CASE OF M.M. v. THE UNITED KINGDOM
Preliminary objection dismissed (Article 35-1 - Effective domestic remedy);Violation of Article 8 - Right to respect for private and family life (Article 8-1 - Respect for private life)
George Nicolaou;Lech Garlicki;Ledi Bianku;Nebojša Vučinić;Nicolas Bratza;Päivi Hirvelä;Vincent A. De Gaetano
5. The applicant was born in 1951 and lives in County Tyrone, Northern Ireland. 6. In April 2000 the girlfriend of the applicant’s son wished to leave Northern Ireland with the applicant’s ten-month old grandson and return to live in Australia following her separation from the applicant’s son. In order to try and force her son and his girlfriend to reconcile their differences, and in the hope that her grandson would not return to Australia, the applicant disappeared with her grandson at 6 p.m. on 19 April 2000 without the parents’ permission. The police were called and the child was returned unharmed on the morning of 21 April 2000. 7. The applicant was subsequently arrested for child abduction. At a police interview on 24 April 2000, in the presence of her solicitor, the applicant confirmed that she had been aware at the time that she took her grandson that her conduct amounted to child abduction. 8. By letter dated 10 October 2000 the Director of Public Prosecutions recorded his decision that the public interest did not require the initiation of criminal proceedings against the applicant and that no such proceedings should therefore be brought. Instead, he indicated that a caution should be administered. 9. The applicant received a caution for child abduction which was formally administered on 17 November 2000. 10. On 6 March 2003, in reply to a query from the applicant, the police advised her that her caution would remain on record for five years, and so would be held on record until 17 November 2005. 11. On 14 September 2006 the applicant was offered employment as a Health Care Family Support Worker within Foyle Health and Social Services Trust (“the Trust”) through Westcare Business Services (“Westcare”), subject to vetting. She was asked to disclose details of prior convictions and cautions. She accordingly disclosed details of the incident of April 2000 and her subsequent caution on the form provided, and consented to a criminal record check. Westcare contacted the Criminal Records Office of the Police Service of Northern Ireland (“Criminal Records Office”) to verify the details disclosed. The existence of the caution was duly verified. 12. On 31 October 2006 Westcare withdrew the offer of employment, indicating that it had taken into account the verification by the Criminal Records Office of the caution for child abduction. 13. The applicant subsequently sought to challenge her acceptance of the caution in November 2000 by letter to the Criminal Records Office. In an undated letter, the Criminal Records Office replied to her in the following terms: “... in a case where someone agrees to be cautioned by the police for a particular offence, by doing so they are accepting that they were guilty of the offence in the first place. This information is printed on the caution form, which you signed on 17th November 2000. Regrettably there is no way to change that. The case cannot be brought back to a court because the whole idea of the caution was to keep it out of court in the first instance. I should also point out that the information given to Sgt Dunne and which he relayed to you in 2003, about the weeding date for an adult caution, was correct at that time but there has since been a policy change. Normally an adult caution will be weeded after a period of five years, provided the defendant has not been convicted of any further offences. However following the murder of the schoolgirls in Soham England and the subsequent Bichard Report the weeding policy was changed in relation to all cases where the injured party is a child. The current policy is that all convictions and cautions, where the injured party is a child, are kept on the record system for life.” 14. The letter concluded: “I fully appreciate that the offence in your case was not the normal type of offence and that the child did not suffer any harm and that it was never your intention that he should suffer any harm. The offence code under which the offence comes for computing purposes classes the offence as ‘child abduction’ (by other person). Which means a person other than a parent of the child. ... Perhaps you would be good enough to contact me ... in order that we might discuss the matter and perhaps find some means of ameliorating the consequences of the information given above.” 15. By letter dated 6 May 2006 to the applicant’s solicitor, the Criminal Records Office confirmed that in signing the caution form the applicant had accepted guilt for the offence in question and that nothing could be done to change the criminal record. The applicant’s solicitor subsequently informed her that there did not appear to be any action which she could take in relation to the removal of the caution. 16. By letter dated 6 December 2006 Detective Superintendent Thomson of the Northern Ireland Police Service confirmed that he would not delete the caution from police records. However he proposed, with the applicant’s agreement, to add a comment to the effect that the incident was domestically related and that in any vetting context the applicant should be approached for an explanation. 17. In January 2007 the Northern Ireland Legal Services Commission (“the LSC”) refused an application for legal aid, made by the applicant’s solicitor, to review the Trust’s decision not to employ the applicant. The solicitor informed the applicant that she could appeal the LSC’s decision at a cost of GBP 500 for representation by counsel, but the applicant could not afford to instigate legal proceedings without public funding. 18. In February 2007 the applicant was interviewed for a position as a Family Support Worker. The interview letter advised that the position was a regulated one under Article 31 of the Protection of Children and Vulnerable Adults (Northern Ireland) Order 2003 and she was asked to complete a consent form and bring it to the interview. 19. On 29 March 2007 the applicant was informed that her application for the position was unsuccessful. No reasons were provided. 20. At the relevant time the purpose of a formal caution was set out in Police Force Order no. 9/96 issued by the Royal Ulster Constabulary, namely: “(a) to deal quickly and simply with less serious offenders; (b) to divert offenders in the public interest from appearance in the criminal courts; and (c) to reduce the likelihood of re-offending.” 21. The Order further noted: “... a formal caution is not a form of sentence ... (a) A formal caution is nonetheless a serious matter. It is recorded by police; it may be relevant in relation to future decisions as to prosecution, and it may be cited in any subsequent criminal prosecutions. Properly used, caution is an effective form of disposal. ...” 22. Article 29(4) of the Police and Criminal Evidence (Northern Ireland) Order 1989 (as subsequently amended) provides that: “... the Secretary of State may by regulations make provision for recording in police records convictions for such offences as are specified in the regulations.” 23. The regulations made by the Secretary of State under this provision are the Northern Ireland Criminal Records (Recordable Offences) Regulations 1989. These regulations identify the relevant convictions as being those for offences punishable by imprisonment, as well as a number of additional specified offences. The regulations do not make any reference to cautions. 