprimands and warnings relating to any offence punishable with imprisonment or specified in the schedule to the regulations.

[75]The tribunal rightly observed that the legal framework is “permissive, not mandatory”; that there is no statutory obligation to record convictions nor to retain conviction information for any particular period, or indefinitely; and that not all convictions are recordable, so that – “…even if all recordable offences were recorded and retained indefinitely, the PNC would not be a comprehensive record of all criminal convictions.” (para 19)

[76]All this is true. However, the facts that there is no statutory obligation to maintain a complete register, nor to retain material for any period, and that the register may not include records of all convictions, does not mean that maintenance of the register it is not a permissible purpose. It is enough for schedules 2 and 3 that the maintenance of the register is for a function exercised by the authority in the public interest and under powers conferred by an enactment. If it is permissible under the Directive to maintain a fully complete record, then I do not see why it is not permissible to maintain a record which is designed to be complete in relation to all offences of a defined degree of seriousness.

[77]I do not of course intend to detract from the importance of the policy objectives embodied in the Rehabilitation of Offenders Act 1974. But there are many (arguably, too many) exceptions to the principle of “spent” convictions under that Act. In any event, the scope and effect of the Act are matters of domestic legislation. They do not depend on the DP Directive, nor is there any reason to re-interpret the provisions of the Data Protection legislation by reference to them.

[78]Finally with regard to the Human Rights Convention, it is significant that the DP Directive is itself specifically linked to the need to respect “fundamental rights and freedoms, notably the right to privacy…”, and that it refers in that respect to the European Convention on Human Rights (Preamble (2), (10)). This suggests that the maintenance of such a complete register of convictions, as implicitly endorsed by Article 8(5) of the Directive, should not normally raise any separate issues under the Convention.

[79]There is considerable doubt in any event whether recording the mere fact of a conviction can ever engage

article 8 of the Convention

. Some guidance is found in the observations of Lord Hope in a recent case in respect of acquittals. As he said: “The fact that D was acquitted of the rape is not of itself private information the publication of which would be incompatible with his right to privacy. This has nothing to do with his private life. The trial was held in public, and the media were at liberty to publish D's name along with other details of the case other than the identity of the complainant….” (A-G’s Ref No 3 of 1999: Application by BBC

[2009] UKHL 34

[30]) He went on to explain that the BBC’s concern in the particular case was not confined to his acquittal, but related also to a DNA profile taken at the time of his arrest, which undoubtedly did engage Article 8. If one may apply the same reasoning in the present context, the bare fact of conviction should not be regarded as “private information” such as to engage article 8.

[80]The Commissioner relies on the ECHR case of S and Marper v UK as authority that retention of personal data can engage article 8. That is correct, but the nature of the information was quite different. The main issue related to the retention of fingerprints and DNA records of the unconvicted. The court’s “particular concern” was that persons who had not been convicted of any offence and who were accordingly entitled to the presumption of innocence were treated in the same way as convicted persons (see para 122). The case is no authority for the proposition that a record of the mere fact of conviction engages article 8.

[81]I find it unnecessary to reach a general conclusion on the relevance of article 8 to information about convictions. In the present context, in my view, it is enough to rely on the specific endorsement by the Directive of the concept of a complete register. That in my view makes it impossible to argue that the retention of information in such a register is in itself objectionable under the Convention.

Specified purposes

[82]The enforcement notices in this case asserted that principles DPP3 and 5 were being infringed in that – “(the data controller)… is continuing to process the Conviction Data relating to X and that such data are irrelevant, excessive and no longer required for policing purposes and are being kept for longer than is necessary for such purposes.” (emphasis added) “Policing purposes” were not further defined in the notice, but as will appear this expression seems to be derived from that used by the Police themselves in the registration.

[83]As has been seen principles DPP3 and 5 both depend on identifying “the purpose or purposes” for which the data are processed. The second Principle in schedule 1 is that personal data may only be processed for one or more “specified and lawful purposes”. By paragraph 5 of Part II of the same schedule, a purpose may be “specified” either by a notice to the data subject or “in a notification given to the Commissioner under Part III of this Act”. The latter, which applies in this case, takes one in turn to Part III headed “Notification by Data Controllers”, and containing the registration provisions. Section 16 defines the “registrable particulars” including - “(d) a description of the purpose or purposes for which the data are being or are to be processed. (e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data.” Waller LJ has referred to the Notification Guidebook, which explains that “It is not… intended (nor is it practicable) that the register should contain very detailed information about a data controller’s processing. The aim is to keep the content at a general level, with sufficient detail to give an overall picture of the processing… ” Accordingly, the obvious starting-point for considering the application of principles DPP3 and 5 would naturally be the identification of the specified purposes in the register. In this case that is not as easy as might be expected.

