On Monday the Court of Appeal for England and Wales (Lords Justices Waller, Carnwath and Hughes) gave their decision in Chief Constable of Humberside Police and others v The Information Commissioner and the Secretary of State for the Home Department  EWCA Civ 1079, following a three-day hearing in June.
The Court of Appeal reversed a decision of the Information Tribunal to order the deletion from the police national computer (PNC) of details of five old criminal convictions (nb the Rehabilitation of Offenders Act 1974 makes provision for the disregarding of ‘spent’ convictions for various purposes). According to the Tribunal, the police didn’t have to keep conviction data on the PNC if it was no longer required for their core police operational purposes, rejecting evidence that the convictions had some value for those core purposes.
Said the Court of Appeal, the Tribunal’s concept of “core purposes” was misconceived. It was true that data controllers must specify the purpose for which data is retained. However, statute does not impose limitations as to the purposes for which data can be retained, so long as those purposes are lawful so that they comply with the first data protection principle (data must be processed fairly and lawfully). The police in this case had identified their data retention purposes in the public register and, according to the Court of Appeal, for all those registered purposes a complete record of convictions, spent and otherwise, was required. Accordingly the retention of the data was not excessive.
At the end of his concurring judgment, Hughes LJ had this to say:
“112. I fully understand the concern of the Commissioner at the combination of the extent of a comprehensive database of conviction information and the range of those who have access, directly or indirectly, to it. The greater concern is perhaps related to indirect access. The Tribunal was told in 2005, in a similar appeal (Chief Constable of West Yorkshire and others v Information Commissioner) that at that time approximately 2.6 million CRB [= Criminal Records Bureau, the body established to discharge the functions of the Secretary of State under Part V of the Police Act 1997] certificates were issued in a year and of those 90% or thereabouts enhanced. Some 13,000 organisations are, it would seem, entitled to seek such certificates. But this concern is with policy, and with what ought or ought not to be in the legislation, rather than with the application of the law as it stands. It is for Parliament, and not for the Commissioner alone, to consider any limitation on the indirect access of others to the contents of the PNC. I would respectfully agree that the time may well have come to review the accretions which there have been to the Rehabilitation of Offenders Act 1974 (Exceptions) Order. It currently includes amongst the exceedingly long list of those who must answer questions relating to spent convictions persons as diverse as those who wish to hold a National Lottery licence, or to be a doctor’s receptionist, dental nurse, steward at a football ground, or traffic officer designated under the Traffic Management Act 2000 as having the power to direct traffic. Given that it does not follow that old convictions will in fact be treated as a bar to such employment, it might nevertheless be thought that consideration of the ambit of the Order might be useful. There might also be a case for reviewing the rehabilitation periods applicable to offences, and extending some. There might well be a case for implementing section 56 Data Protection Act in order to prevent employers and others who are outside the Exceptions Order from in effect circumventing the Rehabilitation of Offenders Act. But none of this is for me; it is for Parliament. And it is not for the Commissioner to try to modify the effect of statute by construction of the data protection principles.
113. For the same reason I can understand why over the years the police and the Commissioner have actively discussed a so-called ‘step down’ regime, under which some information on the PNC would become available only to the police. This may have potential as a policy, although to my mind the criminal and family courts and child protection professionals engaged in working together with police officers would all need continued access to unexpurgated information. It would, however, require modification of the Rehabilitation of Offenders Act and of the Police Act 1997, which at present requires the police to provide the Secretary of State with everything in the record. Moreover, it would require immensely detailed programmes for organisation of the database: the March 2006 edition of the Retention Guidelines, which attempts the exercise, has 25 different categories of offender/outcome combination and no less than 200 pages of a closely-typed list of offences; yet it would still remove from the record convictions which would, for example, disqualify from jury service for life, and some which might plainly be relevant even many years later (for example wounding with intent, bigamy or importing Class A drugs). It would require, thirdly, as it seems to me at least, a method of accommodating fixed penalty notices as they are currently issued for offences which include not only public disorder but dishonesty. But again, if a workable and fair restricted access scheme can nevertheless be devised, this is not to be achieved through the Data Protection Act”.