QSA & Ors, R (On the Application Of) v National Police Chiefs' Council & Anor [2021] EWHC 272 (Admin)

“(1) It shall be an offence for a person aged 18 or over (whether male or female) persistently to loiter or solicit in a street or public place for the purpose of prostitution.”

“(2) A person guilty of an offence under this section shall be liable on summary conviction to a fine of an amount not exceeding level 2 on the standard scale, or, for an offence committed after a previous conviction, to a fine of an amount not exceeding level 3 on that scale.”

“(4) The Secretary of State may by regulations make provision for recording in national police records convictions for such offences as are specified in the regulations. (4A) In subsection (4) “conviction” includes— (a) a caution within the meaning of Part 5 of the Police Act 1997; and (b) a reprimand or warning given under section 65 of the Crime and Disorder Act 1998.” (a) a caution within the meaning of Part 5 of the Police Act 1997; and (b) a reprimand or warning given under section 65 of the Crime and Disorder Act 1998.”

“The purpose of this Guidance is to ensure that a consistent approach is taken by relevant and specified Chief Officers and others in relation to dealing with applications for the deletion of records from these three national police systems: • Police National Computer (PNC) • National DNA Database (NDNAD) • National Fingerprint Database (IDENT1)”

“1.5.5 Under this Guidance, PNC records are required to be retained until a person is deemed to have reached 100 years of age. However, Chief Officers can exercise their discretion, in exceptional circumstances, to delete records for which they are responsible, specifically those relating to non-court disposals e.g. adult simple cautions and conditional cautions as well as any ‘Event History’ owned by them on the PNC but only where the grounds for so doing have been examined and agreed. 1.5.6 Court convictions are not eligible for record deletion from the PNC under this process.”

“(1) It is unlawful for a public authority to act in a way which is incompatible with a Convention right. (2) Subsection (1) does not apply to an act if— (a) as the result of one or more provisions of primary legislation, the authority could not have acted differently; or (b) in the case of one or more provisions of, or made under, primary legislation which cannot be read or given effect in a way which is compatible with the Convention rights, the authority was acting so as to give effect to or enforce those provisions.” (a) as the result of one or more provisions of primary legislation, the authority could not have acted differently; or (b) in the case of one or more provisions of, or made under, primary legislation which cannot be read or given effect in a way which is compatible with the Convention rights, the authority was acting so as to give effect to or enforce those provisions.”

“the law must afford adequate legal protection against arbitrariness, and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise: Where the impugned measure is a discretionary power, (a) what is not required is an over-rigid regime which does not contain the flexibility which is needed to avoid an unjustified interference with a fundamental right and (b) what is required is that safeguards should be present in order to guard against overbroad discretion resulting in arbitrary, and thus disproportionate, interference with Convention rights. Any exercise of power that is unrestrained by law is not in accordance with the law.”

“It seems to me that the approach described is the correct approach. If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter. The examination of statistics relevant only to the question as to the risk of re-offending was not to the point. Furthermore the fact that the statistics actually showed that the risk was greater than with non-offenders is not something I would pray in aid. It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police. 44 I emphasise the word retention because if there is any basis for complaint by the data subjects in this case, it seems to me to relate to the fact that in certain circumstances this information will be disclosed, but that is because Parliament has made exceptions to the Rehabilitation of Offenders Act 1974. What is more, the circumstances in which there will be disclosure are circumstances in which the data subject would be bound to give the correct answer if he or she were asked. It is not as it seems to me the purpose of the 1998 Act to overrule the will of Parliament by a side wind.”

“A further argument was addressed to the tribunal on article 8 independently from the arguments on construction under the 1998 Act. I am not persuaded that article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure. Even if that were wrong, if my conclusions so far are right, the processing is in accordance with the law and necessary in a democratic society. I do not think any extra point arises by reference to article 8 on its own and I mean no disrespect in dealing with this aspect so shortly.”

“I find it unnecessary to reach a general conclusion on the relevance of article 8 to information about convictions. In the present context, in my view, it is enough to rely on the specific endorsement by the Directive of the concept of a complete register. That in my view makes it impossible to argue that the retention of information in such a register is in itself objectionable under the Convention.”

“It seems to me that the decisions which the chief officer of police is required to take by section 115(7) of the 1997 Act are likely to fall within the scope of article 8(1) in every case, as the information which he is considering has been stored in files held by the police. It follows that its disclosure is likely to affect the private life of the applicant in virtually every case.”