[84]At paragraph 43, the tribunal identified their understanding of the registered purposes “Under section 16 DPA, the five Appellants as data controllers registered their purpose as ‘policing’ and the purpose description as ‘The prevention and detection of crimes; apprehension and prosecution of offenders, protection of life and properties; maintenance of law and order; also rendering assistance to the public in accordance with force policies and procedures’ And the further description of purpose as ‘protection and detection of crime apprehension and prosecution of offenders maintenance of law and order, protection of life and property vetting and licensing public safety rendering assistance to members of the public in accordance with Force policy’” ‘The prevention and detection of crimes; apprehension and prosecution of offenders, protection of life and properties; maintenance of law and order; also rendering assistance to the public in accordance with force policies and procedures’ ‘protection and detection of crime apprehension and prosecution of offenders maintenance of law and order, protection of life and property vetting and licensing public safety rendering assistance to members of the public in accordance with Force policy’”

[85]At paragraph 91 the tribunal explained why they had difficulty in relating the specified purposes to the Police’s case as presented to them. Of the Police’s contention that the purposes should be interpreted widely as including “providing criminal intelligence to other bodies…”, they observed that the registered purposes included “no purpose expressed as such in these terms”. They noted also that they had been given “very little evidence to help us understand these purposes”. It was this difficulty which appears to have encouraged them (at the end of the same paragraph) to accept the Commissioner’s view that they should concentrate on the “obvious or core police purposes which are easily understood”.

[86]I share some of the tribunal’s difficulty in interpreting the registered particulars. As Waller LJ has explained, the registration document says that the entry contains personal data held for “3 purposes detailed in the following pages”. The three purposes are then defined in successive sections of the document. The first, “Staff Administration”, can be ignored in the present context. The second is headed “Policing”; under sub-headings “purpose description” and “data controller’s further description of purpose”, it contains the material quoted by the tribunal. In the same section there is a reference to “recipients”, including for example “current, past or prospective employers of the Data subject”, “central government (and) local government”, “law enforcement agencies”, and so on.

[87]The third section is headed “Data Controller’s free text Description of purpose”. The description starts “Administration and Ancillary Support for Policing Purposes, including…”; there follows a list of items such as “records of computing transactions”, “telephone log messages”, and so on. Whatever precisely is intended by the requirement for a “free text description” in the heading to this section, I do not think it can be relied on as adding anything material for present purposes. The section is confined to “administration and ancillary support” for “policing purposes”, which must be taken as referring back to the purposes previously defined in section 2. Accordingly it was right in my view for the tribunal to take the relevant description from that section.

[88]Waller LJ comments:

“If one looks at the above, it seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. “Rendering assistance to the public in accordance with force policies” clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include “Employers” “the courts” and “law enforcement agencies”.”

[89]I am not persuaded, with respect, that the picture is as clear as he suggests. What is in issue here is the rendering of assistance to other public agencies, not to the public in general. Arguably, the definition of the potential recipients can be relied on as filling out the description of the purpose, although they are treated separately in section 16 of the Act (see above). However, it is difficult to see why it should be necessary to rely on implication. As the preamble to the directive made clear, the intention is that the register should provide an “explicit” record of the purposes for which data are to be processed. It would have been easy for the specified purposes to be drafted in a way which made clear that they included the provision of information to other agencies.

[90]In any event, the inadequacy or obscurity of the specification did not in my view justify the tribunal’s approach. There was no issue that the Police were in fact using the information on the PNC to assist the various bodies identified in the four additional purposes. It would have been open to the Commissioner to allege a breach of DPP2, which precludes the processing of data in any manner “incompatible with” the specified purposes. No such case had been advanced. The tribunal had to proceed therefore on the basis that the additional purposes were at least compatible with the specified purposes.

[91]It is fair to observe also that there would have been little purpose in the Commissioner advancing such a case. If the only problem lay in the terms of the specification it could have been (and could still be) easily corrected. Such a contention by the Commissioner would not have thrown light on the issues of principle raised by the enforcement notice.

Justification

[92]Here again, it seems to me that the tribunal was not assisted by the way in which the case was presented on both sides. Waller LJ has quoted the comments of the Commissioner in evidence to the Bichard Inquiry on his approach to the Data retained by the Police. I note in particular the following:

“The police are the first judge of their operational needs and the primary decision makers; the Information Commissioner’s role is a reviewing or supervisory one.” “Police judgements about operational needs will not be lightly interfered with by the Information Commissioner. His office ‘cannot and should not substitute [their] judgement for that of experienced practitioners’. His office will give considerable latitude to the police in their decision making. If a reasonable and rational basis exists for a decision, ‘that should be the end of the story’.” “In terms of striking the balance between the various rights and interests involved, retaining information represents considerably less interference than using (that is, disclosing) that information, and is correspondingly easier to justify.”