24. According to the Government, the recording of cautions in Northern Ireland takes place under the police’s common law powers to retain and use information for police purposes. That power is subject to the provisions of the Data Protection Act 1998 (see generally paragraphs 65-71 below). 25. According to the Government, the policy and practice of the Police Service in Northern Ireland (“PSNI”) at the time of the issue of the applicant’s caution in 2000 was to delete cautions from the individual’s criminal record after five years. 26. However, following publication of the Bichard Report in 2006 (see paragraphs 31-32 below), the PSNI changed its practice so as to retain information on adult cautions for the rest of a person’s life. 27. The chief constable of PSNI is a member of the Association of Chief Police Officers of England and Wales and Northern Ireland (“ACPO”). 28. Pursuant to the ACPO Code of Practice 1995 (“the 1995 ACPO Code”), in cases of conviction for an offence that carried the possibility of imprisonment, a record of the conviction had to be retained for a period of twenty years. Exceptions to this included cases where the conviction was for an offence against a child or young person, where the record was to be retained until the offender was 70 years old, subject to a minimum 20-year retention period; and cases involving rape, where the record was to be retained for the life of the offender. 29. Records of cautions (assuming there were no other convictions or further cautions) were to be retained for a five-year period. 30. The 1995 ACPO Code was updated in 1999 and subsequently replaced by another code of practice in 2002. Neither instrument substantially altered the provisions regarding retention of data relating to cautions. 31. Following the murders of two young girls in August 2002 by a caretaker employed at a local school, a review of the United Kingdom’s police forces was announced by the Home Secretary. An inquiry was set up, to be conducted by Sir Michael Bichard. 32. The Bichard Inquiry Report (“the Bichard report”) was published in June 2004. It reviewed current practice as regards retention of data on convictions and cautions and concluded (at paragraph 4.41) that “there were a number of problems with the review, retention or deletion of records.” The report recommended that: “A Code of Practice should be produced covering record creation, review, retention, deletion and information sharing. This should be made under the Police Reform Act 2002 and needs to be clear, concise and practical. It should supersede existing guidance.” 33. In July 2005 the Secretary of State adopted a Code of Practice on the Management of Police Information (“the 2005 Code of Practice”). The Code applies directly to police forces in England and Wales and is available for adoption by other police forces. The Government did not clarify whether the Code has been adopted by the PSNI. 34. Paragraph 1.1.1 of the Code explains that police forces have a duty to obtain and use a wide variety of information, including personal information. The Code clarifies that responsibility for the management and use of information lies with the chief officer of the police force. It recognises the existing legislative framework for the management of information relating to data protection and human rights set out in the Data Protection Act (see paragraph 65-71 below). 35. The Code sets out a number of key principles including, inter alia, the duty to obtain and manage information; the importance of recording information considered necessary for a police purpose; and the need to review information and consider whether its retention remains justified, in accordance with any guidance issued. 36. In 2006 ACPO published Guidance on the Management of Police Information. This Guidance was applied by the PSNI. A second edition was published in 2010 (“the MOPI Guidance”), and is also applied by the PSNI. 37. Chapter 7 of the MOPI Guidance deals with review, retention and disposal of police information not contained on the Police National Computer (“PNC”). The PNC is the system for recording conviction data in England and Wales; the Causeway system is used in Northern Ireland. The MOPI Guidance notes at the outset that: “7.2.1 ... Public authorities, including police forces, must act in a way that complies with the European Convention on Human Rights (ECHR) and the Human Rights Act 1998. In relation to record retention this requires a proportionate approach to the personal information held about individuals. The decision to retain personal records should be proportionate to the person’s risk of offending, and the risk of harm they pose to others and the community. A higher proportionality test should be met in order to retain records about relatively minor offending.” 38. The MOPI Guidance also refers to the need to comply with the principles of the Data Protection Act (see paragraph 65-71 below). 39. The MOPI Guidance sets out the framework for decision-making in respect of retention of police information. It provides that records should be kept for a minimum period of six years, beyond which time there is a requirement to review whether retention of the information remains necessary for a policing purpose. Relevant questions are whether there is evidence of a capacity to inflict serious harm, whether there are concerns relating to children or vulnerable adults, whether the behaviour involved a breach of trust, whether there is evidence of links or associations which might increase the risk of harm, whether there are concerns as to substance misuse and whether there are concerns that an individual’s mental state might increase the risk. In any review, the MOPI Guidance notes that there is a presumption in favour of retention of police information provided that it is not excessive, is necessary for a policing purpose, is adequate for that purpose and is up to date. 40. The MOPI Guidance also contains a review schedule based on the seriousness of offences. Under the review schedule, information is divided into four categories. Group 1 is called “Certain Public Protection Matters”, which includes information relating to individuals who have been convicted, acquitted, charged, arrested, questioned or implicated in relation to murder or a serious offence as specified in the Criminal Justice Act 2003 (or historical offences that would be charged as such if committed today). Such information should only be disposed of if it is found to be entirely inaccurate or no longer necessary for policing purposes. The MOPI Guidance continues: “Forces must retain all information relating to certain public protection matters until such time as a subject is deemed to have reached 100 years of age (this should be calculated using the subject’s date of birth). There is still a requirement, however, to review this information regularly to ensure that it is adequate and up to date. This must be done every ten years ... Due to the seriousness of this group, no distinction is made between the type or classification of information that can be retained for 100 years; information retained under this grouping can include intelligence of any grading. There may be extreme cases where the retention of records relating to certain public protection matters would be disproportionately injurious to the individual they are recorded against. For example, an individual arrested on suspicion of murder for a death that is subsequently found to have been the result of natural causes, or an entirely malicious accusation that has been proven as such, would both generate records that can only be adequate and up to date if they reflect what actually happened. Particular care must be exercised in disclosing any such records to avoid unnecessary damage to the person who is the subject of the record.” 