“The Court reiterates that both the storing of information relating to an individual’s private life and the release of such information come within the scope of Article 8 § 1”

“…it is clear that the state’s systematic collection and storage in retrievable form even of public information about an individual is an interference with private life. For that reason, I think that the Court of Appeal was right to hold (overruling the Divisional Court in Catt) that article 8.1 was engaged.”

“6. In April 2000 the girlfriend of the applicant’s son wished to leave Northern Ireland with the applicant’s ten-month old grandson and return to live in Australia following her separation from the applicant’s son. In order to try and force her son and his girlfriend to reconcile their differences, and in the hope that her grandson would not return to Australia, the applicant disappeared with her grandson at 6 p.m. on 19 April 2000 without the parents’ permission. The police were called and the child was returned unharmed on the morning of 21 April 2000. 7. The applicant was subsequently arrested for child abduction. At a police interview on 24 April 2000, in the presence of her solicitor, the applicant confirmed that she had been aware at the time that she took her grandson that her conduct amounted to child abduction. 8. By letter dated 10 October 2000 the Director of Public Prosecutions recorded his decision that the public interest did not require the initiation of criminal proceedings against the applicant and that no such proceedings should therefore be brought. Instead, he indicated that a caution should be administered.”

“The requirement that any interference must be “in accordance with the law” under Article 8 § 2 means that the impugned measure must have some basis in domestic law and be compatible with the rule of law, which is expressly mentioned in the preamble to the Convention and inherent in the object and purpose of Article 8. The law must thus be adequately accessible and foreseeable, that is, formulated with sufficient precision to enable the individual – if need be with appropriate advice – to regulate his conduct. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.”

“The Court considers it essential, in the context of the recording and communication of criminal record data as in telephone tapping, secret surveillance and covert intelligence-gathering, to have clear, detailed rules governing the scope and application of measures; as well as minimum safeguards concerning, inter alia, duration, storage, usage, access of third parties, procedures for preserving the integrity and confidentiality of data and procedures for their destruction, thus providing sufficient guarantees against the risk of abuse and arbitrariness (see S. and Marper, cited above, § 99, and the references therein). There are various crucial stages at which data protection issues under Article 8 of the Convention may arise, including during collection, storage, use and communication of data. At each stage, appropriate and adequate safeguards which reflect the principles elaborated in applicable data protection instruments and prevent arbitrary and disproportionate interference with Article 8 rights must be in place.”

“199. The Court recognises that there may be a need for a comprehensive record of all cautions, convictions, warnings, reprimands, acquittals and even other information of the nature currently disclosed pursuant to section 113B(4) of the 1997 Act. However, the indiscriminate and open-ended collection of criminal record data is unlikely to comply with the requirements of Article 8 in the absence of clear and detailed statutory regulations clarifying the safeguards applicable and setting out the rules governing, inter alia, the circumstances in which data can be collected, the duration of their storage, the use to which they can be put and the circumstances in which they may be destroyed”

“The Court reiterates that there is no statutory law in respect of Northern Ireland which governs the collection and storage of data regarding the administration of cautions. Retention of such data is carried out pursuant to the common law powers of the police, in accordance with the general principles set out in the Data Protection Act. In the absence of any statutory provisions, a number of policy documents which apply in Northern Ireland have been identified by the Government (see paragraphs 33-46 above). As noted above, it is clear from the MOPI Guidance and the ACPO Guidelines that the recording and initial retention of caution data are intended in practice to be automatic. While reference is made in the MOPI Guidance to a review of retention after a six-year period, the criteria for review appear to be very restrictive. The Guidance notes that there is a presumption in favour of retention and the review schedule requires police to retain data in the category of “Certain Public Protection Matters” until the data subject is deemed to have reached one hundred years of age, regardless of the type or classification of data or grade of the intelligence concerned (see paragraphs 39-40 above). Any review in such cases seems intended to focus on whether the data are adequate and up to date. Pursuant to the ACPO Guidelines, it appears that data held in central police records are now automatically retained, regardless of the seriousness of the offence in question, until the person is deemed to have reached one hundred years of age. The ACPO Guidelines themselves explain that they are based on a format of restricting access to data, rather than deleting them. While deletion requests can be made under the ACPO Guidelines, they should only be granted in exceptional circumstances (see paragraphs 43-46 above). As noted above the examples given as to what constitute exceptional circumstances do not suggest a possibility of deletion being ordered in any case where the data subject admits having committed an offence and the data are accurate.”