[93]Like Waller LJ I would endorse the approach there stated, which conforms to that taken by the courts. Thus in R v Chief Constable of the North Wales Police ex parte Thorpe

[1999] QB 396

, which concerned disclosure by the Police of information about the presence of a couple who had been convicted of sex offences against children, Lord Woolf said at p 429:- "Both under the Convention and as a matter of English administrative law, the police are entitled to use information when they reasonably conclude this is what is required (after taking into account the interests of the applicants), in order to protect the public and in particular children…. where the use in question is decided upon as a result of the exercise of an honest judgment of professional police officers, that will of itself, go a long way to establish its reasonableness.” (emphasis added)

[94]That statement was relied on by Nicol J in W v Chief Constable of Northumbria

[2009] EWHC 747 (Admin)

, which concerned disclosure by the Police to an employer of information relating to an employee’s conviction for sexual offences: “The briefing document recognised that disclosure could lead to the Claimant losing his job. ACC Vant took this into account, but considered that disclosure was proportionate and that the public interest outweighed the Claimant's individual rights. In Thorpe Lord Woolf said that the exercise of an honest judgment of professional police officers would go a long way to satisfying the test of reasonableness for the purposes of English administrative law and the Convention. It may be that the Convention requires a rather more exacting standard of review than Wednesbury reasonableness. Nonetheless, the Courts will still acknowledge the expertise which the police have in assessing risk and their professional judgment is still entitled to be given due weight. For similar reasons, it was relevant that the Social Services department endorsed the proposal for disclosure.” (para 59)

[95]Those cases related to disclosure of information. As the extract from the Bichard report implies, the same principle applies a fortiori to retention. Consistently with that approach, I would have expected the Commissioner to have presented the case to the tribunal on the basis that his and their function was to “review” the Police’s judgment of what was required to fulfil the purposes of the PNC, not to substitute their own judgment. Had that approach been adopted, it is hard to see why it would have been necessary for as many as 19 witnesses to be called on behalf of the police, or for there to have been (as there was) detailed examination of complex statistical evidence about the risk of re-offending in different types of case.

[96]Perhaps understandably, given the way the case was presented, and having been taken through this voluminous evidence, the tribunal felt obliged to undertake the task of evaluating it and forming its own view. For example, having referred to the evidence of certain witnesses about their application of the 2006 guidelines, the tribunal commented: “None of these witnesses identified any features specific to the individual data subjects that justified the retention of their conviction information… Rather than relying on considerations that are specific to any of the individual data subjects, the Appellants appear to have relied on a general principle: conviction information, once recorded by the police, ought to be retained for life… In order to justify this principle the Appellants called a number of experienced police officers who gave evidence as to how past convictions had led to the apprehension of offenders. Although in no way wishing to substitute our judgment for that of experienced practitioners we would observe that it seemed to us that few if any of these examples seemed to relate to the sorts of offences committed by the data subjects in this case.” (para 122-3)

[97]Similarly, when dealing with each of the individual cases, the tribunal generally accepted the Commissioner’s evaluation of the utility of the information relating to that particular case. For example, in respect of HP, who had been convicted of shop-lifting in 1984 and fined £15, the tribunal summarised (and apparently accepts – para 147) the Commissioner’s case:

“The Commissioner contends that the retention of this information is excessive in relation to policing purposes, and the material has been kept for longer than necessary. Although it is possible to construct hypothetical circumstances in which the information might be of value for policing purposes, it cannot realistically be said to be necessary for those purposes. The Commissioner submits that the information is highly unlikely to assist an employer in any future employment decision in deciding whether HP is suitable to work with children or vulnerable adults; and that it is also highly unlikely to have any bearing on any of the risk assessment exercises discussed in the evidence in this case (e.g. under the MAPPA or SOPO processes, or in relation to child welfare assessments). Given the nature of the information the Commissioner concludes that it is extremely unlikely either: (i) that there would be proper grounds for disclosing it to the Court if HP were to be tried in future; or (ii) that it would be of any assistance to the Court in sentencing HP following any future trial. His overall assessment is that retention of this information is a breach of DPP3 and DPP5.”

[98]To my mind this shows the Commissioner doing precisely what he indicated to Bichard that he would not do, that is to substitute his own judgment for that of the Police. Furthermore it misses the point. The purpose of maintaining a complete record of convictions is not negated by showing in an individual case that one or more particular pieces of information is of no identifiable utility. To require a review at that level of particularity would impose a completely unrealistic burden on the controller of the record. Perhaps, if it could be shown that a category of information (defined perhaps by remoteness in time, or triviality) could never be of utility, there might be a case for a general requirement to exclude items within that category. But this is not the case being made by the Commissioner. In any event it would be difficult to reconcile such a requirement with the recognition in the Directive of the legitimacy of a “complete register”.

[99]I conclude that the approach of the Commissioner was fundamentally flawed, and that the tribunal was wrong to endorse it. It follows that, in agreement with Waller LJ, I would quash the enforcement notices in so far as they rely on DPP3 and 5.

