CL, R (on the application of) v The Secretary of State for the Home Department [2018] EWHC 3333 (Admin)

Case Nos: CO/3515/2016 & CO/1076/2018[2018] EWHC 3333 (Admin)
IN THE HIGH COURT OF JUSTICE
QUEEN’S BENCH DIVISION
ADMINISTRATIVE COURT IN MANCHESTER
DIVISIONAL COURT
Venue Manchester Civil Justice Centre
1 Bridge Street,
Venue Manchester M60 9DJDate Date: 06/12/18
Before
LORD JUSTICE HICKINBOTTOMMRS JUSTICE MOULDER
Between
THE QUEEN ON THE APPLICATION OFClaimantCLClaimantTHE CHIEF CONSTABLE OFDefendantGREATER MANCHESTER POLICEDefendantTHE SECRETARY OF STATEInterested PartyFOR THE HOME DEPARTMENTInterested Party
Amanda Weston QC and Jennifer Twite (instructed by Hodge Jones and Allen) for ClaimantCharlotte Ventham (instructed by Weightmans LLP) for DefendantThe Interested Party neither appearing nor being representedHearing Hearing dates: 13 July and 12 October 2018
JudgmentLord Justice Hickinbottom :Introduction
[1]“Sexting” is the creating, sharing, sending or posting of sexually explicit messages or images via mobile phones or other electronic devices. It covers a wide variety of circumstances. This case concerns peer-to-peer sexting by young people of photographs, initially self-generated and deliberately sent to another young person, although sometimes transmitted as a result of a request by and/or pressure from the recipient and sometimes sent on by the recipient to third parties.[2]Sexting potentially involves a number of criminal offences, e.g. distributing or showing an indecent photograph of a child contrary to section 1(b) of the Protection of Children Act 1978, or causing or inciting a child to engage in sexual activity contrary to section 10 (read with section 13) of the Sexual Offences Act 2003. These claims particularly concern the treatment by the police of reports of such behaviour.[3]The Claimant is the subject of two crime reports as a result of his alleged involvement in sexting incidents. At the time of the incidents, he was 14 or 15 years old. He is now over 18; but it has been agreed that he should be treated as a minor for the purposes of the determination of these claims. In these judicial reviews, he seeks deletion of the crime reports (or, at least, the details in those reports which identify him), on the primary basis that the recording and retention of his details is an unjustified interference with his rights under article 8 of the European Convention on Human Rights (“article 8”: we will refer to the Convention as “the ECHR”). In practice, he is not so much concerned about retention of the data by the police in itself: he is anxious that, if the police retain information identifying him with these incidents, that may be disclosed if (e.g.) a potential employer seeks an enhanced criminal record check before offering him a job.[4]Before us, Ms Amanda Weston QC leading Ms Jennifer Twite of Counsel appeared for the Claimant, and Ms Charlotte Ventham of Counsel for the Defendant Chief Constable. At the outset, we would like to express our gratitude for their written and oral submissions.[5]This is the judgment of the court to which we have each contributed.