“The cumulative effect of these shortcomings is that the Court is not satisfied that there were, and are, sufficient safeguards in the system for retention and disclosure of criminal record data to ensure that data relating to the applicant’s private life have not been, and will not be, disclosed in violation of her right to respect for her private life. The retention and disclosure of the applicant’s caution data accordingly cannot be regarded as being in accordance with the law.”

“29 But for the decision of the ECtHR on 13 November 2012 in MM v United Kingdom … to which I will turn at para 35 below, there is in my view little reason to doubt that the issue of the certificates and the imposition of the obligations on T were, at any rate, in accordance with law… 35…It is hard to see how absence of review can affect either the accessibility or the precision of the legislation although, if safeguards against arbitrariness are a free-standing aspect of the principle, it might arguably qualify in that regard. But in my view the court’s third and final point, namely its powerful criticism of the failure of the regime under [the Police Act 1997] to regulate disclosure by reference to the circumstances of the caution, clearly addresses its proportionality and thus the necessity, as opposed to the legality, of the interference. Then in para 207 the court concluded that the consequence of these three points was an absence of safeguards which precipitated a violation of the grandmother’s rights and that accordingly the retention and disclosure of the information about her caution were not in accordance with law. So, although – significantly - the grandmother had not even disputed that the interference was in accordance with law (para 192), the court reached its determination on that basis and therefore without any reference to the margin of appreciation.”

“113 … Put shortly, legislation which requires the indiscriminate disclosure by the state of personal data which it has collected and stored does not contain adequate safeguards against arbitrary interferences with article 8 rights. 114 This issue may appear to overlap with the question whether the interference is necessary in a democratic society: a question which requires an assessment of the proportionality of the interference. These two issues are indeed inter-linked, as I shall explain, but their focus is different. Determination of whether the collection and use by the state of personal data was necessary in a particular case involves an assessment of the relevancy and sufficiency of the reasons given by the national authorities. In making that assessment, in a context where the aim pursued is likely to be the protection of national security or public safety, or the prevention of disorder or crime, the court allows a margin of appreciation to the national authorities, recognising that they are often in the best position to determine the necessity for the interference. As I have explained, the court’s focus tends to be on whether there were adequate safeguards against abuse, since the existence of such safeguards should ensure that the national authorities have addressed the issue of the necessity for the interference in a manner which is capable of satisfying the requirements of the Convention. In other words, in order for the interference to be in accordance with the law, there must be safeguards which have the effect of enabling the proportionality of the interference to be adequately examined. Whether the interference in a given case was in fact proportionate is a separate question. (Emphasis added.)”

“119 In the light of the judgment in MM v United Kingdom, it is plain that the disclosure of the data relating to the respondent’s cautions is an interference with the right protected by article 8.1. The legislation governing the disclosure of the data, in the version with which these appeals are concerned, is indistinguishable from the version of Part V of the 1997 Act which was considered in MM. That judgment establishes, in my opinion persuasively, that the legislation fails to meet the requirements for disclosure to constitute an interference in accordance with the law. That is so, as the court explained in MM, because of the cumulative effect of the failure to draw any distinction on the basis of the nature of the offence, the disposal in the case, the time which has elapsed since the offence took place or the relevance of the data to the employment sought, and the absence of any mechanism for independent review of a decision to disclose data under section 113A.”