41. The other categories are “Other Sexual, Violent or Serious Offences (Group 2), in respect of which information should be retained for as long as the offender or suspected offender continues to be assessed as posing a risk of harm; “All Other Offences” (Group 3), in respect of which police forces may choose to use a system of time-based, automatic disposal if it is considered that the risk of disposal is outweighed by the administrative burden of reviewing the information or the cost of retaining it; and “Miscellaneous” (Group 4), which covers a variety of other cases and entails different guidance on retention in each one. 42. The ACPO Retention Guidelines for Nominal Records on the Police National Computer 2006 (“the ACPO Guidelines”) came into effect on 31 March 2006. The ACPO Guidelines form part of the guidance issued under the MOPI Code and are applied by PSNI. 43. The ACPO Guidelines explain that: “1.3 The Retention Guidelines are based on a format of restricting access to PNC data, rather than the deletion of that data. The restriction of access is achieved by setting strict time periods after which the relevant event histories will ‘step down’ and only be open to inspection by the police. Following the ‘step down’ other users of PNC will be unaware of the existence of such records, save for those occasions where the individual is the subject of an Enhanced Check under the Criminal Records Bureau vetting process ... ” 44. They continue: “2.8 ...the Nominal records will now contain ‘Event Histories’ to reflect the fact that the subject may have been Convicted (including cautions, reprimands and warnings), dealt with by the issue of a Penalty Notice for Disorder, Acquitted, or dealt with as a ‘CJ Arrestee’ [a person who has been arrested for a recordable offence under the Criminal Justice Act 2003 but in respect of whom no further action was taken].” 45. The general principle set out in paragraph 3.1 of the ACPO Guidelines is that when a nominal record is created or updated on the PNC by virtue of an individual being convicted, receiving a Penalty Notice for Disorder, being acquitted or being a CJ Arrestee, the record will contain the relevant personal data together with details of the offence which resulted in the creation of the record. The record will be retained on PNC until that person is deemed to have attained 100 years of age. 46. Paragraph 4.32 of the ACPO Guidelines clarifies that chief officers are the “data controllers” (within the meaning of the Data Protection Act 1998 – see paragraphs 65-71 below) of all PNC records, including DNA and fingerprints associated with the entry, created by their forces and that they have the discretion in exceptional circumstances to authorise the deletion of any such data. Appendix 2 of the ACPO Guidelines outlines the procedure to be followed in deciding whether a particular case will be regarded as “exceptional” and states: “Exceptional cases by definition will be rare. They might include cases where the original arrest or sampling was found to be unlawful. Additionally, where it is established beyond reasonable doubt that no offence existed, that might, having regard to all the circumstances, be viewed as an exceptional circumstance.” 47. According to the Government, from the date on which the caution was administered to the applicant until 1 April 2008, requests for disclosure of criminal record data in Northern Ireland were made on a consensual basis. Disclosure took place in accordance with well-established common law powers of the police for police purposes only. 48. Part V of the Police Act 1997 (“the 1997 Act”) now sets out the legislative framework for the disclosure of criminal record information in Northern Ireland. The relevant provisions entered into force in Northern Ireland on 1 April 2008. 49. Section 113A deals with criminal record certificates (“CRCs”). Section 113A(3) defines a CRC as follows: “A criminal record certificate is a certificate which– (a) gives the prescribed details of every relevant matter relating to the applicant which is recorded in central records, or (b) states that there is no such matter.” ...” 50. Section 113A(6) defines “central records” as such records of convictions and cautions held for the use of police forces generally as may be prescribed. In Northern Ireland, the relevant records are prescribed in the Police Act 1997 (Criminal Record) (Disclosure) Regulations (Northern Ireland) 2008 as information in any form relating to: convictions held in the criminal history database of the Causeway System; and convictions and cautions on a names index held by the National Police Improvement Authority for the use of police forces generally. The term “relevant matter” is defined in section 113A(6) of the 1997 Act as including “spent” convictions and cautions (see paragraphs 61-64 below). Pursuant to section 65(9) of the Crime and Disorder Act 1998 , the reference to a “caution” in section 113A is to be construed as including warnings and reprimands. 51. The Secretary of State must issue a CRC to any individual who makes an application in the prescribed manner and form and pays the prescribed fee. The application must be countersigned by a registered person and accompanied by a statement by the registered person that the certificate is required for the purposes of an exempted question. Section 113A(6) defines “exempted question” as follows: in respect of a conviction, a question which the Secretary of State has by order excluded from the provisions on “spent” convictions under the 1974 Act or the 1978 Order; and in respect of a caution, a question which the Secretary of State has by order excluded from the provisions on “spent” cautions under the 1974 Act; as noted above there is no corresponding provision in Northern Ireland. In respect of Northern Ireland, the Secretary of State subsequently made an order excluding the provisions on “spent” convictions in relation to questions directed, inter alia, at assessing the suitability of persons to work with children and vulnerable adults. 52. Section 113B deals with enhanced criminal record certificates (“ECRCs”). As with a CRC, the Secretary of State must issue an ECRC to any individual who makes an application in the prescribed manner and form and pays the prescribed fee. The application must be countersigned by a registered person and accompanied by a statement by the registered person that the certificate is required for the purposes of an exempted question asked for a “prescribed purpose”. 53. The “prescribed purposes” are defined in the Police Act 1997 (Criminal Records) (Disclosure) Regulations (Northern Ireland) 2008 as amended and include the purposes of considering the applicant’s suitability to engage in any activity which is regulated activity relating to children or vulnerable adults, as defined in legislation. 54. Section 113B(3) provides: “An enhanced criminal record certificate is a certificate which– (a) gives the prescribed details of every relevant matter relating to the applicant which is recorded in central records and any information provided in accordance with subsection (4), or (b) states that there is no such matter or information.” 55. Section 113B(4) provides that before issuing an ECRC the Secretary of State must request the chief officer of every relevant police force to provide any information which, in the chief officer’s opinion, might be relevant for the “prescribed purpose” and ought to be included in the certificate. 