Police Powers of Obtaining and Storing Information

[6]Reported crimes are recorded by police forces on their own local crime recording systems. Information recorded locally can be shared with other police forces on request. We will refer to the local databases maintained by police forces collectively as “the Police Database”. These claims are concerned with the Police Database – which is distinct from the Police National Computer (“the PNC”) which records inter alia convictions and cautions.[7]The police have a common law power to obtain and retain information for policing purposes, notably the prevention of crime and disorder. This power is now the subject of a substantial regulatory scheme which is focused on the Data Protection Act 2018 (“the DPA 2018”) which, effective from 23 May 2018, transposes into domestic law European Parliament and Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“the General Data Protection Regulation”, or “the GDPR”). The GDPR and the DPA 2018 repealed earlier measures, namely European Parliament and Council Directive 95/46/EC on the same subject matter (“the Data Protection Directive”, or “the DPD”), and the Data Protection Act 1998 (“the DPA 1998”) which gave effect to the DPD.[8]At the time of each of the specific challenged decisions, the earlier regime was operative; but, as the claims challenge continued retention of the data, the GDPR/DPA 2018 regime is also in play. However, for the purposes of these claims, the regimes have essentially the same foundations. Like the DPD, the GDPR is a harmonisation measure designed to produce a common European framework of regulation ensuring “a high level of protection” satisfying, amongst others, the standards in article 8 (see recital (10) of the GDPR, and recitals (10) and (11) of the DPD).[9]They have each regulated the “processing” of data, which includes the obtaining, recording or holding of information or data or carrying out any operation upon it including retrieval, use or disclosure (see article 4(2) of the GDPR, and article 2(b) of the DPD).[10]In respect of the “processing” of data, section 22 of the DPA 2018 requires a “controller” to comply with various obligations set out in article 5 of the GDPR, in particular (so far as relevant to these claims) that:
“Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject… (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes… (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed… (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay… (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed… (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing…”
. These obligations were, in substance, required of a controller under the previous regime (see especially section 4 of, and Parts I and II of Schedule 1 and Schedule 2 to, the DPA 1998).[11]They focus on the “processing” (including the collecting and retaining) of personal data being strictly restricted to particular “purposes”. By article 6(1) of the GDPR, processing shall be lawful only if and to the extent that at least one of several criteria applies, notably for the purposes of these claims:
“(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;…”
. These again effectively replicate the provisions of the earlier scheme, the substance of article 6(1)(e) being formerly found in paragraph 5(d) of Schedule 2 to the DPA 1998. It chimes with the important purposes potentially permitted as an interference by a public authority with an individual’s right to respect for his private and family life under article 8(2) of the ECHR, notably “for the prevention of disorder and crime” but also “for the protection of the rights and freedoms of others” (see R (Catt) v Association of Chief Police Officers; R (T) v Metropolitan Police Commissioner [2015] UKSC 9; [2015] AC 1065 (“Catt”) at [48] per Baroness Hale of Richmond DP).[12]By article 6(2) of the GDPR: “Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing…”; and the general provisions of the GDPR, which apply to all data processing by whomever performed, are indeed supplemented in the case of the police by extensive published codes and guidance.[13]Under section 39A of the Police Act 1996, until 2014, the Secretary of State was empowered to issue codes of practice to promote the efficiency and effectiveness of police forces. In July 2005, under that power and closely following the provisions of the DPA 1998, the Secretary of State issued a “Code of Practice on the Management of Police Information” (“the Code of Practice”), prepared by the National Centre of Policing Excellence. The Code of Practice restricts the processing of data to that required for police purposes, defined in paragraph 2.2.2 as follows:
“(a) protecting life and property, (b) preserving order, (c) preventing the commission of offences, (d) bringing offenders to justice, and (e) any duty or responsibility of the police arising from common or statute law”
. Under paragraphs 4.5 and 4.6, at intervals, retained information must be reviewed, the likelihood of it being used for police purposes reassessed, and consideration given to its deletion.[14]Paragraph 3.1.1 of the Code of Practice provides for more detailed guidance to be given to ensure consistent police procedures with regard to data processing and to identify minimum standards of information management. In 2006 (updated in 2010), the Secretary of State issued such further guidance under the Code, namely “Guidance on the Management of Police Information” (or “MOPI”). As a result of section 124(2) of the Anti-Social Behaviour, Crime and Policing Act 2014, section 39A of the Police Act 1996 was amended so that the power to give guidance was transferred from the Secretary of State to the College of Policing (albeit with the approval of the Secretary of State). MOPI was superceded by the College of Policing’s “Authorised Professional Practice: Information Management – Retention, review and disposal”, originally published in October 2013. This requires an evaluation of whether retention of the data is proportionate and necessary for policing purposes at the point of input, and then regularly reviewed. For these purposes, information is categorised by the nature of the offence or record involved. For certain “public protection matters”, including serious specified offences under the Criminal Justice Act 2003, data is retained until the subject has reached 100 years of age, with a review every ten years “to ensure adequacy and necessity” (so-called “Group 1” cases). Offences under both section 1 of the Protection of Children Act 1978 and section 10 of the Sexual Offences Act 2003 are “serious offences” as defined in section 224 of the Criminal Justice Act 2003; and thus fall into this group for review purposes. For the least serious matters, data are retained for an initial clear period of six years, after which there is a review with a further review every five years. In addition, section C of the Home Office Counting Rules for Recorded Crime (“the HOCR”) (see below) provides for removing crime records in certain circumstances, including where there is “additional verifiable information that determines that no notifiable crime occurred becomes available”.[15]For the purposes of ensuring that all police forces record crime accurately and consistently, the Secretary of State annually publishes the HOCR, a document which incorporates the National Crime Recording Standard (“the Recording Standard”). One express aim of the guidance is “to take a victim-orientated approach to crime recording” (paragraph 1 of the Recording Standard).[16]Under the heading “General Principles”, the Recording Standard states: “2.1 All reports of incidents, whether from victims, witnesses or third parties and whether crime related or not, will, unless immediately recorded as a crime, result in the registration of an auditable incident report by the police. 2.2 An incident will be recorded as a crime (notifiable offence) for ‘victim related offences’ if, on the balance of probability:(a) the circumstances of the victim’s report amount to a crime defined by law (the police will determine this, based on their knowledge of the law and counting rules); and(b) there is no credible evidence to the contrary immediately available. 2.3 A belief by the victim, or person reasonably assumed to be acting on behalf of the victim…, that a crime has occurred is usually sufficient to justify its recording. 2.4 … 2.5 Once recorded, a crime will remain recorded unless additional verifiable information… is found and documented which determines that no notifiable crime has occurred or crimes are transferred or cancelled i.e. where crimes are created in error, or as a duplicate of an existing crime.” (a) the circumstances of the victim’s report amount to a crime defined by law (the police will determine this, based on their knowledge of the law and counting rules); and (b) there is no credible evidence to the contrary immediately available.[17]What is meant by “the balance of probability” is further considered in paragraphs 3.2 and 3.3:
“3.2 Balance of Probability Test: When examining a report of an incident regarding offences involving identified victims, the test to be applied in respect of recording a crime is that of the balance of probabilities: that is to say: “is the incident more likely than not the result of a criminal act”.A belief by the victim, or person reasonably assumed to be acting on behalf of the victim, that a crime has occurred is usually sufficient to justify its recording as a crime. A victim focused approach is the standard to be applied based on a presumption that the victim should be believed. 3.3 Initial Report – Informing the Crime Recording Decision: A complaint should be considered as made at the first point of contact in keeping with guidance at paragraph 2.3 prior. Evidence indicates that the information obtained by the police at the point of first contact (from all channels/routes) will usually be sufficient to meet the ‘balance of probability’ crime recording decision making process…. (CRDMP). Where the CRDMP establishes that a crime has been committed then recording must take place and must not routinely be delayed to facilitate deployment of resources or to enable further investigation to take place…”
(emphasis in the original). That is also emphasised in the section of the guidance headed, “Whether & When to Record”.[18]Therefore, for a reported incident to be recorded as a crime, the threshold is very low: in essence, it will be so recorded if the circumstances as reported amount to a crime, unless there is verifiable information that determines (i.e. proves) that no crime occurred. It will be recorded as a crime even if there are no identifiable suspects.[19]Section H of the HOCR set out various “Recorded Crime Outcomes”, into one of which any recorded crime must be assigned. Outcome Type 10 is “Formal action against the offender is not in the public interest – Police decision”, which is generally used where there has not been any determination that there is sufficient evidence to charge and the police consider it is not in the public interest to take any further action against the suspect.[20]From January 2016, a new outcome type was added, Outcome 21, as follows:
“Further investigation, resulting from the crime report, which could provide evidence sufficient to support formal action being taken against the named suspect, is not in the public interest – police decision.”
The notes of clarification state: “… Outcome 21 is… used operationally as an indication to [Disclosure and Barring Service (“the DBS”): see paragraph 26 below] staff, that care should be taken before routinely disclosing the information. It will not, therefore, normally be appropriate in relation to ‘serious’ offences such as domestic abuse, hate crime, child abuse or any indictable only matter; nor to any offence, e.g. dishonesty, where the nature of the offending may be relevant to future employment with children and/or vulnerable adults. If, in exceptional circumstances, use of Outcome 21 is deemed appropriate for a ‘serious’ or ‘relevant’ offence, the decision maker must be appropriate for the seriousness of the offence in question and the rationale sufficient for future DBS staff consideration. It will usually be necessary for police to speak to the suspect and/or to their appropriate adult (parent/carer etc) to explain the implications…”.[21]Annex E to the HOCR deals specifically with “Crime Reporting by Police Officers Working in Schools”. At the relevant time, paragraph 8 stated:
“When requested by the school, officers should consider the nature and seriousness of an incident before deciding whether to officially record the matter, immediately or at a later stage, as a recordable crime. A serious incident is as defined within the ‘Serious Incidents’ section below (this is the same as defined by the now repealed Section 116 of the Police and Criminal Evidence Act 1984 [“PACE”]). In addition, a serious incident is one which in the view of the child, parent or guardian or the child’s representative any incident that has led or is intended to, or is likely to or threatened to lead to serious harm or loss to any school child.”
An offence under section 1 of the Protection of Children Act 1978 was a specified “serious arrestable offence” under section 116 of PACE, and thus is a “serious incident” for these purposes (listed in Annex E at page 4 paragraph (n)).[22]Once a crime is recorded, it remains on the Police Database unless it is classified as “No crime” on the basis of one of the criteria in Section C, the only relevant criterion for the purposes of these claims being: “(B) Where following the report of an incident which has subsequently been recorded as a crime, additional verifiable information is available which determines that no notifiable crime has been committed”.[23]In the particular context of these claims, the above guidance is supplemented by a College of Policing Briefing Note, “Police action in response to youth produced sexual imagery (‘Sexting’)” (Version 1.0) (November 2016) (“the Sexting Briefing Note”). So far as the recording of a report of sexting by a young person is concerned, this gives chief police officers further non-statutory guidance in the following terms:
“Overview 2. Most offences involving sexual activity with children will require a full criminal investigative response, for example in the presence of exploitation, coercion, a profit motive or adults as perpetrators. Offences involving self-generated images or images obtained with consent by other children may be dealt with differently. Forces may, for example, consider that suitably experienced first responders, safer school officers or neighbourhood teams can provide an appropriate response, thereby avoiding stigmatising children or causing them unnecessary fears and concerns. The recently introduced ‘outcome 21’… provides for forces to resolve crimes with the appropriate contextual factors in a proportionate and effective way. 3. In deciding whether criminal justice processes are necessary and proportionate, forces will wish to consider the long-term impact of investigation and prosecution, such as labelling a child a ‘sex offender’ and potential disclosure as part of a [DBS] process. Chief constables have discretion to consider whether behaviour covered in this paper should be disclosed on a DBS enhanced check, as for other non-conviction information (see section 22). … Initial police action 9. All reported offences of youth produced sexual imagery must be recorded as a crime in line with [the HOCR]. 10 … 11. Background checks should be run regarding the victim(s), perpetrator(s) and location(s) (where relevant). This should include all police systems…. 12. … 13. Most offences involving sexual activity connected to children will raise significant safeguarding concerns. In youth produced sexual imagery cases where there are no aggravating features, it may be appropriate to take an approach that is supportive of the children involved, rather than a criminal process. Decisions on the appropriate approach should be underpinned by careful assessment of the facts of the case: the presence of any aggravating features; the backgrounds of the children involved; and the views of significant stakeholders (such as parents/carers and the children’s teachers). Investigation 14. When collecting initial accounts it is important that care is taken and the needs of the children affected are considered. In deciding whether criminal justice processes are necessary and proportionate, forces will wish to consider the long-term impact of investigation and prosecution, such as labelling a child a ‘sex offender’ and the potential for disclosure as part of a [DBS] process.”
Initial police action

Investigation

[24]In respect of Outcome 21, the guidance continues (all emphasis in the original): “19. HOCR requires each crime to be allocated an outcome from a menu of predefined codes. In January 2016, the Home Office launched outcome 21 which states: ‘Further investigation, resulting from the crime report, which could provide evidence sufficient to support formal action being taken against the suspect is not in the public interest – police decision.’ This outcome code allows the police to record a crime as having happened but for no formal criminal justice action to be taken as it is not considered to be in the public interest to do so.20. Outcome 21 may be considered the most appropriate resolution in youth produced sexual imagery cases where the making and sharing is considered non-abusive and there is no evidence of exploitation, grooming, profit motive, malicious intent (e.g. extensive or inappropriate sharing (e.g. uploading onto a pornographic website) or it being persistent behaviour. Where these factors are present, outcome 21 would not apply.21. It is likely that forces will want decisions about the use of outcome 21 in these circumstances to be reviewed by a suitably senior and/or experienced officer.22. Once an appropriate outcome has been decided it is vital that this is clearly communicated to the persons affected, their parents or carers and school where appropriate. This should also explain the immediate and longer term implications as this is a common concern cited by those being investigated and their parents or carers. Should a person receive a caution (incl youth caution) or conviction, disclosure on a DBS certificate is mandatory. Non conviction information can only be included on an enhanced criminal record check and it is for a Chief Officer to consider what information should be included based on relevance. The discretion on whether to disclose non-conviction information rests with each chief constable managing the process. Therefore, no guarantee can or should be provided that this information would not be released…. However, in the event that outcome 21 is utilised the following text may be given in writing, the principles of which explained to them in person: You/Your child has been recorded on police systems against (add crime type) in line with Home Office crime recording rules. After consideration of all relevant factors, a decision has been made that no further action will be taken by the police in this instance. ****** has not been convicted or cautioned for any offence connected with this investigation. In the event that a future ‘Enhanced Disclosure and Barring Service’ (DBS) check is required it is unlikely that this record will be disclosed unless you/your child are investigated or have further action taken against you/them in the future which could suggest a relevant pattern of behaviour. Any decision to disclose will be made by the chief police officer dealing with the request, based on all factors and information available at the time of the decision.” ‘Further investigation, resulting from the crime report, which could provide evidence sufficient to support formal action being taken against the suspect is not in the public interest – police decision.’