“concerned the disclosure of information from police records under the Police Act 1997 to potential employers and regulatory bodies, as a result of which the complainants were unable to obtain employment involving contact with children or vulnerable adults ... Since these disclosures were required by statute, the provisions of the Data Protection Act 1998 restricting their disclosure had no application: see section 35(1) of that Act. In MM, the European Court of Human Rights held that disclosure in accordance with sections 113A and 113B was not in accordance with the law because it was mandatory. The relevant provisions involved no rational assessment of risk and contained no safeguards against abuse or arbitrary treatment of individuals. In T, the Supreme Court, on materially indistinguishable facts, applied the same principle. The present appeals, however, come before us on a very different basis. There has been no disclosure to third parties, and the prospect of future disclosure is limited by comprehensive restrictions. It is limited to policing purposes, and is subject to an internal proportionality review and the review by the Information Commissioner and the courts. 16 In MM, the Strasbourg court criticised the generous approach of the law of the United Kingdom to the exercise of police power to retain personal data even before disclosure: para 170. It does not, however, follow from these criticisms that retention of personal data in the United Kingdom is not in accordance with the law. In the first place, at the time which was relevant to the applicant’s complaint in MM, challenges to the retention of data were seriously inhibited by the decisions of the House of Lords in R (S) v Chief Constable of the South Yorkshire Police [2004] 1 WLR 2196, which concerned the statutory power of the police to retain DNA profiles taken from persons who had been arrested but who were subsequently acquitted or not prosecuted, and the Court of Appeal in Chief Constable of Humberside Police v Information Comr (Secretary of State for the Home Department intervening) [2010] 1 WLR 1136, which concerned the retention of records of minor convictions. In both cases, the courts had doubted whether article 8 of the Convention was even engaged, but on the footing that it was engaged considered that the interference with private life was minor and justified. Things have moved on since then. There is no longer any doubt about the application of article 8 to the systematic retention of processable personal data, and the test of justification has become more exacting since the decision of the Strasbourg court in S v United Kingdom 48 EHRR 1169. The decisions of this court in R (GC) v Comr of Police for the Metropolis (Liberty intervening) [2011] 1 WLR 1230 and R (L) v Comr of Police of the Metropolis (Secretary of State for the Home Department intervening) [2010] 1 AC 410 were important milestones. Secondly, the purpose for which the rules and practices about data retention were reviewed by the Strasbourg court in MM was not to ascertain the legality of the retention but to assess the adequacy of domestic remedies having regard to the applicants alleged failure to exhaust them before petitioning the Strasbourg court. Thirdly, it is clear that the retention of the data in MM was relevant not so much in itself as because it exposed the applicant to future disclosure. The problem with which the Strasbourg court was concerned was that once the data were entered into the system, there was no way of preventing their disclosure under the mandatory provisions of the Police Act. It followed that the only legal protection against disclosure consisted in the restrictions on the obtaining or retention of the data in the first place. The point is well captured in the court’s conclusion, at para 207... 17 In my opinion, the retention of data in police information systems in the United Kingdom is in accordance with law. The real question on these appeals is whether the interference with the respondents article 8 rights was proportionate to the objective of maintaining public order and preventing or detecting crime. For this purpose, it is necessary to look separately at the two cases before us, for the relevant considerations are very different.” (Emphasis added.)

“I too agree that the systematic collection and retention of information about Mr Catt and Ms T constitutes an interference with their right to respect for their private life protected by article 8, even though, in the case of Mr Catt, the information collected related to his activities in public. I also agree that, as Lord Sumption JSC has explained, the combination of the requirements of the Data Protection Act 1998, coupled with the Code of Practice issued by the Secretary of State under the Police Act 1996 and the detailed Guidance on the Management of Police Information issued by the Association of Chief Police Officers, provided sufficient protection against arbitrary police behaviour, so that the collection and retention of this information was in accordance with the law for the purpose of article 8.2 of the Convention.”

“The accessibility test speaks for itself. For a measure to have the quality of law, it must be possible to discover, if necessary with the aid of professional advice, what its provisions are. In other words, it must be published and comprehensible. The requirement of foreseeability, so far as it adds to the requirement of accessibility, is essentially concerned with the principle summed up in the adage of the American founding father John Adams, a government of laws and not of men. A measure is not in accordance with the law if it purports to authorise an exercise of power unconstrained by law. The measure must not therefore confer a discretion so broad that its scope is in practice dependent on the will of those who apply it, rather than on the law itself. Nor should it be couched in terms so vague or so general as to produce substantially the same effect in practice. The breadth of a measure and the absence of safeguards for the rights of individuals are relevant to its quality as law where the measure confers discretions, in terms or in practice, which make its effects insufficiently foreseeable. Thus a power whose exercise is dependent on the judgment of an official as to when, in what circumstances or against whom to apply it, must be sufficiently constrained by some legal rule governing the principles on which that decision is to be made. But a legal rule imposing a duty to take some action in every case to which the rule applies does not necessarily give rise to the same problem. It may give rise to a different problem when it comes to necessity and proportionality, but that is another issue. If the question is how much discretion is too much, the only legal tool available for resolving it is a proportionality test which, unlike the test of legality, is a question of degree.”