DPP1

[100]As already indicated, I take a different view of the tribunal’s decision in respect of principle DPP1 that personal data must be “processed fairly”. This applies only to SP. In 2001, when she was reprimanded, she was given an assurance that the reprimand would be removed from her record when she was 18 if she did not get into any more trouble. The Commissioner alleged and the tribunal found that the retention of the reprimand on the PNC after her 18th birthday was unfair. Waller LJ has quoted the relevant passage of the tribunal’s reasoning. They were “not convinced” on the facts of SP’s case that the representation should be disregarded because of “the benefits the conviction data will provide to the wider public”; and there was no clear evidence that the issue of fairness had even been considered by the Police.

[101]Waller LJ criticises this reasoning, on the basis as I understand that it would need to be applied to all those in a similar position to that of SP. The representation was in accordance with the “weeding” policy then in force, and SP would not have been alone in being told about its expected effect. That should not bind the Police if the policy subsequently changes. I could see the force of this reasoning, with respect, if there were evidence that the Police had considered the issue along those lines. That was not the case. The tribunal in my view were entitled to proceed on the evidence before them. The Police did not, as I understand it, advance a case based on the potential consequential effects on other cases of the same kind. In the absence of evidence of the implications for other cases, the tribunal was entitled to limit consideration to this particular case; and to balance, on the one hand, the effect on SP of going back on the representation, against, on the other, the potential significance of the information in question. In my view, their conclusion cannot be faulted in law.

Conclusion

[102]Before closing, I add a brief comment on the future role of the Information Tribunal. This case is one of a number which have demonstrated the weight and public importance of some of the cases which come before the tribunal. Without any disrespect to the experienced President and members who sat in this case, the issues were as complex and significant as many cases in the High Court. It is envisaged that from January 2010 this jurisdiction will become part of the new two-tier tribunal system under the Tribunal Courts and Enforcement Act 2007. The relevant orders are expected to provide for some selected cases to begin in the Upper Tribunal, where it is also possible for High Court or Circuit judges to sit by request. The selection of such cases, and the deployment of judges and members to sit on them, will be a matter for the relevant Chamber President. I observe only that a case of this kind might have been particularly suitable for such treatment, not only because of the importance of the issues, but also because it would have allowed for the involvement of a judge with direct hands-on experience of the criminal system.

[103]Returning to the present case, I would allow the appeal on the grounds based on DDP3 and 5 in relation to all five cases. In the case of SP I would dismiss the appeal in relation to the application of DPP1.

Lord Justice Hughes :

[104]I agree with both my Lords that all these appeals should be allowed on the grounds arising from DPP 3 and 5, and for the reasons which they both give. It is undesirable to prolong this judgment by re-stating those reasons at length. At the risk of over-summarising, I respectfully agree that: i) it is for the data controller to determine the purpose(s) for which the data is processed; ii) it is not open to the Commissioner to impose his own determination of those purposes; the imposition of a concept of ‘core police purposes’ was misconceived; iii) in any event the proper purposes of the police in managing the PNC plainly include the retention of information for provision to others who have a legitimate need for it, including (but not limited to) provision under statutory duty created by the Police Act 1997; iv) those purposes sufficiently appear from the notification of purposes lodged, but even if they do not the notification could be amended tomorrow; v) accordingly retention of the records in these cases for those purposes was not a breach of DPP 3 or 5; and vi) none of the foregoing is in any sense inconsistent with the Directive, which plainly contemplates (though does not require) the maintenance by the police of a comprehensive record of convictions.

[105]On the separate question of DPP 1 in the case of SP, I respectfully agree with Waller LJ that the appeal must also be allowed. It would be different if the Tribunal had found that SP had been induced to admit the offence by a promise that the record would be expunged if she reached 18 without further offence; in that event there would have been particular considerations, individual to SP, which might justify a conclusion with which a court of appeal ought not to interfere. But the Tribunal did not so find, unsurprisingly given that such a procedure would have been quite improper and that it was not consistent with the recorded interview under caution, in which SP had volunteered the admission in forthright terms:

“it was not really self defence; I just went mad.”

It did not follow from the fact that the relevant police employee had not separately considered DPP 1, but had simply applied the general rule as it now stood, that the application of that rule was unfair: that was to focus on some requirement for express reasoning rather than on the objective fairness or unfairness of the decision. I am satisfied that it cannot be unfair to apply to SP exactly the same rules as are applied to everyone else, after a change in practice for which there was good reason. Although it is not necessary to do so, I would myself also hold that the retention of this record, like all conviction records, is taken out of the fairness requirement of DPP 1 by section 29(1) Data Protection Act; the absence of a comprehensive record of such matters would be likely to prejudice the prevention and detection of crime and the apprehension or prosecution of offenders.

[106]I add a few words of my own principally to underline some practical considerations and in particular the value, in the public interest, of the existence of a single comprehensive record of convictions and of its being held by police forces acting collectively. By ‘comprehensive’ I mean a complete record of all significant convictions, cautions and reprimands, together with associated information. That the PNC does not extend to recording parking offences and the like does not affect the principle.