Disclosure and Barring Service Checks

[25]In some circumstances, information held on the Police Database is disclosable to potential employers; and it is the particular concern of the Claimant and his parents that, if his personal data were to be retained by the Defendant, it might in due course be disclosed in that context.[26]Amongst its other functions, the DBS carries out checks on potential employees to prevent unsuitable people from working with vulnerable groups including children, and provides a certificate confirming the results of the investigation. There are three levels of check. A “basic check” certificate will record details of convictions and cautions held on the PNC considered to be “unspent” under the Rehabilitation of Offenders Act 1974 which provides that, as a result of the effluxion of time, convictions may become “spent” such that the offender is treated for many purposes as if he had never been convicted of the offence concerned. A “standard check” certificate will contain details of both spent and unspent convictions, cautions, reprimands and warnings recorded on the PNC. An “enhanced check” certificate (known as an “Enhanced Criminal Record Certificate” or “ECRC”) contains all the details that would be found on a standard check, but it may also contain non-conviction information supplied by any relevant chief police officer. For the purposes of an enhanced check, section 113B(4) of the Police Act 1997 obliges the DBS to make a request of any relevant chief of police who, upon such a request, is required to provide any information which he “reasonably believes to be relevant for the purpose” and in his opinion “ought to be included in the certificate”. Therefore, a chief police officer has a discretion whether to disclose non-conviction information found on the Police Database, in the sense that he must make an assessment of the factors for and against disclosure and come to a decision as to whether the information ought to be included in the certificate. By section 113B(4A), in exercising that function, the chief officer must have regard to any guidance for the time being published by the Secretary of State. We deal with the current guidance below.[27]A standard DBS check or ECRC can only be applied for by an employment recruiter for a specified class of job as listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975 No 1023), and only through the specific individual they wish to check. That individual is the real applicant; and the certificate is sent to him, and he sends it on to the prospective employer.[28]If the applicant considers that the ECRC contains information that he believes is irrelevant or otherwise ought not to have been disclosed, he has the right to appeal through the DBS disputes process. The DBS initially refer the matter back to the police force who made the disclosure for it to reassess its decision in the light of any new information that the applicant has provided. Under the Service Level Agreement between the DBS and the National Police Chiefs’ Council, the force has 60 days to respond. If it agrees that the information should not be included, it will issue a new ECRC without that information. If the matter is not resolved to the satisfaction of the applicant, he has a right of appeal to an Independent Monitor under section 117AA of the Police Act 1997 as inserted by the Protection of Freedoms Act 2012. There is no set timetable for such a reference; but it seems that the average time for a reference to be concluded is about three months. There is no further appeal; but the decision of the Independent Monitor is subject to challenge by judicial review on the usual public law grounds.[29]The current disclosure guidance issued under section 113B(4A) of the 1997 Act is “Statutory Disclosure Guidance” (SecondEdition) (August 2015) (“the Disclosure Guidance”). Under that guidance, chief officers are also required to have regard to the Quality Assurance Framework (at all material times, the version issued in September 2014) (“the QAF”) drawn up by the Association of Chief Police Officers and the DBS.[30]Reflecting the Recording Standard, paragraph 18 of the Disclosure Standard states, under the main heading, “Principle 2 – Information must only be provided if the chief officer reasonably believes it to be relevant for the prescribed purpose”, and the sub-heading, “Information should be sufficiently credible”:
“This will always be a matter of judgment, but the starting point will be to consider whether the information is from a credible source. Chief officers should consider whether there are any specific circumstances that lead them to consider that information is unlikely to be true or whether the information is so without substance that it is unlikely to be true. In particular, allegations should not be included without taking reasonable steps to ascertain whether they are more likely than not to be true.”
[31]Under the same Principle, it is said that the information should also be “sufficiently current”, as the older the information the more difficult it will be to form a reasonable belief that it is relevant”; although “other factors, especially seriousness,… may mean that even very old information may reasonably be believed to be relevant” (paragraph 17).[32]Under the heading, “Principle 3 - Information should only be provided if, in the chief officer’s opinion, it ought to be included in the certificate”, and the sub-heading, “The impact of disclosure on the private life of the applicant or a third party”, the guidance goes on to say:
“20. The words ‘ought to be included’ should be read and given effect in a way which is compatible with the applicant’s right to respect for their private and family life under article 8 of the [ECHR]. Disclosure of information on ECRCs as a result of decisions made by chief officers will fall within the scope of article 8. That being the case, they will, in virtually every case, involve an interference with the applicant’s private life; this may include the impact on the applicant in terms of their prospects of being selected for the role in question. Therefore chief officers must ensure that the disclosure of such information is justified in every case. 21. Firstly this requires establishing whether there is a legitimate aim pursued by the disclosure; this might be the legitimate aim of crime prevention and/or the protection of the rights and freedoms of others and/or ensuring public safety. Every case should be evaluated on its own facts. 22. If there is a legitimate aim pursued, the next step is to consider whether the disclosure of the information is necessary to pursue that aim including consideration of whether there are any other realistic and practical options to pursue that aim. If disclosure is considered necessary to pursue that aim then the question becomes one of proportionality. In practice this will involve weighing factors underpinning relevancy, such as seriousness, currency and credibility against any potential interference with privacy. All decisions must be proportionate. This means that the decision is no more than necessary to achieve the legitimate aim and that it strikes a fair balance between the rights of the applicant and the rights of those the disclosure is intended to protect. It is therefore essential that the reasoning in reaching a decision is fully and accurately recorded in each case.”
[33]Principle 4 in the guidance requires a chief officer to “consider whether the applicant should be afforded the opportunity to make representations”, in the following terms: “26. In any case where a chief officer is minded to provide information for inclusion in a certificate or is uncertain whether to do so, they should consider whether the applicant should be offered the opportunity to make representations before the information is submitted. Some of the factors relevant to this consideration are: * is there doubt as to whether the purpose for which the certificate is being requested, while eligible for an ECRC, actually requires the disclosure of this specific information? * has the applicant ever had a fair opportunity to answer an allegation? * is there doubt that an allegation could be substantiated? * is there any doubt as to whether factual information is correct or remains valid? * is it questionable whether disclosure of this information would represent a disproportionate interference with the applicant’s private life? 27. The chief officer should ask themselves whether it is obvious that nothing the applicant might say by way of representations could rationally or sensibly influence their decision. Only in cases where there is no room for doubt that the information should be disclosed should a decision to disclose be taken without first giving the applicant an opportunity to make representations.” * is there doubt as to whether the purpose for which the certificate is being requested, while eligible for an ECRC, actually requires the disclosure of this specific information? * has the applicant ever had a fair opportunity to answer an allegation? * is there doubt that an allegation could be substantiated? * is there any doubt as to whether factual information is correct or remains valid? * is it questionable whether disclosure of this information would represent a disproportionate interference with the applicant’s private life?[34]Principle 6 requires decisions on disclosure to be made in a timely manner.[35]The QAF does not materially add to this guidance, although flowchart MP7a states that the key steps which the police will take are to determine: i) whether it is reasonable to believe that the information is relevant to considerations of risk that the individual may pose to children or vulnerable adults for the specific application; ii) whether it is reasonable to believe the information to be true; iii) whether it is disproportionate to consider the information further; and iv) whether the police need to offer representations.[36]MP7a also gives guidance as to how these questions should be approached. For example, in relation to the question, “Is it reasonable to believe the information to be true?”, it states that the information need not be true “beyond reasonable doubt” and that, although the civil test (“burden of probabilities”) is a good starting point, case law directs the decision-maker to consider whether there are “untoward circumstances” that lead him or her to believe that the information “might not be true” or “is so devoid of substance that it would be unreasonable to conclude that it might be true”, in which case the answer to this question is “No”.[37]Importantly, in relation to the question of the proportionality of giving disclosure, it states:
“Consider the passage of time since the relevant events occurred – how does this affect your risk assessment and your conclusion? Events that occurred some years in the past may become decreasingly relevant over time, particularly if there is evidence that the individual has since changed their ways. Age of offender at the time of the offence is a factor – was the individual a youth at the time? With the passage of time, an offender who was a child or young person at the time of their offence may have matured to become a greatly reduced risk as an adult (or no risk at all) – do you have recent evidence that they have continued their relevant behaviour?”
[38]Accompanying Chief Officer Guideline GD6 reinforces this guidance.