56. Pursuant to section 113B(5), the Secretary of State must also request the chief officer of every relevant police force to provide any information which, in the chief officer’s opinion, might be relevant for the “prescribed purpose”, ought not to be included in the certificate in the interests of the prevention or detection of crime but can, without harming those interests, be disclosed to the registered person. 57. The Secretary of State must send to the registered person who countersigned the application a copy of the enhanced criminal record certificate, and any information provided in accordance with subsection (5). 58. The MOPI Guidance explains the circumstances in which police information will be disclosed: “6.3.1. ... The Police Act 1997 creates a statutory scheme for the disclosure of criminal records and police information on potential employees to prospective employers. The CRB is responsible for the scheme and for ensuring that employers have sufficient information to make a judgment on the suitability of a potential employee to work with children or vulnerable adults.” 59. The Guidance further refers to the possibility of sharing information under common law powers. In such cases, a policing purpose must be established and the decision to disclose data must strike a balance between the risk posed and the need for confidentiality of data under the Human Rights Act and the Data Protection Act. 60. As noted above, the ACPO Guidelines work on the basis of restricting access to police information rather than deleting data. Recordable offences are split into categories “A”, “B” and “C” depending on the seriousness of the offence, with category A being the most serious offences. These categories mirror Groups 1, 2 and 3 set out in the MOPI Guidance. The Guidelines set strict time periods after which relevant data will “step down” and only be open to inspection by the police. The aim is to ensure that following step down, other users of the PNC will be unaware of the existence of the relevant records, save in cases of requests for criminal record checks. For example, the ACPO Guidelines state, at paragraph 4.19, that: “4.19 In the case of an adult who is dealt with by way of a caution in respect of an offence listed in category ‘A’, the conviction history will ‘step down’ after a clear period of 10 years, and thereafter only be open to inspection by the police.” 61. Pursuant to legislation, those convicted of certain offences may become “rehabilitated” after a certain period of time has elapsed. The relevant legislation in England and Wales is the Rehabilitation of Offenders Act 1974 (“the 1974 Act”). The legislation which applies in Northern Ireland is the Rehabilitation of Offenders (Northern Ireland) Order 1978 (“the 1978 Order”). 62. Pursuant to the 1978 Order, any person who has been convicted of an offence capable of rehabilitation and has not committed any other offence during the rehabilitation period is to be treated as rehabilitated at the end of the rehabilitation period. 63. The effect of rehabilitation is that the person is treated for all purposes in law as a person who has not committed, or been charged with, prosecuted for or convicted of the offence in question, i.e. the conviction is considered “spent”. If asked about previous convictions, a person is to treat the question as not relating to spent convictions and may frame his answer accordingly; he is not to be liable or prejudiced for his failure to acknowledge or disclose a spent conviction. Spent convictions are not a proper ground for dismissing or excluding a person from employment. However, the Secretary of State is empowered to provide for exclusions, modifications or exemptions from the provisions on the effect of rehabilitation. 64. The 1978 Order makes no reference to cautions. However, the 1974 Act (which does not apply in Northern Ireland) contains a Schedule introduced in 2008 which provides protection for spent cautions. According to Schedule 2, a caution is to be considered a spent caution at the time that it is given. The effects of rehabilitation in respect of a caution are the same as those described above which apply to a conviction. As with convictions, the Secretary of State may, by order, provide for exclusions or exemptions. 65. The Data Protection Act (“the DPA 1998”) was adopted on 16 July 1998. The main provisions of the Act entered into force on 1 March 2000. 66. The Act stipulates that the processing of personal data is subject to eight data protection principles listed in Schedule 1. 67. Pursuant to section 1 of the DPA 1998, “personal data” includes data which relate to a living individual who can be identified from those data. Section 2 of the Act defines “sensitive personal data” as personal data consisting, inter alia, of information as to the commission or alleged commission by him of any offence, or any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings. 68. Under the first principle personal data shall be processed fairly and lawfully and, in particular shall not be processed unless (a) at least one of the conditions in Schedule 2 is met; and (b) in case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. Schedule 2 contains a detailed list of conditions, including that the processing of any personal data is necessary for the administration of justice or for the exercise of any other functions of a public nature exercised in the public interest by any person (paragraphs 5(a) and (d)). Schedule 3 contains a more detailed list of conditions, including that the processing is necessary for the purposes of performing an obligation imposed by law on the data controller in connection with employment (paragraph 1), the processing is necessary for the purpose of, or in connection with, any legal proceedings or is otherwise necessary for the purposes of establishing, exercising or defending legal rights (paragraph 6), or is necessary for the administration of justice or for the exercise of any functions conferred on any person by or under an enactment (paragraph 7). Section 29 provides a qualified exemption from the first data protection principle in the case of personal data processed, inter alia, for the prevention or detection of crime. 69. The third principle provides that personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 70. The fifth principle stipulates that personal data processed for any purpose shall not be kept for longer than is necessary for that purpose. 71. The Information Commissioner created pursuant to the Act has an independent duty to promote the following of good practice by data controllers and has power under section 40 of the Act to make orders (“enforcement notices”) in this respect. Section 47 of the Act makes it a criminal offence not to comply with an enforcement notice. Section 48 of the Act gives data controllers the right to appeal against an enforcement notice to the First Tier Tribunal, if an enforcement notice raises a point of law. Section 13 sets out a right to claim damages in the domestic courts in respect of contraventions of the Act. 72. Section 3(1) of the Human Rights Act 1998 (“the Human Rights Act”) provides as follows: “So far as it is possible to do so, primary legislation and subordinate legislation must be read and given effect in a way which is compatible with the Convention rights.” 73. Section 4 of the Act provides: “(1) Subsection (2) applies in any proceedings in which a court determines whether a provision of primary legislation is compatible with a Convention right. (2) If the court is satisfied that the provision is incompatible with a Convention right, it may make a declaration of that incompatibility. ...” 