[107]First, even if only what the Commissioner called ‘core purposes’ were relevant, the attack on the retention of this data must fail. Like both Waller and Carnwath LJJ, I take the clear view that if senior police officers with considerable operational experience are satisfied that even very old and comparatively minor convictions may sometimes be of assistance in police investigations, then unless that view is perversely or unreasonably held, it is not open to the Commissioner to substitute his own view of their potential use. But I should also add that the opinion expressed by the police witnesses in this case entirely accords with what is seen to be true from time to time in major criminal investigations. As was in evidence in these proceedings, Dame Janet Smith also reached a similar conclusion when considering the investigation into Dr Shipman. Such old convictions, if never subsequently repeated, may very well not be the kind of material which it is proper to put before a jury, for example pursuant to the ‘bad character’ rules contained in sections 98-113 of the Criminal Justice Act 2003, but that does not begin to mean that they have not been of use in the investigation. Quite apart from propensity (or lack of it) to offend in a particular manner, they are likely to be useful for other reasons, of which location and associates are but two simple examples. Moreover, the critical consideration is not the use of the conviction standing by itself, but its potential value in conjunction with other information pieced together by a skilled detective. For the same reason, statistics on the probability of re-offending (even if their interpretation were agreed) are simply not a useful measure of potential use.

[108]Second, many others depend heavily, and reasonably, on the maintenance by the police of these records. Those others include (but are not limited to) the criminal courts, the family courts and those concerned with the protection of children and the vulnerable.

[109]The criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings: section 7(2)(a). There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown. a) It is the duty of the Crown to place before any sentencing court a complete record of previous convictions of the defendant. By section 143(2) Criminal Justice Act 2003, a previous conviction is to be treated as aggravating the offence if it reasonably can be. A court may of course disregard an old conviction and often will, but it may be wrong to do so. Certainly there ought often to be a real difference between sentencing a person who has never before offended and sentencing one who has, perhaps similarly, albeit many years previously. The court must be in a position to make an informed decision. b) There is an obligation on the Crown to reveal to the defence any convictions of any witness on whom it relies. That does not mean that the conviction can automatically be put in evidence by the defendant, but it enables the court to give proper consideration to any application under section 100 Criminal Justice Act 2003 to do so. Similarly, it will sometimes happen that it is relevant to challenge a witness called on behalf of the defendant on the basis of his record, especially for example if he has professed to a respectability which he does not enjoy. These simple, non-exhaustive, examples demonstrate how the common coin of the criminal court depends upon access by the court, through the prosecution and thus through the PNC, to a reliable and comprehensive record of convictions and their circumstances. Such records as might be pieced together from multiple courts, or from the historical files of diverse prosecuting authorities, would be no kind of substitute, and it is in any event highly undesirable that there should be multiple databases, with the inevitable concomitant risks of duplication of effort, inconsistency and reduced security. The criminal justice system thus depends on the maintenance of the PNC. If the PNC is not complete, the court can never know of a relevant old conviction. The Secretary of State for Justice expressed the view in this case that “providing anything less than full information to the courts would potentially undermine the criminal justice process.” I agree.

[110]The importance of multi-agency working to child welfare in general, and to child-centred family proceedings in particular, has been recognised for many years, has been the repeated subject of judicial and ministerial exhortation alike, and is difficult to overstate. It is, nowadays, the daily norm of cases in the family courts. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to these proceedings either: see section 7(2)(c) and (cc). It may well be that at times such co-operation throws up difficult questions about the extent of disclosure which a police force ought to make to social services or other child welfare professionals, but that is not a reason for failing to have available a comprehensive record in order to make a fully-informed decision about it.

[111]When it comes to the vetting of potential employees, the retention of conviction information is, in effect, governed by statute. Relevant potential employers are given by section 4(4) Rehabilitation of Offenders Act and the Exceptions Order made under it the statutory right to ask “exempt questions” about spent convictions. The potential employee cannot rely on the fact that the conviction is spent if the employer is within the Exceptions Order. He is bound to tell the truth. Without some comprehensive record in existence there is a risk that that obligation is an empty one. The answer can, however, be verified by the employer requiring the employee to obtain from the Secretary of State (in practice from the Criminal Records Bureau) a standard certificate of conviction under section 113A Police Act 1997. If the employer has additional qualification he can require the obtaining of an enhanced certificate under s 113B. Either certificate must reveal spent as well as unspent convictions: s 113A(3) and (6)(a) and 113B(3)(a). The enhanced certificate or a disclosure associated with it may also reveal other relevant information: s 113B(4) and (5). The Secretary of State is under a statutory duty to issue such certificates. The Police are under a statutory duty to supply him with the information so that he can do so. Section 119 provides:

“Any person who holds records of convictions, cautions or other information for the use of police forces generally shall make those records available to the Secretary of State for the purpose of enabling him to carry out his functions under this Part…”

Given that statutory framework, it is plain that it is part of the necessary public purposes of the PNC that it maintain a complete record of convictions etc to enable the statutory scheme to work.