Factual Background

[39]The Claimant has allegedly been involved in three incidents of sexting involving other students from his school, which we shall refer to as simply the first, second and third incidents. What happened on each occasion is not uncontroversial. Some parts are not accepted by the Claimant. Some are firmly disputed.[40]The first incident took place in early 2015. In a contemporaneous note made on 9 February 2015, the safeguarding officer at the Claimant’s school recorded that the Claimant had sent an image of himself to another, female student, A; and, on the same day, she had sent an image of herself to him. The school-based police officer, who we shall refer to as PC X, was informed. In a note, not prepared until February 2016, PC X said that she was told that the Claimant had sent an image of himself to A; and she spoke to him, warning him that his actions constituted a criminal offence and he should not do it again. On 9 February 2018, PC X apparently told Det Supt Rawlinson (who was reviewing the retention of the data, in circumstances to which we shall come) that she had been told of the exchange of images, and she had spoken to both children who each admitted sending an image to the other. PC X and Det Supt Rawlinson decided to take no further action, and no part of that incident was in fact recorded on the Police Database.[41]In a witness statement dated 1 July 2016 in these proceedings, without having sight of any evidence from the school safeguarding officer or PC X, the Claimant said that, “a long time before the incident of 19 March 2015” (see below), he had received an unsolicited image from A, which had been received by others in the school and which she had asked him to delete which he did; but he did not refer to any image sent by him to her.[42]The second incident occurred shortly thereafter. In a witness statement dated 13 February 2018 (i.e. nearly three years after the incident), the Assistant Head Teacher said that on a day in March 2015 another female student, B, went to see him one morning to say that the Claimant had sent her a picture of his “willy”, and she had sent him a picture of her “boobs”, both via a social media app. B had fallen out with the Claimant, who had passed on her photograph to another student. The Assistant Head decided to see the Claimant immediately, and summoned him. He saw the Claimant with PC X, who happened to be on the school premises at the time. In his statement, the Assistant Head said that the Claimant admitted both sending an image of himself and sending on the image of B to the third party. He agreed to delete the image from his phone. The Assistant Head agreed with PC X that she would record the crime, and tell the Claimant’s parents, which is why (the Assistant Head said) he did not make a contemporaneous note of the interview. PC X’s statement of February 2016 was broadly consistent with that account, except, whilst the Assistant Head had said that PC X had gone through more detailed questions concerning the incident, PC X herself said that she asked no questions of the Claimant – she just informed him that she would make a crime report of the incident. PC X accepts that she did not caution him; and it is also accepted that the interview proceeded without the Claimant being given an opportunity to have a parent or other appropriate adult present.[43]In his statement (again made without sight of any evidence from the Assistant Head or PC X), the Claimant accepted that he had sent a photo of himself to B, and said that she had circulated that more widely; but he denied receiving an image from her (or, of course, sending on such a photo to a third party) – although he said he understood that she had sent photos of herself to another pupil.[44]In the crime report created by PC X (Crime Report No 162026F/15), it is said that this second incident was reported on 19 March 2015, but “finalised” and “recorded” on 14 September 2015. It records the Claimant’s name in the “Offender details” section. The report indicated that the Claimant had “taken indecent image of himself and forward same to another”; and recorded “Crime type: obscene publications” and under Home Office code, “take indecent photos”. The report records:
“All Parties Fully Admit The Offence And Parents Fully Aware”; and it states that the “outcome” was “not in the public interest to pursue.”
[45]On 15 November 2015 Ms Twite from “Just for Kids Law” wrote to the Defendant requesting that information identifying the Claimant be deleted from the crime report, on the basis that a crime report should never have been created because(i) the alleged actions did not constitute an offence,(ii) the procedures used to obtain his admissions did not comply with the PACE Codes, and(iii) it was disproportionate for the school to have reported the matter to the police. The Defendant (through Detective Chief Inspector Michael Fraser) responded to that request by a letter dated 5 April 2016, following the intervention of the Deputy Police and Crime Commissioner. That letter responded to all the claims, concluding that the incident was properly recorded as a criminal offence and the Claimant was properly documented as a suspect in relation to the offence; although the crime investigation was closed with an outcome of no further action because the police had taken the view that it was not in the public interest to pursue it. Outcome 21 was not available at that time – it was introduced in January 2016 – but the outcome assigned (Outcome 10) was to generally similar effect.[46]On 12 July 2016, a claim was issued against the Defendant and the Secretary of State for the Home Department (Claim No CO/3515/2016), challenging the decision of 5 April 2016 to refuse to delete the crime record, and seeking a declaration that Annex E to the HOCR related policy and/or guidance were in breach of article 8. The Claimant relied on three grounds. i) The HOCR, the Recording Standard and accompanying guidance breached article 8 as failing to provide adequate safeguards against arbitrary interference, ensuring that interference is in accordance with the law and justified as necessary in pursuit of a legitimate aim. ii) The decision to record and/or the refusal to delete the crime record breached the Claimant’s rights under article 8. iii) The decision to retain the crime record indefinitely and to fail to operate a proportionate and lawful system of review breached article 8.[47]However, by this time a further incident had been reported to the police by the school. On 19 February 2016, an allegation was made by a third girl, C, that, amongst several other boys – seven boys in all were allegedly involved – the Claimant had asked her to send him indecent pictures of herself and when she refused he had threatened to tell people that they had slept together. She said that she had then sent one indecent image of herself to the Claimant; and he had sent back an image of a penis, although it looked to her as if it had been taken from the internet.[48]The matter was the subject of some preliminary investigation by the police. However, as eventually recorded in a further crime report, C’s account of exactly what had been communicated between her and the boys was “very vague”, and she claimed that she could not recall (or, at least, she had refused to provide) her account and log in information to recover any images from her mobile phone so that the images were never in fact recovered. In any event, C did not wish to pursue a formal complaint; and a decision was made by the police that it was in the best interests of C not to inform the Claimant (or any of the other boys) of her allegation “as this may seriously compromise her progress at school and negatively affect her well-being”. Instead, a programme of work was undertaken with C to address her safeguarding needs, and with her parents to help keep her safe online. Neither the Claimant, nor his parents, were told of the allegation at the time.[49]The record of this third incident showed the crime as being reported on 19 February 2016 and recorded on 21 April 2016. The crime type was (wrongly) shown as “Unlawful Sex. Activity” (i.e. an offence under section 11 rather than presumably section 10 (each read with section 13) of the Sexual Offences Act 2003). The outcome is shown as Outcome 21, “Further Invest Not In Public Interest”. In the “Offender details” section, the Claimant is shown as “suspect”. It is recorded that “No Letter Sent [to the Claimant] Due To Nature Of The Crime”.[50]Picking up the claim issued in respect of the crime report of the second incident, the Secretary of State responded to the effect that the HOCR do not require that the name of the actual or suspected offender be recorded. In the light of that response, the Claimant withdrew his claim against the Secretary of State who became an Interested Party.[51]In respect of the continuing claim against the Defendant Chief Constable, on 14 April 2017 Sweeney J refused permission to proceed. However, the Claimant renewed the application; and, at an oral hearing on 10 November 2017, Kerr J granted permission to proceed but restricted to “seeking relief in relation to CL as an individual” and expressly not extending “to seeking relief in respect of the content of any guidance or other document, such as a declaration that such content is unlawful or an order quashing it”.[52]On 14 December 2017, the Defendant wrote to the Claimant’s solicitors disclosing a redacted version of the crime report for the third incident (Crime Report No 070952B/16); and indicating that the Defendant intended to review the decision to retain the information in relation to the second incident. In performing that review, the Defendant said that he would take into account any further representations from the Claimant, particularly in the light of the fresh disclosure. The Claimant’s solicitors responded to say that they regarded the failure to inform the Claimant of such further allegation as a breach of article 6 of the ECHR (“article 6”), because the report identified the incident as a “crime” and the Claimant as the “offender” and the Claimant had not been afforded the protections given by article 6 to those accused of a criminal charge.[53]The review was conducted by Detective Superintendent Joanne Rawlinson. In her witness statement dated 16 February 2018, she says that she was asked to make a “fresh decision” in relation to the data retained in respect of the second incident, and was provided with various documents including those produced in connection with the judicial review proceedings. She records that she sought further details about the second incident speaking to the Assistant Head, who then made a formal statement dated 13 February 2018, and to PC X. She concluded that the crime report from 2015 was correctly recorded against the Claimant in accordance with the HOCR and that his details should remain on the record.[54]Det Supt Rawlinson produced a rationale for her decision, which is attached as an exhibit to her witness statement.[55]In relation to the first incident, based on the initial report provided by PC X and the subsequent conversation, Det Supt Rawlinson stated that an indecent image was sent by the Claimant to a girl and an indecent image was sent by the girl to the Claimant. Det Supt Rawlinson observed that the two children, who were 14 years old, made admissions to PC X who considered their accounts at the time to be reliable.[56]In relation to the second incident, Det Supt Rawlinson stated that PC X in her conversation of 9 February 2018 confirmed that the Claimant had admitted to forwarding the indecent image to a third student. Det Supt Rawlinson noted that the Claimant denied sending an image, but that this was at odds with the accounts of PC X and the Assistant Head.[57]In relation to the third incident, the alleged details were recorded, much as set out above. Det Supt Rawlinson also noted that the individuals named as being responsible:
“have not had the opportunity to comment on the behaviour described. A decision was made in the best interests of female C by the investigating officer not to speak to the boys concerned.”
Det Supt Rawlinson concluded:
“This report remains unsubstantiated. It may or may not be true; however it does fit with the pattern of behaviour by CL. If this report is true then this offending behaviour is very concerning.”
[58]Det Supt Rawlinson then considered whether the details should be retained in the light of article 8 of the ECHR and article 3(1) of the United Nations Convention on the Rights of the Child (see paragraph 80 below). In carrying out the balancing exercise required, she referred to all three incidents, noting in relation to the third incident that: “This third report of offending in February 2016, if true, showed malicious intent in so far as the complainant describes threats made to her by CL if she didn’t send indecent images to him. This again is not consensual sharing of images between young people of a similar age. I accept however that this third report is at this stage an allegation that has not been fully corroborated however indecent images and video of the girl that was sent was shown to [the school safety officer] by the girl concerned. No issues or concerns have been raised that would give any reason to disbelieve what the complainant reported. I am concerned that the first two incidents show a distinct pattern of offending by CL and that despite having been spoken to by school and the police following the first incident he has undeterred continued to commit further offences. Potentially incident three shows further evidence of a pattern of offending however if correct his actions in this case are becoming more serious in nature. The actions of CL do not simply involve the consensual sharing of indecent images.… That gives me cause to believe that CL presents a potential risk to the community. Based on the pattern of offending behaviour of CL I believe that it is necessary to record his name as a suspect… in order to protect members of the community and to assist in the prevention of further crimes. If a decision was made not to record his name on the crime officers would not be able to correctly assess the risk he poses and would not be sighted on his previous history which potentially could be an incredibly dangerous position. It is my opinion that the behaviours displayed by CL are beyond what can be described as normal teenage sexual development…”.[59]Det Supt Rawlinson considered the retention of the information by reference to the MOPI guidelines. In relation to the effect on the Claimant if the data were disclosed in the future, she concluded that each request for disclosure would be assessed on a case-by-case basis, and the decision-maker would consider whether information should be disclosed following an ECRC request taking into account the QAF guidance, case law and the human rights of the Claimant. Det Supt Rawlinson did not specifically address the period of time for which the information would be retained.[60]She concluded that the recording of the information in relation to the second incident was for “a genuine and legitimate policing purpose, to protect members of the public, and to assist in the prevention of further crime”; and that on balance it was proportionate to retain the details of the Claimant because of “the potential risk posed by him to young people.”[61]Following a request for further information and further pre-action correspondence (including, on 16 February 2018, the Defendant’s refusal to remove the information as a result of Det Supt Rawlinson’s review), on 13 March 2018 the Claimant issued a second claim for judicial review seeking to challenge the decision of 21 April 2016 to “record an offence by the Claimant” arising out of the third incident (Claim No CO/1076/2018).[62]The grounds of claim in the second proceedings are not set out seriatim; but, as presaged in the initial response to the disclosure, the Claimant’s focus is upon the Defendant’s action in “secretly recording the details of a serious sexual offence against a minor under 16 without disclosing the same to the Claimant or his parents” (see paragraph 5(iii) of the Claimant’s skeleton argument for the 12 October 2018 hearing), which, it is submitted, breached articles 6 and 8 of the ECHR and the Defendant’s duty under section 11 of the Children Act 2004 to exercise his functions having regard to the need to safeguard and promote the welfare of children. In addition, it is submitted that the allocation of outcome 21 to this matter was unlawful, because the policy under which outcome 21 was formulated gives rise to an unacceptable risk of unlawfulness; or, alternatively, the Defendant misinterpreted or misapplied that policy in this case leading to unfairness to the Claimant.[63]At the hearing of the first judicial review on 13 July 2018, we indicated that we considered we should hear any issues in the second judicial review before giving judgment on both matters. On 28 August 2018, Moulder J formally adjourned the application for permission to proceed in the second judicial review into open court on a rolled-up basis, and we heard that application on 12 October 2018.[64]This is the reserved judgment in respect of both matters.