74. Section 6(1) of the Act provides that it is unlawful for a public authority to act in a way which is incompatible with a Convention right. Section 6(2) clarifies that: “Subsection (1) does not apply to an act if– (a) as the result of one or more provisions of primary legislation, the authority could not have acted differently; or (b) in the case of one or more provisions of, or made under, primary legislation which cannot be read or given effect in a way which is compatible with the Convention rights, the authority was acting so as to give effect to or enforce those provisions.” 75. Section 7(1) provides that a person who claims that a public authority has acted in a way made unlawful by section 6(1) may bring proceedings against the authority. 76. Section 8(1) of the Act permits a court to make a damages award in relation to any act of a public authority which the court finds to be unlawful. 77. In R (X), the Court of Appeal considered the compatibility with Article 8 of the Convention of the disclosure of additional information under the predecessor of section 113B(4) of the 1997 Act in the context of an enhanced criminal records check. The appellant had applied for a job as a social worker and had no previous convictions. He had been charged with indecent exposure, but the proceedings were discontinued when the alleged victim failed to identify him. The social work agency which was dealing with his job application applied for an ECRC. The chief constable, as he was required to do, issued an ECRC. It contained details of the allegations of indecent exposure under the heading “other relevant information”. 78. Lord Woolf CJ noted at the outset that while it was accepted by both parties that the information included in the ECRC might offend against Article 8 § 1, it was not suggested that the legislation itself contravened that Article. He explained: “20. ... No doubt this is because disclosure of the information contained in the certificate would be ‘in accordance with the law’ and ‘necessary in a democratic society’, in the interests of public safety and for the prevention of crime and for the protection of the rights and freedoms of others. This country must, through its legislature, be entitled to enable information to be available to prospective employers, where the nature of the employment means that particular care should be taken to ensure that those who are working with the appropriate categories of persons can be relied on to do so, without those in their care coming to harm if they are under the age of 18 or vulnerable adults.” 79. On the question of the balance between competing interests, Lord Woolf CJ indicated (at paragraph 36) that: “Having regard to the language of section 115 [the predecessor of section 113B], the Chief Constable was under a duty to disclose if the information might be relevant, unless there was some good reason for not making such a disclosure.” 80. He continued (at paragraph 37): “This was obviously required by Parliament because it was important (for the protection of children and vulnerable adults) that the information should be disclosed even if it only might be true. If it might be true, the person who was proposing to employ the claimant should be entitled to take it into account before the decision was made as to whether or not to employ the claimant. This was the policy of the legislation in order to serve a pressing social need. In my judgment it imposes too heavy an obligation on the Chief Constable to require him to give an opportunity for a person to make representations prior to the Chief Constable performing his statutory duty of disclosure.” 81. On the application of Article 8, assuming that it was engaged, he noted (at paragraph 41): “... [H]ow can the Chief Constable’s decision to disclose be challenged under article 8? As already indicated, the Chief Constable starts off with the advantage that his statutory role is not in conflict with article 8, because the statute meets the requirements of article 8(2). It follows also, that as long as the Chief Constable was entitled to form the opinion that the information disclosed might be relevant, then absent any untoward circumstance which is not present here, it is difficult to see that there can be any reason why the information that ‘might be relevant’, ought not to be included in the certificate. I accept that it is possible that there could be cases where the information should not be included in the certificate because it is disproportionate to do so; the information might be as to some trifling matter; it may be that the evidence made it so unlikely that the information was correct, that it again would be disproportionate to disclose it. These were not, in my judgment, the situations on the facts before the Chief Constable.” 82. The case of R (R) concerned the issue of a “reprimand or warning” to a young person for alleged offences of indecent assault. Unlike the issue of a caution, the issue of a reprimand or warning did not require the person’s consent. However, like a caution, the issue of a reprimand/warning required the individual to admit to the offence. The issue of the reprimand/warning in the case had given rise to an obligation that the young offender in question be subject to registration pursuant to the Sex Offenders Act 1977. The claimant alleged that the reprimand had violated Article 6 of the Convention because it had been issued without his consent and the consequences of its issue, including the need to register on the Sex Offender Register, had not been properly identified to him. 83. The House of Lords unanimously rejected the claim. Lord Bingham of Cornhill doubted whether Article 6 had been engaged at all, but even assuming that it was, he concluded that it had ceased to apply once the decision had been made not to prosecute the claimant. He noted that there was little case-law from this Court as to the meaning of “determination” of criminal charges and expressed the view that the determination of a criminal charge, to be properly so regarded, must expose the subject of the charge to the possibility of punishment, whether in the event punishment was imposed or not. He considered therefore that a process which could only culminate in measures of a preventative, curative, rehabilitative or welfare-promoting kind would not ordinarily involve the determination of a criminal charge. He accordingly concluded that neither the warning of the claimant nor the decision to warn him involved the determination of a criminal charge against him. Had they done so, Lord Bingham noted, it was acknowledged by the police force that there had been no valid waiver by him of his fair trial right. 84. The claimant challenged the inclusion under section 113B(4) of the 1997 Act of other information provided by the chief constable on an ECRC regarding alleged offences of which he had been found not guilty. 85. The High Court upheld the challenge and quashed the decision on the basis that the decision-maker had not taken reasonable steps to ascertain whether the allegations that had been made had been true and why the claimant had been acquitted. On the facts of the case it was clear that the Magistrates’ Court had acquitted the claimant because it took the view that he was innocent in the full sense of the word. The High Court observed: “I stress, however, that this decision is very specific to the facts of this case. I do not suggest for one minute that allegations should not be disclosed in an ECRC simply because the alleged offender has been acquitted. The circumstances surrounding the acquittal are all important. There will be instances where an alleged offender is acquitted but only because the Magistrates (or Jury) entertain a reasonable doubt about the alleged offender’s guilt. The tribunal of fact may harbour substantial doubts. In such circumstances, however, it might well be perfectly reasonable and rational for a Chief Constable to conclude that the alleged offender might have committed the alleged offence ...” 