“The pre-2008 position in Northern Ireland as regards cautions was an obvious example of unconstrained discretionary power. For present purposes, however, the judgment is mainly of interest for its treatment of the position in Northern Ireland after April 2008 under the Police Act 1997. MM contended that the caution should have been deleted so as not to be available for disclosure under the new regime. The court recorded (para 195) its view that article 8 was engaged by the whole process of collection, retention, use and disclosure of data on police files. It recognised (para 199) that there may be a need for a comprehensive record of all cautions, conviction, warnings, reprimands, acquittals and even other information of the nature currently disclosed pursuant to section 113B(4) of the 1997 Act. However, as the court went on to observe at para 200: the greater the scope of the recording system, and thus the greater the amount and sensitivity of data held and available for disclosure, the more important the content of the safeguards to be applied at the various crucial stages in the subsequent processing of the data. In other words, the considerations that were relevant to each of the three stages were interrelated, because the greater the volume or significance of the data retained, the more important it was to restrict its disclosure. It followed that for the statutory scheme to have the quality of law, it was not enough that the circumstances in which disclosure was authorised were sufficiently defined by law. This merely pushed the issue back to the earlier stages of collection and storage of data. In R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland (Equality and Human Rights Commission intervening) [2015] AC 1065, para 15, I suggested that the Strasbourg court in MM had found disclosure of convictions under section 113A and 113B of the 1997 Act not to be in accordance with law because it was mandatory. It would have been more accurate to say that it was because its mandatory disclosure meant that the scheme as a whole was not in accordance with law, which is the third point made at para 16. If collection and retention continued to be subject to an unconstrained discretion, the result was that the bank of data available for mandatory disclosure was variable according to the judgment of the police and did not have the necessary quality of foreseeability.”

“MM was treated as authority for the following proposition: As the court has recalled the expression in accordance with the law not only requires the impugned measure to have some basis in domestic law, but also refers to the quality of the law in question, requiring that it should be accessible to the person concerned and foreseeable as to its effects. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope and discretion conferred on the competent authorities and the manner of its exercise (see, among other authorities, MM … para 193, with further references). In other words, an excessively broad discretion in the application of a measure infringing the right of privacy is likely to amount to an exercise of power unconstrained by law. It cannot therefore be in accordance with law unless there are sufficient safeguards, exercised on known legal principles, against the arbitrary exercise of that discretion, so as to make its application reasonably foreseeable.” (Emphasis added)

“it is hardly conceivable that Lord Reed JSC intended to effect a revolution in this branch of the law, with such far-reaching results, and without acknowledging the fact. On the contrary, it is clear that he did not. He regarded himself as applying the established case law of the Strasbourg court” which had been based on “the classic dual test of accessibility and foreseeability.”

“In a precedent-based system, the reasoning of judges has to be approached in the light of the particular problem which was before them. There is a danger in treating a judge’s analysis of that problem as a general statement of principle applicable to a whole area of law. Lord Reed JSCs observations in T cannot inmy opinion be applied generally to the whole relationshipbetween legality and proportionality in the Convention, even incases where the relevant domestic rule satisfied the tests ofaccessibility and foreseeability. It is noticeable that the principle of legality was stated in narrower terms by Baroness Hale DPSC, Lord Reed and Lord Hodge JJSC in their joint judgment in

“The principles to be derived from the Strasbourg cases were to my mind accurately summarised in the joint judgment of Lord Reed, Lord Hodge JJSC and myself in Christian Institute v Lord Advocate 2017 SC (UKSC) 29, at paras 79–80, cited and agreed with by Lord Sumption at para 41 above. The foundation of the principle of legality is the rule of law itself—that people are to be governed by laws not men. They must not be subjected to the arbitrary—that is, the unprincipled, whimsical or inconsistent— decisions of those in power. This means, first, that the law must be adequately accessible and ascertainable, so that people can know what it is; and second, that it must be sufficiently precise to enable a person—with legal advice if necessary— to regulate his conduct accordingly. The law will not be sufficiently predictable if it is too broad, too imprecise or confers an unfettered discretion on those in power. This is a separate question from whether the law in question constitutes a disproportionate interference with a Convention right—but the law in question must contain safeguards which enable the proportionality of the interference to be adequately examined. This does not mean that the law in question has to contain a mechanism for the review of decisions in every individual case: it means only that it has to be possible to examine both the law itself and the decisions made under it, to see whether they pass the test of being necessary in a democratic society.” (Emphasis added)