The Issues

[65]The two claims are not based on identical (and, certainly, not identical surviving) grounds; but between them they give rise to three main discrete issues, on which Ms Weston makes the following submissions. Issue 1: Article 6: In respect of the crime report of the third incident, the Defendant breached article 6 by recording the details of the reported matter as a serious sexual offence in circumstances in which the Claimant and his parents were not told about, and had no opportunity to respond to, the charge. Issue 2: Article 8 (Legality): The regime for the collection and retention of data concerning reports of matters which might amount to the commission of a crime by a minor breaches article 8 because, in two respects, it is not in accordance with the law. i) There was a blanket and indiscriminate approach to recording personal details without regard to the fact that CL was a minor, such that, as well as being a discrete breach of section 11 of the Children Act 2004, there were no adequate safeguards against arbitrary treatment. Under this umbrella, it was submitted in the Statement of Facts and Grounds in the second claim that Outcome 21 gives rise to an unacceptable risk of unlawfulness by the way it deals with the recording and retaining of data where a decision is taken on the basis of the initial report that no further investigation be performed or action taken. ii) It is not possible to predict with a reasonable degree of certainty whether the information in the crime reports (or any of it) will be disclosed if an application for an ECRC is made. Issue 3: Article 8 (Proportionality): Insofar as the Defendant recorded and maintains each of the two crime reports in pursuit of the article 8(2) legitimate aims of preventing disorder or crime and the protection of the rights and freedoms of others, the adverse impact that that made on the Claimant’s right to respect for his private life was disproportionate. In respect of the decisions to collect and to retain the Claimant’s data in connection with the second and third incidents, it is said that the relevant police officers gave no or no proper consideration to fact that the Claimant was a child. Had they done so they would either not have collected the data, or by now they would have deleted it, on the basis that its retention was (and continues to be) a disproportionate interference with the Claimant’s article 8 right to respect for his private life.[66]We will deal with these in turn.