86. The Divisional Court considered a claim by an individual aggrieved by the disclosure in an ECRC of three allegations of sexual abuse of autistic persons in his care, where he had been interviewed by the police about one of the allegations but no charges were pursued. 87. The judge conducted a detailed analysis of the allegations and concluded: 58. It follows that in my judgment the decision to disclose the three allegations was lawful ... I recognise how painful such disclosure must be for the claimant, and how damaging its consequences may be. It seems to me, however, that all this follows inevitably from the terms of the legislation and is fully in line with the legislative policy as explained by Lord Woolf in R (X) v Chief Constable of the West Midlands Police. In relation to employment with children or vulnerable adults, it is information of which an employer should be aware. It is then for the employer to decide whether the employment of the person concerned involves an unacceptable risk. 59. I am troubled by the fact that the claimant’s new employer in this case apparently operated a blanket policy of insisting on a ‘clean’ certificate, so that the disclosure of the three allegations led inevitably to the claimant’s dismissal on the transfer of his employment to that employer on a reorganisation at work. The legislation imposes a relatively low threshold for disclosure in the certificate in order to enable an employer to make a properly informed decision. But it is important that employers understand how low that threshold is and the responsibility that it places in practice upon them. A properly informed decision requires consideration not only of the information disclosed in the certificate but also of any additional information or explanation that the employee may provide. The operation of a blanket policy of insisting on a ‘clean’ certificate leaves no room for taking into account what the employee may have to say. That is a matter of particular concern if it leads to the dismissal of an existing employee or of someone whose employment is transferred to the employer on a reorganisation. On the basis of the limited material available to the court, I confess to some surprise that the claimant was advised in this case that he had no reasonable prospect of success in a claim for unfair dismissal resulting from the application of such a policy ...” 88. The question for examination by the Court of Appeal in its judgment handed down on 19 October 2009 was whether certain principles of the Data Protection Act 1998, namely principle 1 (personal data shall be processed fairly and lawfully), principle 3 (personal data shall be adequate relevant and not excessive) and principle 5 (personal data shall not be kept for longer than necessary), required the police to delete certain old convictions from the PNC. Lord Justice Waller noted at the outset: “1. ... The complaint in each case follows the disclosure of the convictions pursuant to a request by the ... CRB ... or, in one case, a request by one of the individuals herself, and it is important to emphasise at the outset that the complaint about retention flows in reality not from the retention itself but from the fact that, if retained, disclosure may follow. In respect of each of those convictions the Information Tribunal (the IT) has upheld the view of the Information Commissioner (the IC) that they should be deleted. However the ramifications are far wider than these five cases since, if these convictions must be deleted and if the police are to treat people consistently, the application of any viable system of weeding would probably lead to the deletion of around a million convictions.” 89. He clarified the effect of the “stepping down” policy on disclosure in the context of criminal records checks, noting: “3. ... [I]t seems that both the Police and the IT understood that the result of stepping down would be that in certain circumstances the CRB would not have access to ‘stepped down’ convictions when preparing ‘standard disclosure certificates’ (as opposed to ‘enhanced disclosure certificates’) under Part V of the Police Act 1997. It is now accepted that that is not accurate. Under Part V of the 1997 Act ‘stepped down’ convictions are required to be revealed even on ‘standard disclosure certificates’, and thus although ‘stepping down’ prevents disclosure in many circumstances to persons other than the police, it does not prevent disclosure by the police in many others including the circumstances under which disclosure was made of four of the convictions the subject of this appeal.” 90. Waller LJ noted that PNC information was used for employment vetting. He observed that CRCs and ECRCs would contain details of spent convictions which, he indicated, provided an important protection to employers. He noted: “... Some emphasis is placed by [counsel for the intervenor] that no statutory obligation is placed on the police to retain data under the Police Act 1997, but on any view Part V of the Act seems to recognise that the data will be there to be provided.” 91. Taking as an example the case of one of the individuals concerned, Waller LJ considered the purposes for which the data had been recorded: “35. ... [I]t seems to me to be clear that one of the purposes for which the police retained the data on the PNC was to be able to supply accurate records of convictions to the CPS, the courts and indeed the CRB. ‘Rendering assistance to the public in accordance with force policies’ clearly covers the roles the police seek to perform in those areas and if there was any doubt about it the recipients include ‘Employers’ ‘the courts’ and ‘law enforcement agencies’.” 92. He continued: “36. If one then poses the question whether the Data being retained is excessive or being retained for longer than necessary for the above purposes there is, it seems to me, only one answer, since for all the above a complete record of convictions spent and otherwise is required. That seems to me to be a complete answer to the appeal ...” 93. Even if a narrower approach to police purposes were adopted, Waller LJ considered that the retention of the data was lawful under the DPA 1998. He noted: “43. ... If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter ... It is simply the honest and rationally held belief that convictions, however old and however minor, can be of value in the fight against crime and thus the retention of that information should not be denied to the police.” 