[112]I fully understand the concern of the Commissioner at the combination of the extent of a comprehensive database of conviction information and the range of those who have access, directly or indirectly, to it. The greater concern is perhaps related to indirect access. The Tribunal was told in 2005, in a similar appeal (Chief Constable of West Yorkshire and others v Information Commissioner) that at that time approximately 2.6 million CRB certificates were issued in a year and of those 90% or thereabouts enhanced. Some 13,000 organisations are, it would seem, entitled to seek such certificates. But this concern is with policy, and with what ought or ought not to be in the legislation, rather than with the application of the law as it stands. It is for Parliament, and not for the Commissioner alone, to consider any limitation on the indirect access of others to the contents of the PNC. I would respectfully agree that the time may well have come to review the accretions which there have been to the Rehabilitation of Offenders Act 1974 (Exceptions) Order. It currently includes amongst the exceedingly long list of those who must answer questions relating to spent convictions persons as diverse as those who wish to hold a National Lottery licence, or to be a doctor’s receptionist, dental nurse, steward at a football ground, or traffic officer designated under the Traffic Management Act 2000 as having the power to direct traffic. Given that it does not follow that old convictions will in fact be treated as a bar to such employment, it might nevertheless be thought that consideration of the ambit of the Order might be useful. There might also be a case for reviewing the rehabilitation periods applicable to offences, and extending some. There might well be a case for implementing section 56 Data Protection Act in order to prevent employers and others who are outside the Exceptions Order from in effect circumventing the Rehabilitation of Offenders Act. But none of this is for me; it is for Parliament. And it is not for the Commissioner to try to modify the effect of statute by construction of the data protection principles.

[113]For the same reason I can understand why over the years the police and the Commissioner have actively discussed a so-called ‘step down’ regime, under which some information on the PNC would become available only to the police. This may have potential as a policy, although to my mind the criminal and family courts and child protection professionals engaged in working together with police officers would all need continued access to unexpurgated information. It would, however, require modification of the Rehabilitation of Offenders Act and of the Police Act 1997, which at present requires the police to provide the Secretary of State with everything in the record. Moreover, it would require immensely detailed programmes for organisation of the database: the March 2006 edition of the Retention Guidelines, which attempts the exercise, has 25 different categories of offender/outcome combination and no less than 200 pages of a closely-typed list of offences; yet it would still remove from the record convictions which would, for example, disqualify from jury service for life, and some which might plainly be relevant even many years later (for example wounding with intent, bigamy or importing Class A drugs). It would require, thirdly, as it seems to me at least, a method of accommodating fixed penalty notices as they are currently issued for offences which include not only public disorder but dishonesty. But again, if a workable and fair restricted access scheme can nevertheless be devised, this is not to be achieved through the Data Protection Act. APPENDIX 1 CHRONOLOGY IN THE CASE CONCERNING HP

APPENDIX 1

[1967]HP was born. 2nd March 1984 HP was 16 years of age. With another he stole items from a display in a Marks & Spencers store in Whitefriargate, Hull at 9.25 hours (Bundle p 35). 1984. HP was convicted of the offence of theft at the Juvenile Court. He was fined £15 [Bundle pp 33-34]. 31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426) 7th July 2006 The offence was disclosed on an enhanced disclosure certificate dated 7th July 2006 [Bundle p. 17]. HP had applied for a position as a care officer with the Hull City Council [Bundle pp. 12-16]. 16th September 2006 HP made a complaint to the ICO. In his complaint he said he had been informed by his employer that an enhanced disclosure certificate had revealed his conviction, which he had not previously disclosed and he was informed by his manager that he may be disciplined [Bundle p. 14]. 19th December 2006 to 8th August 2007 1 The ICO corresponded with the First Appellant in respect of the conviction [Bundle pp.1-11]. He asked for it to be “stepped down” or deleted from the PNC. The First Appellant agreed to step down the conviction but not to delete it. 9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 256-260] 8th August 2007 The Respondent issued an enforcement notice [Bundle p. 261-265]. The notice required the First Appellant to erase the conviction data relating to HP held on the PNC database. The Respondent said that the retention of the information contravened the third and fifth data protection principles. He said that he had taken into account whether the contravention of the principles had caused or were likely to cause HP damage or distress and had taken into account the provisions of

Article 8 of the European Convention on Human Rights

. 3rd September 2007 The First Appellant appealed against the enforcement notice [Bundle pp. 266-267A]. He disputed that there has been a breach of the data protection principles and further, or alternatively, submitted that the Respondent has wrongly exercised his discretion in requiring the First Appellant to erase the data. 8th April 2008 to 18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals. 21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed. 8th August 2008 The First Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court. APPENDIX II CHONOLOGY IN THE CASE CONCERNING SP