Issue 1: Article 6

[67]Ms Weston relies upon the common law right to a fair trial; but, in the circumstances of this case, the common law does not add anything of substance to article 6, which enshrines the right to a fair trial.[68]Article 6(1) guarantees an individual procedural fairness in “the determination of… any criminal charge against him”; and article 6(2) and (3) provide specific rights to anyone “charged with a criminal offence”, including “to be informed promptly, in a language he understands and in detail, of the nature and cause of the accusation against him”.[69]Ms Weston submits that the Defendant breached article 6 by recording details of a serious sexual offence against the Claimant, as a minor, without disclosing that to him or his parents. A criminal charge was a potential outcome of the pre-trial investigations performed by the Defendant, and thus the procedure was required to be compliant with the article 6 provisions that apply to a criminal charge. Ms Weston submits – rightly – that “charged with a criminal offence” in a European context has an autonomous meaning; but she also relies upon(i) paragraph 22 of the Sexting Briefing Note (quoted at paragraph 24 above), which states that it is vital that an outcome is clearly communicated to the persons affected (which clearly includes a child suspect) and their parents, and(ii) the wording used in the crime report, which describes the matter as an “offence” and the Claimant as an “offender”. She also relied upon a number of authorities, including two House of Lords cases: Attorney General’s Reference (No 2 of 2001) [2003] UKHL 68; [2004] AC 72 and R (R) v Durham Constabulary [2005] UKHL 21; [2005] 1 WLR 1184.[70]We do not consider there is any force in these submissions. As Ms Ventham submitted, in respect of the third incident, the Claimant has not even been the subject of a criminal investigation (as opposed to preliminary enquiries following a report) let alone any criminal proceedings. He has not been “accused” of anything, and he has not been charged with any crime. As paragraph 19 of the Sexting Briefing Note (also quoted at paragraph 24 above) makes clear, outcome 21 has been designed to ensure that, in appropriate cases, “no formal criminal justice action [is] taken”; and this better formalises the previous practice of not taking any such action. In respect of each of the two crime records, the highest it can be put on the Claimant’s behalf is that, on the basis of a report, he is, or was, suspected of being involved in activity which may have amounted to a criminal offence; but, as the crime report makes clear, following preliminary enquiries a decision was taken to take no further action in respect of the report, and the Defendant has more recently confirmed that he has no intention of opening or reopening any investigation.[71]Paragraph 22 of the Sexting Briefing Note does not help Ms Weston: it merely emphasises the obvious importance of telling interested persons the outcome of a report. That does not in itself suggest that a criminal charge has necessarily been made. A crime report is not the same as a criminal record. And we agree with Ms Ventham: it cannot be sensibly said that the nomenclature used in the crime report (that of “crime” and “offender”) either converts what is plainly a record of an allegation into an out-of-court disposal of a criminal charge, or pre-determines any future disclosure decision or the terminology that might be used in such a decision. Indeed, the evidence is that the unit which deals with ECRC responses “would not use the terms ‘offender’ or ‘victim’ in disclosure text relating to non-conviction information. The term ‘suspect’ may be used in rare cases” (paragraph 12 of the witness statement of Susanna Wilson dated 19 July 2018: Ms Wilson is employed in the Greater Manchester Police’s Occupation Checks Unit, and has authority delegated to her by the Defendant for the purposes of authorising ECRC disclosures). There is no reason not to accept that evidence.[72]Nor do the authorities referred to assist the Claimant: indeed, in our view, if anything they undermine Ms Weston’s submissions.[73]In Attorney General’s Reference (No 2 of 2001), a serious prison disturbance took place in April 1998. Many prisoners were interviewed by the police in June and July 1998; but informations were not laid until February 2000 and the trial for violent disorder in the Crown Court was not fixed until January 2001. The indictment was stayed on the basis of delay. The issue arose as to when, in the determination of whether a criminal charge had been heard within a reasonable time, the relevant period started. The House of Lords concluded that it “commences at the earliest time at which the defendant was officially alerted to the likelihood of criminal proceedings against him, which in England and Wales will ordinarily be when he is charged or served with a summons” (see [29] per Lord Bingham). Ms Weston submits that that does not deal with the situation where a person is never alerted to the matter, but nonetheless matters are recorded against him; but, with respect, it seems to us that it does. Where there is no charge or summons, a potential defendant in criminal proceedings is never officially alerted to criminal proceedings against him – because there has never been any such proceedings. In any event, in our view, there is nothing in the case to support Ms Weston’s proposition.[74]Ms Weston relied upon R (R) v Durham Constabulary, with other domestic and European authorities, for the proposition that children have a special position in the criminal law (see at [28] per Baroness Hale); but that special position does not alter the time at which a charge is made for the purposes of article 6.[75]For those reasons, we do not consider that Ms Weston’s submission that the creation and retention of the crime report in respect of the third incident engaged article 6 is arguable. Therefore, on the article 6 ground of challenge in the second judicial review, we refuse permission to proceed.[76]Insofar as Ms Weston put forward the more general submission that the manner in which the third incident was recorded as a crime with the Claimant as a suspect without him or his parents knowing about it or being given an opportunity to respond was procedurally unfair, we do not agree. Paragraph 22 of the Sexting Briefing Note (quoted at paragraph 24 above) makes clear how important it is that the outcome of a report is “communicated to the persons affected” which, in the case of a child, clearly includes both the child and his parents. However, as we have described (see paragraph 48 above), in this case a decision was taken not to do so because of the adverse effect that that might have upon the complainant, C, who was at the same school as the Claimant and the other six boys who were allegedly involved. The Defendant had to take into account the best interests of C (as well as those of the Claimant). He determined that it was in the best interests of C not to inform the Claimant (or any of the other boys) of her allegation “as this may seriously compromise her progress at school and negatively affect her well-being”, and that outweighed other factors. In our view, that was a conclusion that the Defendant was well-entitled to make. He revisited it when, in December 2017, he decided to review the decision to retain the Claimant’s data in relation to the second incident but considered that that could not properly be considered without taking the third incident into account which he considered he could not do without giving the Claimant and his parents an opportunity to respond to it. At that stage, the requirement for procedural fairness outweighed C’s best interests as they then were.[77]We do not consider that the Defendant acted with any procedural unfairness in the way suggested by Ms Weston.

Issue 2: Article 8 (Legality)

[78]Article 8, “Right to Respect for Private and Family Life”, provides:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
The right prescribed under article 8(1) is therefore qualified, and an interference with it may be justified under article 8(2) if it is in accordance with the law, necessary in the interests of one of the identified public aims and proportionate.[79]Where the article 8 rights of children are involved, then they have to be interpreted in harmony with the general principles of international law, including obligations imposed on the state by international conventions (Neulinger v Switzerland (2010) 28 BHRR 706 at [131]; and ZH (Tanzania) v Secretary of State for the Home Department [2011] UKSC 4; [2011] 2 AC 166 at [21]-[23] per Baroness Hale). In this context, the most important obligations on the United Kingdom are those derived from the United Nations Convention on the Rights of the Child (New York, 20 November 1989) (“the UNCRC”), article 3(1) of which provides:
“In all actions concerning children, whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or legislative bodies, the best interests of the child shall be a primary consideration.”
When a child’s article 8 rights are engaged, they must be looked at in the context of the UNCRC or, as it has been put, “through the prism of article 3(1)” (HH v Deputy Prosecutor of the Italian Republic, Genoa; F-K v Polish Judicial Authority [2012] UKSC 25; [2012] 4 All ER 539 at [155] per Lord Wilson).[80]The spirit of article 3(1) has been incorporated into domestic law in the form of section 11(2) of the Children Act 2004, which (so far as relevant to these claims) provides:
“Each person and body to whom this section applies must make arrangements for ensuring that— (a) their functions are discharged having regard to the need to safeguard and promote the welfare of children;…”
The section applies to a chief officer of police (section 11(1)(h)).[81]Section 11(4) provides that:
“Each person and body to whom this section applies must in discharging their duty under this section have regard to any guidance given to them for the purpose by the Secretary of State.”
[82]The relevant statutory guidance was issued in 2005, entitled “Statutory guidance on making arrangements under section 11 of the Children Act 2004” (“Every Child Matters, Change for Children”), one of a suite of five documents issued to support provisions in the 2004 Act.

(a) :