94. He continued: “44. I emphasise the word ‘retention’ because if there is any basis for complaint by the data subjects in this case, it seems to me to relate to the fact that in certain circumstances this information will be disclosed, but that is because Parliament has made exceptions to the Rehabilitation of Offenders Act. What is more, the circumstances in which there will be disclosure are circumstances in which the Data Subject would be bound to give the correct answer if he or she were asked. It is not as it seems to me the purpose of the 1998 [Data Protection] Act to overrule the will of Parliament by a side wind.” 95. As to the complaint of one of the individuals concerned, S.P., that she had been assured in 2001 that the reprimand she had received aged thirteen would be removed from her record when she was eighteen if she did not get into anymore trouble and that the retention of the reprimand on the PNC after her eighteenth birthday was therefore unfair under the first data protection principle, Waller LJ, with whom Lord Justice Hughes agreed, held: “48. ... It seems to me that if it is fair to retain convictions under the new policy it does not become unfair to do so simply because the data subject was told of what the policy then was when being convicted or reprimanded. Furthermore, the deletion of this reprimand leading (as it would have to) to deletion of many others would be likely to prejudice the prevention and detection of crime and the apprehension or prosecution of offenders. The court and the CPS need the full information, never mind the fact the police are of the view that for their operational purposes they need the same.” 96. Finally, on the argument raised by the individuals that retention of the data violated Article 8 of the Convention, Waller LJ indicated that he was not persuaded that Article 8 § 1 was engaged at all in relation to the retention of the record of a conviction. He was of the view that disclosure might be another matter, but reiterated that the appeal before him was not about disclosure. Even if his conclusion were wrong, he considered that the processing was in accordance with the law and necessary in a democratic society. 97. On the Article 8 question, Lord Justice Carnwath noted as follows: “78. ... [W]ith regard to the Human Rights Convention, it is significant that the [Data Protection] Directive is itself specifically linked to the need to respect ‘fundamental rights and freedoms, notably the right to privacy...’, and that it refers in that respect to the European Convention on Human Rights (Preamble (2), (10)). This suggests that the maintenance of such a complete register of convictions, as implicitly endorsed by Article 8(5) of the Directive, should not normally raise any separate issues under the Convention.” 98. He referred to “considerable doubt” as to whether recording the mere fact of a conviction could ever engage Article 8 in any case, distinguishing S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, ECHR, on the basis that it concerned the data of unconvicted persons and was, in his view, accordingly no authority for the proposition that a record of the mere fact of a conviction engaged Article 8. 99. As regards the specific facts of S.P.’s case, given the assurance that she had received from the police that the reprimand would be removed when she reached the age of 18 and the manner in which the police had sought to justify their subsequent decision not to do so, Carnwath LJ considered that the decision of the first-instance tribunal that the retention of the data was unfair and in breach of the first data protection principle could not be faulted in law. 100. Permission to appeal was refused by the Supreme Court on 24 February 2010. 101. In its judgment in R (L), handed down on 29 October 2009, ten days after the Court of Appeal’s ruling in Chief Constable of Humberside, the Supreme Court considered the Court of Appeal’s ruling in R (X) (see paragraphs 77-81 above) in the context of a case concerning disclosure of police information under the predecessor of section 113B(4) in the context of an ECRC. The appellant had secured a job as a playground assistant and the school required an ECRC to which the appellant consented. The ECRC disclosed that the appellant had been suspected of child neglect and non-cooperation with social services. The appellant had not been charged with, or convicted of, any offence, nor had she received a caution. Her employment was subsequently terminated and she brought judicial review proceedings, arguing that the disclosure of the information had violated her rights under Article 8. At issue was whether the requirement in the 1997 Act that chief officers provide information which “might be relevant” and “ought to be disclosed” when an ECRC was requested, was proportionate. 102. As to whether Article 8 was engaged by the mere retention of data, after reviewing the case-law of this Court, Lord Hope indicated (at paragraph 27): “This line of authority from Strasbourg shows that information about an applicant’s convictions which is collected and stored in central records can fall within the scope of private life within the meaning of article 8(1), with the result that it will interfere with the applicant’s private life when it is released. It is, in one sense, public information because the convictions took place in public. But the systematic storing of this information in central records means that it is available for disclosure under Part V of the 1997 Act long after the event when everyone other than the person concerned is likely to have forgotten about it. As it recedes into the past, it becomes a part of the person’s private life which must be respected. Moreover, much of the other information that may find its way into an ECRC relates to things that happen behind closed doors. A caution takes place in private, and the police gather and record information from a variety of sources which would not otherwise be made public. It may include allegations of criminal behaviour for which there was insufficient evidence to prosecute ... It may even disclose something that could not be described as criminal behaviour at all. The information that was disclosed on the appellant’s ECRC was of that kind.” 103. He therefore considered that decisions taken by chief constables in the context of ECRCs were likely to fall within the scope of Article 8 in every case as the information in question was stored in files held by the police. He noted that the approach taken by the police to questions of disclosure at the time was modelled on Lord Woolf CJ’s ruling in R (X) (see paragraphs 77-81 above). 104. Lord Hope indicated that the approach to disclosure under the applicable legislation involved a two-part test. In the first instance, the chief constable was required to consider whether the information might be relevant. Having concluded in the affirmative, he then had to turn his mind to the question whether the information ought to be included in the certificate. This required consideration of whether there was likely to be an interference with the individual’s private life and, if so, whether the interference could be justified. This raised the question whether the Court of Appeal in R (X) had struck the balance between the competing interests in the right place. 105. Turning to examine the approach of the Court of Appeal in that case, Lord Hope first endorsed the views expressed there as to the compatibility of the legislation itself with Article 8 (see paragraph 77 above). He noted that, as in that case, the appellant in the present case did not argue that the legislation itself contravened Article 8 and accepted that it could be interpreted and applied in a manner that was proportionate. Lord Hope continued: “42. So the issue is essentially one of proportionality. On the one hand there is a pressing social need that children and vulnerable adults should be protected against the risk of harm. On the other there is the applicant’s right to respect for her private life. It is of the greatest importance that the balance between these two considerations is struck in the right place ... [T]he use that is being made of the requirement to obtain an ECRC has increased substantially since the scheme was first devised. The number of disclosures of information by means of ECRCs has exceeded 200,000 for each of the last two years (215,640 for 2007/2008; 274,877 for 2008/2009). Not far short of ten per cent of these disclosures have had section 115(7) [now section 113B(4) – see paragraphs 55 above] information on them (17,560 for 2007/2008; 21,045 for 2008/2009). Increasing use of this procedure, and the effects of the release of sensitive information of this kind on the applicants’ opportunities for employment or engaging in unpaid work in the community and their ability to establish and develop relations with others, is a cause of very real public concern ...” 