“The criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings: see section 7(2)(a). There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown. (a) It is the duty of the Crown to place before any sentencing court a complete record of previous convictions of the defendant. By section 143(2) of the Criminal Justice Act 2003, a previous conviction is to be treated as aggravating the offence if it reasonably can be. A court may of course disregard an old conviction and often will, but it may be wrong to do so. Certainly there ought often to be a real difference between sentencing a person who has never before offended and sentencing one who has, perhaps similarly, albeit many years previously. The court must be in a position to make an informed decision. (b) There is an obligation on the Crown to reveal to the defence any convictions of any witness on whom it relies. That does not mean that the conviction can automatically be put in evidence by the defendant, but it enables the court to give proper consideration to any application under section 100 of the Criminal Justice Act 2003 to do so. Similarly, it will sometimes happen that it is relevant to challenge a witness called on behalf of the defendant on the basis of his record, especially for example if he has professed to a respectability which he does not enjoy. These simple, non-exhaustive, examples demonstrate how the common coin of the criminal court depends upon access by the court, through the prosecution and thus through the PNC, to a reliable and comprehensive record of convictions and their circumstances. Such records as might be pieced together from multiple courts, or from the historical files of diverse prosecuting authorities, would be no kind of substitute, and it is in any event highly undesirable that there should be multiple databases, with the inevitable concomitant risks of duplication of effort, inconsistency and reduced security. The criminal justice system thus depends on the maintenance of the PNC. If the PNC is not complete, the court can never know of a relevant old conviction. The Secretary of State for Justice expressed the view in this case that “providing anything less than full information to the courts would potentially undermine the criminal justice process”

“The criminal record of defendants (and even non-defendant witnesses) has potential relevance at various stages of criminal proceedings from the very beginning of the prosecution case, through plea and allocation, bail, evidence at trial, and sentencing. A person’s previous convictions thereafter continue to have relevance for parole and probation.”

“Even seemingly “minor” aged convictions (including out of court disposals) can provide an invaluable policing tool for the prevention and detection of crime. Small details of information about the convictions are capable of establishing modi operandi and making it easier for the police service to make the necessary connections to bring offenders to justice.”

“due diligence checks are performed which include examining records on the PNC. Any criminality the individual has been or is involved in is used to enable a full and complete risk assessment, including that of risk to the potential CHIS, of any recruiting activity to be taken. CHIS recruitment could take place at any age, that individual’s full criminal record including historical convictions is needed to enable officers be cognisant of all the risks associated with a CHIS and if needed, put the correct mitigations in place. The absence of such information would lead to an increased risk to officers, the CHIS, operations and enhance the likelihood of mission failure.”

“The UK is aligning with EU Regulation 2019/103 which requires all airport and air crew identity card holders to go through an ongoing review of their criminal record checks. The UK Government will carry out this ongoing review at least once every twelve months, using data from the PNC. …. The Civil Aviation Authority (“CAA”) accesses PNC data to identify those who have been convicted of a disqualifying offence and can remove individual’s passes where necessary, helping to reduce the risk of insider threat. ”

“A criminal record is not necessarily a bar to security clearance, but a decision maker will need to consider both spent and unspent convictions to consider whether any conviction is relevant to their assessment of suitability… Failure to declare convictions may be taken as evidence of dishonesty and unreliability and may affect the granting of a security clearance.”

“the benefits to the public of retaining the DNA profiles of those who are convicted are potentially very considerable and outweigh the infringement of the right of the person concerned under article 8.”

“the indiscriminate nature of the powers of retention of the DNA profile, fingerprints and photograph of the applicant as person convicted of an offence, even if spent, without reference to the seriousness of the offence or the need for indefinite retention and in the absence of any real possibility of review, failed to strike a fair balance between the competing public and private interests. The Court recalls its finding that the State retained a slightly wider margin of appreciation in respect of the retention of fingerprints and photographs. However, that widened margin is not sufficient for it to conclude that the retention of such data could be proportionate in the circumstances, which include the lack of any relevant safeguards including the absence of any real review”

“The purpose of maintaining a complete record of convictions is not negated by showing in an individual case that one or more particular pieces of information is of no identifiable utility.”