“The section 11 duty means that these key people and bodies must make arrangements to ensure… that their functions are discharged having regard to the need to safeguard and promote the welfare of children….”
[83]Paragraph 2.4 makes the clear that the intention of section 11 is not to change existing functions:
“The duty does not give agencies any new functions, nor does it over-ride their existing functions. It, however, requires them to carry out their existing functions in a way that takes into account the need to safeguard and promote the welfare of children.”
[84]Paragraph 2.8 provides that safeguarding and promoting the welfare of children involves preventing impairment of children’s health or development, ensuring that children grow up in circumstances consistent with the provision of safe and effective care and undertaking that role so as to enable those children to have optimum life chances and to enter adulthood successfully.[85]So far as article 8 is concerned, it is agreed between the parties and uncontroversial that: i) The systematic collection and storage by the police of information about an individual, in retrievable form, amounts to an interference with private life which is required to be justified in accordance with article 8(2) (see, e.g., Catt at [5]-[6] per Lord Sumption JSC). ii) In this context, the prevention of disorder or crime is a legitimate aim of such collection and storage. Ms Weston rightly accepts that there is a legitimate aim in recording and retaining material that may demonstrate a risk of future harm to those who are vulnerable, such that it may be disclosed in the future to a potential employer.[86]Therefore, like the claims in Catt (see [6]), the focus of the claims before this court is on whether the collection/recording and then the retention of the data in this case was and is(i) in accordance with the law, and(ii) proportionate to its objective of securing public safety and/or preventing disorder or crime, but in the context of the obligation upon the Defendant chief police officer to have regard to the need to safeguard and promote the welfare of the Claimant as a child.[87]Ms Weston’s first submission in relation to article 8 focused on whether the regime for the collection and retention of data concerning reports of matters which might amount to the commission of a crime by a minor was “in accordance with the law” for the purposes of article 8(2). She submitted that it was not, on two grounds.[88]First, she submitted that there was a blanket and indiscriminate approach to recording personal details without regard to the fact that the Claimant was a minor, such that, as well as being a discrete breach of section 11 of the Children Act 2004, there were no adequate safeguards against arbitrary treatment. Second, she submitted that the scheme is arbitrary because it is not possible to predict with any reasonable degree of certainty whether the information in the crime reports (or any of it) will be disclosed if an application for an ECRC is made.[89]In respect of the first ground, Ms Weston relied upon MM v United Kingdom (Application No 24029/07) (13 November 2012) and R (T) v Chief Constable of Greater Manchester Police [2014] UKSC 35; [2015] AC 49, which each concerned disclosure under ECRCs. At that time, section 113A of the Police Act 1997 required the disclosure of convictions (including cautions), and section 113B required the disclosure of non-conviction information if the chief constable believed it to be relevant and he thought it should be disclosed. Disclosure was required by statute, so that the DPA 1998 did not apply (see section 35(1)). In MM, the Grand Chamber held that disclosure under section 113A or 113B was arbitrary and “not in accordance with the law” because it was mandatory, and there were no provisions requiring a reasonable assessment of risk and no safeguards against arbitrary treatment of individuals. In T, the Supreme Court, on essentially the same facts, came to the same conclusion.[90]However, with due respect to Ms Weston’s submissions, things have moved on. In Catt, after a comprehensive review of the regulatory scheme, the Supreme Court considered the systematic collection and storage of retrievable data by the police; and Lord Sumption (with whom all the other justices agreed on this issue) concluded that the retention of data by the police, in accordance with the DPA 1998, the Code of Practice and the detailed administrative guidance to which we have referred above was in accordance with the law for the purposes of article 8(2) (see, especially, [11]-[17]). In doing so, Lord Sumption carefully considered the domestic legal framework. He noted, in particular, the requirement of the DPA 1998 and the mandatory guidance that data could not be obtained or retained by the police unless it is necessary for them to collect and retain it for one of the limited available public interest purposes which are clearly and narrowly defined; and the data could not be retained for longer than necessary for those purposes (see [12]). Since that judgment, of course, a new regime has been implemented, based on the GDPR and the DPA 2018; but that regime imposes safeguards that are only more rigorous.[91]Catt would seem to be determinative of the issue before this court; but Ms Weston submitted that the system failed to cater for a situation where the data concerns a child suspect, a matter not considered by the Supreme Court. She stressed the need for the criminal justice system to treat children differently from the way it treats adults; and the system failed to differentiate between adults and children.[92]However, we are unpersuaded. A similar argument was made, and rejected by this court, in R (Castle) v Metropolitan Police Commissioner [2011] EWHC 2317 (Admin); [2012] 1 All ER 953, which concerned children who had been detained by “kettling” during a central London demonstration in November 2010. Pitchford LJ, giving the judgment of the court, said (at [51]):
“The chief officer’s statutory obligation is not confined to training and dissemination of information. It is to ensure that decisions affecting children have regard to the need to safeguard them and to promote their welfare. This does not mean that the duties and functions of the police have been re-defined by section 11. [Paragraph] 2.4 of the statutory guidance [i.e. Every Child Matters, Change for Children], to which the chief must also have regard, makes that explicit. In our view the guidance accurately states the obligation of chief officers of police ‘to carry out their existing functions in a way that takes into account the need to safeguard and promote the welfare of children. The impact which the duty will have upon the performance of a function will depend to a significant degree upon the function being performed and the circumstances in which it is being performed. The responsibility will take on its sharpest focus when a police officer encounters a child who needs protection, for example in circumstances such as those anticipated by the statutory guidance concerning police investigations during which an unprotected child or a child at risk comes to their attention. A police officer will not be deterred from performing his public duty to detect or prevent crime just because a child is affected but when he does perform that duty he must, as the circumstances require, have regard to the statutory need.”
(emphasis in the original).[93]We respectfully agree that the duty to have regard the need to safeguard and promote the welfare of children does not affect the nature and scope of police functions, including the collection and retention of data. Rather, it affects how that function is performed.[94]In that regard, the scheme leaves a chief police officer in no doubt that, in performing his functions of collecting and retaining data, he has to respect article 8 rights and, in that context, to have regard to the need to safeguard and promote the welfare of children who are suspects or who are otherwise associated with reported activities which fall to be recorded on the Police Database. The relevant guidance documents include, most importantly (as emphasised in Castle), Every Child Matters, Change for Children (referred to in paragraph 82 above), which stresses the requirement of section 11(2)(a) of the Children Act 2004 to have regard to the need to safeguard and promote the welfare of children in exercising any police function. However, also of some relevance are: i) The Sexting Briefing Note (referred to in paragraphs 23-24 above), which emphasises that, in deciding whether criminal justice processes are necessary and proportionate, chief police officers forces should consider the long-term impact of investigation and prosecution; and that, when it comes to disclosure, if it remains as non-conviction information, they have discretion to consider whether behaviour covered in this paper should be disclosed on a ECRC. ii) Paragraphs 20-22 of the Disclosure Standard (quoted in paragraph 32 above), which emphasise the need for a proper approach to disclosure requests in the light of article 8 rights.[95]The fact is that, as we have described, each element of recording, retaining and disclosing non-conviction information by the police is the subject of intensive regulation and guidance, which rightly includes a myriad of safeguards for the subjects of the information – whether adult or child – to ascertain what information is held and, if considered appropriate, to challenge its collection and/or continued retention.[96]In the second claim, Ms Weston challenged the HOCR and in particular Outcome 21 because, she submitted, it gives rise to a risk of unlawfulness, because (as we understood the submission)(i) the HOCR requires the recording of a crime where a report on its face would probably amount to a criminal offence; and(ii) the HOCR (but particularly Outcome 21) requires such circumstances to be recorded as a crime and it results in the retention of personal data about a suspect without a full investigation of the crime report in circumstances in which, with such investigation, it might be concluded that no crime was committed at all or no crime was committed by the relevant individual.[97]These appear to be grounds upon which Kerr J did not give permission to proceed in the first claim. We consider he was right not to give permission; and, in her submissions, we consider Ms Weston was right not to press these grounds. The crime recording system is designed to assist with legitimate identified police public interest purposes, notably the prevention and detection of crime and the protection of potential victims. They consequently record any report of an incident that, on its face, probably amounts to a crime. The threshold for recording is low, and deliberately so: any information that may be useful for the identified police purposes is recorded and retained unless and until it is shown that no crime was committed by the relevant individual or that it is no longer required for those purposes. With the safeguards that we have described, the system is not arguably unlawful nor does it constitute a risk of unlawfulness.[98]It is true that Outcome 21 requires a report to be recorded as a crime without any (or, at least, any full) investigation; but that is in respect of cases in which, on public interest grounds, that course is preferable to making or continuing an investigation even where the “suspect” and his parents are not made aware that the incident has been recorded as a crime with his details attached (see paragraph 77 above). In some circumstances, sexting by a young person may fall within that category. The recording of the report with all the caveats required as a result of there being no or no full investigation is a quid pro quo for not fully investigating the matter. In any event, even if the matter were fully investigated, it would still be recorded on the Police Database as a crime pursuant to the HOCR unless and until evidence came forward that no crime had been committed or the police purpose was exhausted.[99]In any event, in all the circumstances, we do not consider that the collection and retention of data in police information systems is other than in accordance with the law on this ground.[100]The second ground on which Ms Weston submitted that the regime for the collection and retention of data concerning reports of matters was not “in accordance with the law” for the purposes of article 8(2) was based upon the proposition, described by the European Court of Human Rights in The Sunday Times v United Kingdom (26 April 1979) (Application No 6538/74) at [49], that a norm cannot be regarded as a “law” unless it is formulated with sufficient precision to enable a citizen to regulate his conduct: he must be able reasonably to foresee the consequences a given action may entail. That degree of predictability is an important strand of the rule of law.[101]However, we do not consider that this important proposition assists Ms Weston’s case here. A similar argument was made by the appellants in Catt, which Lord Sumption disposed of (at [14]) in this way:
“Much of the argument advanced on behalf of Mr Catt and Ms T on this point amounted to a complaint that this material did not enable them to know precisely what data would be obtained and stored or for how long. But these arguments were not in my opinion realistic. The infinite variety of situations in which issues of compliance may arise and the inevitable element of judgment involved in assessing them make complete codification impossible.”
Lord Sumption continued by pointing out some of the relevant safeguards in the scheme, e.g. that any person who thinks that the police may hold personal information about him may call for access to it and, armed with that, he may seek to have objectionable data removed if necessary by making an application to the Information Commissioner.[102]The same observations are relevant to Ms Weston’s submission. Any application for an ECRC would have to be dealt with on its merits; and given the infinite variety of circumstances which may obtain, it is simply impossible to give a guarantee as to the result of any ECRC application that may be made in the future. However, neither the rule of law nor article 8 require such guarantees. They require appropriate safeguards against arbitrary collection, retention and disclosure of information. We respectfully agree with Lord Sumption: they are in place in the scheme we are considering.[103]For those reasons, we do not find this ground made good either.