[1988]SP was born. 2001. SP was 13 years of age. She punched a 15 year old girl to the ground, kicked her and caused her injury in Wolgaston Way, Penkrage, Staffordshire [Bundle pp. 85-123]. That day she was arrested and taken to the police station. SP was given a reprimand for an offence of common assault [p 90]. 31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426) 1st September 2006 The reprimand was disclosed on an enhanced disclosure certificate dated 1st September 2006 to Four Seasons Health Care to whom SP had applied for a post as a care assistant [Bundle pp57-60]. 14th November 2006 SP complained to the ICO [Bundle p. 51-56]. She complained that she had been informed by the police officer who reprimanded her that the record would be removed by the time she was 18 years of age. 16th January 2007 to 16th August 2007 The Respondent corresponded with the Second Appellant and requested him to step down the reprimand or delete it from the PNC database [Bundle pp. 42-51]. The Second Appellant agreed to step down the reprimand but not to delete it from the PNC database. 9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 282-286] 16th August 2007 The Respondent issued an enforcement notice against the Second Appellant [Bundle pp. 287-289]. In the enforcement notice the Respondent required the Second Appellant to erase the data of the reprimand from the PNC database on the grounds that it breached the first, third and fifth data protection principles. The Respondent believed that the first data protection principle was breached because of the representation which had been made to SP that it would be removed after 5 years. He said he had taken into account that the distress had been caused or was likely and the provisions of

Article 8 of the European Convention on Human Rights

. 6th September 2007 The Second Appellant appealed against the enforcement notice [Bundle pp. 292-296]. He disputed that there has been a breach of the data protection principles and further, or alternatively, submitted that the Respondent has wrongly exercised his discretion in requiring the Second Appellant to erase the data. 8th April 2008 to 18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals. 21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed. 8th August 2008 The Second Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court. APPENDIX III CHRONOLOGY IN THE CASE OF NP

[1960]NP was born. He is now 48 years of age. 26th August 1981 NP was 20 years of age. At 11.30 am at Gledsons Electrical Co, Redburn Industrial Estate, Westerhope, Newcastle upon Tyne, NP posed as a representative of a company in order to obtain goods dishonestly and by deception [Bundle pp. 160-163]. 1981. NP was convicted of an offence of obtaining by deception and an offence of attempting to obtain by deception at the Magistrates Court for which he was fined £150 and £100 respectively and ordered to pay costs of £10 [Bundle pp 160-161]. 31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426) 13th September 2006 The offences were disclosed in a standard disclosure certificate [Bundle pp. 153-155] to Home Group Ltd upon an application of NP for the post of Housing Maintenance Officer. 17 October 2006 NP complained to the ICO [Bundle pp. 141-145]. He complained that his conviction was still retained notwithstanding under previous weeding rules it would have been removed. 19th December 2006 to 15th August 2007 In correspondence between the Respondent and the Third Appellant the Respondent requested the Third Appellant to delete the conviction data from the PNC or step it down [Bundle pp. 129-140]. The Third Appellant agreed to step down the conviction data but not to delete it. 9th July 2007 The Respondent served a preliminary enforcement notice on the Third Appellant [Bundle pp. 312-314] 15th August 2007 The Respondent served an enforcement notice on the Third Appellant [Bundle pp. 317-219]. The Respondent required the Third Appellant to erase the conviction data in respect of NP on the grounds that it breached the third and fifth data protection principles. The Respondent said that he had taken into account whether distress had been or would be likely to be caused to NP and

Article 8 of the European Convention on Human Rights

. The Third Appellant agreed to step down the conviction data but not to erase it. 12th September 2007 The Third Appellant appealed against the enforcement notice [Bundle pp. 322-325]. He disputed that there has been a breach of the data protection principles and submitted that the Respondent had wrongly exercised his discretion in requiring the Third Appellant to erase the data. 8th April 2008 to 18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals. 21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed. 8th August 2008 The Third Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court. APPENDIX IV CHRONOLOGY IN THE CASE CONCERNING WMP

[1962]WMP was born. 2nd July 1977 WMP was 15 years of age. At 3.50 pm WMP and another individual inserted metal blanks into an amusement arcade roulette machine at Dearmouth Park, West Bromwich [Bundle pp. 194-195]. 1978. At the Juvenile Court, WMP was convicted of two offences of attempted theft, in respect of which he was conditionally discharged for two years, and an offence of criminal damage, for which he was fined £25 and ordered to pay compensation of £6.60, a legal aid contribution of £30 and costs of £29.20 [Bundle pp189-191]. 31st July 2006 The Retention Guidelines for Nominal Records on the PNC came into effect (Bundle p 426) 23rd August 2006 The convictions were disclosed in an enhanced disclosure certificate dated 23rd August 2006 to Humber Parascending when WMP applied for a position on a Summer Scorcher Activity [Bundle p. 185]. 5th October 2006 WMP complained to the ICO on 5th October 2006 and requested that his convictions be removed as he regarded them, on today’s terms, as nothing more than a juvenile prank. He said that as a professional trainer and businessman he felt the terminology used could compromise his integrity [Bundle pp. 179-184]. 11th December 2006 to 15th August 2007 The Respondent corresponded with the Fourth Appellant [Bundle pp. 169-178] and requested that the Fourth Appellant should remove the conviction data or step it down. The Fourth Appellant agreed to step down the conviction but not to delete it. 9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 339-341] 16th August 2007 The Respondent served an enforcement notice on the Fourth Appellant [Bundle pp. 344-346]. The Respondent required the Fourth Appellant to delete the conviction data on the grounds that in his opinion it contravened the third and fifth data protection principles. He said that he had taken into account whether the contravention caused or was likely to cause WMP distress and