Issue 3: Article 8 (Proportionality)

[104]The ground of challenge upon which Kerr J granted permission to proceed in the first judicial review as we understand it, and a key ground in the second judicial review, is that, insofar as the Defendant recorded and maintains each of the two crime reports, the adverse impact those actions have made on the Claimant’s right to respect for his private life was disproportionate. In considering that proportionality balance, Ms Weston submitted that the relevant decision-maker either failed to have any regard to the fact that the Claimant was a child or at least failed properly to take that matter into account. Had they done so, then the data would not have been collected or, having been collected, would not have been retained.[105]Proportionality is a matter of substance not form. It is therefore for this court to consider whether, on all the evidence, the collection and retention of the Claimant’s personal data for the purposes identified in article 8(2) is proportionate to the adverse consequences of that collection and retention of data to the Claimant’s right to respect for his private life. It is an exercise in which we have to identify those matters in favour of allowing the collection and retention of data despite the infringement of the Claimant’s article 8 rights that results, and those matters which are in favour of upholding the article 8 rights and requiring deletion of the data; and then balance the one against the other (Polish Judicial Authorities v Celinski [2015] EWHC 1274 (Admin) at [16] per Lord Thomas of Cwmgiedd LCJ), taking into account the fact that in making that balance the best interests of any children concerned is a primary (although not, of course, determinative) consideration.[106]There can be no doubt that the information in respect of the second and third incidents collected and retained by the Defendant for several of the purposes permitted by article 8(2), notably “for the prevention of crime and disorder” but also “for the protection of the rights and freedoms of others” including potential victims of crime in the future. As noted by Baroness Hale in Catt at [48], putting together pieces of police intelligence can play a crucial part in preventing as well as detecting crime. Whilst individual incidents when looked at discretely may not signal anything untoward, when put together they can, for example, show a pattern of behaviour which may be concerning. It is noteworthy that, in Catt, the Supreme Court held that the collection and retention of information about Mr Catt’s attendance at peaceful demonstrations at which it was not suggested he had committed any offence – there was no crime report in which he was named – was still justified by proper policing purposes.[107]Of course, the nature of the behaviour is an important factor. The Claimant relies upon evidence of Professor Simon Hackett (Professor of Child Abuse and Neglect at Durham University) and Professor Andy Phippen (Professor of Children and Technology at Plymouth University). Both – but particularly the former – appear to regard sexting between children as normative, normal and non-abusive behaviour, which should not be criminal. Professor Hackett states (at paragraph 6 of his statement dated 13 November 2017) that there is no evidence that the sharing of self-taken images between young people, where there is no aggression or exploitation involved, is linked to future risk of sex offending. We do not deny the expertise of these two witnesses – or the sincerity of their views. However: i) The view that sexting is not harmful is not universally held. We were referred to the Report of the Government of Victoria Law Reform Committee for the Inquiry into Sexting (2013) which, at paragraph 2.5 under the heading “Harmful consequences of peer-to-peer sexting”, said that, whilst there was little unambiguous evidence as to the prevalence of sexting and the risk that it poses, “what is certain is that sexting behaviours play a role in framing the experience of gender and sexuality by young people, and that in some cases deleterious consequences may arise from sexting”. An abuse of particular concern to the Committee was the dissemination without consent of an image initially shared willingly (particularly because of the long-lasting nature of electronic images); and, even where sexting is apparently consensual, consent may become blurred or undermined because of coercion or peer pressure. It is not necessary of course for us to express a view on these opinions; but the police are certainly entitled to take the view that sexting even between adolescent children is potentially harmful. ii) Sexting is a criminal offence as being contrary to section 1(b) of the Protection of Children Act 1978; and or causing or inciting a child to engage in sexual activity contrary to section 10 of the Sexual Offences Act 2003. In respect of section 10, Parliament clearly considered the matter, and positively determined that it should still be an offence even if committed by someone under 18 years of age (see section 13). Both offences are serious specified offences under the Criminal Justice Act 2003 so that they are Group 1 cases, for which data is retained until the subject has reached 100 years of age, with a review every ten years.[108]The width of discretion that the police have in the matters which they investigate, and the scope of any investigation, is well-recognised. If in the exercise of that discretion – guided of course by the various provisions and codes etc to which we have referred – the police decide not to pursue a matter in respect of which there is prima facie evidence of an offence having been committed, because the suspect is a minor, it would be curious if they were unable at least to retain sufficient information to ascertain whether any pattern of behaviour was forming. If they were to investigate and prosecute to a conviction, then that would ensure a record on the PNC. If they were obliged to record an offence pursuant to the HOCR but were unable to record details of a suspect for proper police purposes, then that may prompt the exercise of their discretion to investigate and even prosecute in more cases. That would undermine the policy underlying Outcome 21, a key objective of which is to outline a proportionate response to reports of sexting between adolescent children and in turn reduce the potential over-criminalisation of children.[109]It is a quid pro quo of not pursuing or prosecuting a young person for sexting that any suspicion that he has committed a criminal offence will not be fully investigated or let alone determined. In those circumstances, as here, there will be evidential uncertainties that will not be clarified: for example, in addition to the differences between the account of the Claimant and the witnesses from the school in relation to the second incident, there are disparities between the accounts of the school witnesses in respect of both incidents and the Claimant has not responded to the report of the third incident. Those are matters which the Defendant will need to consider when deciding what to disclose on any application for an ECRC. Such uncertainties are inherent in any system in which the Defendant is encouraged to take the decision not to investigate incidents further, on account of the Claimant’s age.[110]In respect of the potential adverse effect of retention of the data on the Claimant, it is clear that the Claimant’s concern is not that his personal data are simply held by the police. His concern is that information will be disclosed on a request for an ECRC. However, that concern is nuanced: as we have described, an ECRC is sent, not to a potential employer, but to the individual who then hands it onto his employer if he wishes. If he is not content with the disclosure being made, then he can ask for a review and then challenge the matter before the Information Commissioner. There is therefore apparently no possibility of the information being disclosed without the Claimant’s consent, although: i) As the Claimant will not be able to obtain a job unless he provides a requested ECRC, whether his “consent” can be regarded as real may be questionable. ii) If he seeks to challenge the ECRC, that would take some time and any particular job which required an ECRC may in practice be lost; although, as we understand it, once an ECRC is obtained for a particular vulnerable group (e.g. children) it is transportable.[111]Of course, as the GDPR/DPA 2018 regime makes clear, the unnecessary processing of personal data is in itself to be avoided. However, in practice, the risk to the Claimant is that, at some point in the future, on an application for an ECRC, despite the guidance which he has, a chief police officer will wrongly conclude that one or both of the two incidents should be disclosed (albeit in neutral terms) in an ECRC; and the Claimant would lose the opportunity of a job whilst he challenged that inclusion.[112]Looking at the evidence now, do the public interest considerations justify the retention of the personal information of the Claimant against the sexting incidents in the two crime reports? We consider that they do. As we have described, we consider that the interference with the Claimant’s right to privacy is modest; and, whilst even the most modest interference requires justification, in our view, in this case, the retention of the information in respect of each incident is well-justified. As Det Supt Rawlinson’s rationale for her decision to retain the information concerning the second incident emphasised, the three reports (if true) fit a pattern of behaviour in the Claimant that, over time, was increasingly serious – including, in the second incident, retransmission of a girl’s sexts to a third party; and, in the third incident, reported coercion. Even with the “evidential” issues Ms Weston has so forcefully put forward, and even on the basis that the Claimant is a child and his best interests are clearly in having the data deleted, we consider the balance firmly falls on the side of the public interest in retention. In coming to that view, like Det Supt Rawlinson, we have taken into account, not only the best interests of the Claimant as a child, but also the interests of the other young people actually or potentially involved, including A, B and C and potential victims of other any further sexting incidents involving the Claimant that might occur in the future.[113]Ms Weston challenged Det Supt Rawlinson’s use of the evidence with regard to the third incident in concluding that the Claimant’s data in relation to the second incident should be retained. Although Det Supt Rawlinson considered whether the second incident was properly recorded as a crime, she was primarily concerned with the question of whether, in the light of article 8 and the UNCRC, the data should be retained. She concluded, as have we, that it was proportionate to retain the information. Given that she was assessing proportionality on the basis of what might happen in the future – i.e. risk – we see no difficulty in her considering that risk on the basis of current evidence. Indeed, she was right to do so.[114]Insofar as Ms Weston submitted that the lawfulness of the earlier decision to record the Claimant’s information and then retain should be considered only on the basis of the information that was available to the decision-maker at the time, we consider that a somewhat academic point – because, even if made good, it would be open to the Defendant to re-record the crime now. In fact, the submission betrays an underlying weakness in the Claimant’s case – namely a failure to appreciate that it is a proper police purpose to collect such information as this to show possible patterns of behaviour. Because of that proper purpose, we consider the decision to record and retain the Claimant’s information in relation to the second incident was proportionate and otherwise lawful, on the evidence available at the time of those decisions. The case for its retention in the light of the alleged behaviour reported in relation to the third incident is, of course, the stronger.[115]For those reasons, we do not consider that any element of the Claimant’s case, in either claim, has been made good.

Disposal

[116]With regard to formal disposal, we shall order as follows: i) Claim No CO/3515/2016: We dismiss the claim for judicial review. ii) Claim No CO/1076/2018: We refuse permission to proceed on the article 6 ground. On the other grounds, we shall grant permission to proceed but, on the substantive judicial review, we dismiss them.

Cited in 2 later judgments