Article 8 of the ECHR

. 4th December 2007 The Fourth Appellant appealed against the enforcement notice [Bundle pp. 322-325]. He disputed that there had been a breach of the data protection principles and submitted that the Respondent has wrongly exercised his discretion in requiring the Fourth Appellant to erase the data. 8th April 2008 to 18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals. 21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed. 8th August 2008 The Fourth Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court. APPENDIX V CHRONOLOGY IN THE CASE CONCERNING GMP

[1964]GMP was born. She is now 44 years of age. 20th April 1983 GMP used a Williams & Glynn cashline card belonging to another to obtain £100 from a bank cashpoint dispenser at Williams & Glynns Bank, Mosley Street, Manchester [Bundle pp. 247-249]. GMP was 18 years of age. 1983. GMP was convicted of an offence of theft (and two matters that were taken into consideration) at the Magistrates’ Court. GMP was sentenced to a conditional discharge of 12 months and ordered to pay compensation of £185 and costs of £35 [Bundle pp 244-246]. GMP was 19 years of age at the date of the conviction. 9th July 2007 The Respondent issued a preliminary enforcement notice [Bundle pp. 339-341] 1st June 2006 The conviction was disclosed in a response to a subject access request (pursuant to Section 7 of the Data Protection Act 1998) made by GMP on 1st June 2006 [Bundle pp. 236-239] and provided by the NIS on 6th July 2006 [Bundle p. 233]. GMP had made the request to support an application for a passport, residency and citizenship to the state of St Lucia. 5th October 2006 GMP made a complaint to the ICO [Bundle pp. 224-228]. She said that because her conviction had been disclosed this would affect her plans to emigrate to St Lucia. 3rd January 2007 to 29th October 2007 The Respondent corresponded with the Fifth Appellant and requested the Fifth Appellant to delete the conviction data in relation to GMP from the PNC or step down the data. The Fifth Appellant agreed to step down the data but not to delete it [Bundle pp. 202-223]. 9th July 2007 The Respondent issued a preliminary enforcement notice on the Fifth Appellant [Bundle pp. 364-367]. 15th November 2007 The Respondent served an enforcement notice on the Fifth Appellant [Bundle pp. 369-371] requiring him to delete the conviction data in relation to GMP on the grounds that its retention breached the third and fifth data protection principles. The Respondent said that he had taken into account whether retention of the data had caused or was likely to cause GMP distress, and

Article 8 of the ECHR

. 20th November 2007 The Fifth Appellant appealed the requirement to delete in the enforcement notice [Bundle pp. 374-379]. He disputed that there has been a breach of the data protection principles and submitted that the Respondent has wrongly exercised his discretion in requiring the Fifth Appellant to erase the data. 8th April 2008 to 18th April 2008 Hearing of appeal before the Information Tribunal, with 4 other consolidated appeals. 21 July 2008 Decision of the Information Tribunal promulgated. Appeal dismissed. 8th August 2008 The Fifth Appellant lodged a Notice of Appeal against the decision of the Information Tribunal in the High Court. APPENDIX VI GLOSSARY ACPO Association of Chief Police Officers ACRO Criminal Records Office of ACPO - the body established in May 2006 to provide a central function for policing matters relating to criminal records and associated biometric identification, namely DNA and fingerprints. CJ arrestee A person who has been detained at a police station having been arrested for a recordable offence. CRB Criminal Records Bureau - the body established to discharge the functions of the Secretary of State under Part V of the Police Act 1997 ICO Information Commissioner’s Office IPLX Interim Police Local Cross Reference Data Base. MAPPA Multi Agency Public Protection arrangements MOPI Statutory Code of Practice and guidance on the management of police information NIS National Identification Service Nominal Records linked to a specific named individual containing histories Records reflecting the fact that the individual has been convicted or cautioned or reprimanded or dealt with by the issue of a penalty notice for disorder NPIA National Police Improvement Agency PIAP PNC Information Access Panel PITO Police Information Technology Organisation - the body responsible for having strategic and the technical role in the development, procurement and information of information technology at a technical level PNC Police National Computer SOPO Sex Offender Protection Order HP The data subject in respect of the case of the first Appellant SP The data subject in relation to the case of the Second Appellant. NP The data subject in relation to the case of the Third Appellant. WMP The data subject in relation to the case of the Fourth Appellant GMP The data subject in relation to the case of the Fifth Appellant.

Cited in 19 later judgments

and 10 more of the most senior