106. He noted in this regard that it was no answer to these concerns that the ECRC was issued on the application of the persons concerned. While he accepted that they could choose not to apply for a position of the kind that required a certificate, he considered that they had, in reality, no free choice in the matter if an employer in their chosen profession insisted, as he was entitled to, on an ECRC. He observed: “43. ... The answer to the question whether there was any relevant information is likely to determine the outcome of their job application. If relevant information is disclosed they may as a result be cut off from work for which they have considerable training and experience. In some cases they could be excluded permanently from the only work which is likely to be available to them. They consent to the application, but only on the basis that their right to private life is respected.” 107. Lord Hope considered that the effect of the approach taken to the issue in R (X) had been to tilt the balance against the applicant too far. The correct approach, he explained, was that neither consideration had precedence over the other. He proposed that the relevant guidance to officers making a decision on disclosure under the provisions should be amended: “45. ...so that the precedence that is given to the risk that failure to disclose would cause to the vulnerable group is removed. It should indicate that careful consideration is required in all cases where the disruption to the private life of anyone is judged to be as great, or more so, as the risk of non-disclosure to the vulnerable group. The advice that, where careful consideration is required, the rationale for disclosure should make it very clear why the human rights infringement outweighs the risk posed to the vulnerable group also needs to be reworded. It should no longer be assumed that the presumption was for disclosure unless there was a good reason for not doing so.” 108. Lord Neuberger, who indicated that his judgment largely echoed that of Lord Hope, was also firmly of the view that Article 8 was engaged in the case, noting: “68. ...An enhanced criminal record certificate ... which contains particulars of any convictions (potentially including spent convictions) or cautions ..., or any other information ‘which might be relevant’ and which ‘ought to be included in the certificate’ ...will often have a highly significant effect on the applicant. In the light of the wide ambit of section 115 (extending as it does to social workers and teachers, as well as to those ‘regularly caring for, training, supervising or being in sole charge of’ children), an adverse ECRC ... will often effectively shut off forever all employment opportunities for the applicant in a large number of different fields ...” 109. He further observed: “69. ... Even where the ECRC records a conviction (or caution) for a relatively minor, or questionably relevant, offence, a prospective employer may well feel it safer, particularly in the present culture, which, at least in its historical context, can be said to be unusually risk-averse and judgmental, to reject the applicant ...” 110. Lord Neuberger also rejected the argument that Article 8 was not engaged because under the relevant legislation the claimant herself had requested the ECRC, noting: “73. ... Where the legislature imposes on a commonplace action or relationship, such as a job application or selection process, a statutory fetter, whose terms would normally engage a person’s Convention right, it cannot avoid the engagement of the right by including in the fetter’s procedural provisions a term that the person must agree to those terms. Apart from this proposition being right in principle, it seems to me that, if it were otherwise, there would be an easy procedural device which the legislature could invoke in many cases to by-pass Convention rights.” 111. He considered the aim of Part V of the 1997 Act, namely to protect vulnerable people, to be unexceptionable and explained how this was achieved by the requirement that relevant information available to the police about an applicant for a post involving responsibility for such vulnerable people be provided to the prospective employer. He continued: “75. ... It is then for that employer to decide whether the information is relevant, and, if so, whether it justifies refusing to employ the applicant. As already mentioned, however, it seems to me realistic to assume that, in the majority of cases, it is likely that an adverse ECRC ... will represent something close to a killer blow to the hopes of a person who aspires to any post which falls within the scope of the section ...” 112. Turning to consider whether there was an infringement of Article 8 in the case, Lord Neuberger was prepared to proceed on the basis that there was “nothing objectionable” in the requirement that an ECRC had to contain details of convictions and cautions, even though, he noted, it might on occasions be “rather harsh” on the person concerned. However, like Lord Hope, he was of the view that where other information provided by the chief constable was concerned, the decision on whether to include it in an ECRC had to incorporate a proportionality assessment and it might well be necessary to seek the prior views of the person concerned. 113. Lords Saville and Brown agreed with Lord Hope and, in the case of Lord Brown, Lord Neuberger. 114. Lord Scott, in the minority, considered (at paragraph 57) that if the compilation and retention of the information was unexceptionable, and the information was relevant to the appellant’s suitability for the employment sought, then it was difficult to see on what basis her attack on the inclusion of the information in the ECRC could succeed. He continued: “58. It is at this point, as it seems to me, that it becomes necessary to remember that it was she who applied for the certificate. I do not doubt that the need for the certificate would have been impressed on her by CSE and that she would have realised that unless she agreed to make the application her chances of obtaining the employment position she desired would be reduced. She may or may not have had in mind the full implications of subsection (7) of section 115 and it would probably not have occurred to her that the history of her delinquent 13 year old son and her failure to have controlled his delinquency would be known to the police and might be considered relevant information. But it cannot, in my opinion, possibly be said that the police response showed a lack of respect for her private life. It was she who, in making the application for an ECRC, invited the exercise by the chief police officer of the statutory duty imposed by section 115(7).” 115. Lord Scott accordingly endorsed the approach taken in R (X). 116. Following R (L), the High Court quashed a decision by the chief constable to disclose details of a sexual allegation made against the claimant in an ECRC on grounds of procedural impropriety, because the claimant’s views had not been sought and because the decision to disclose was disproportionate to the level of risk disclosed. The court granted an injunction to prevent future disclosure. 117. On appeal, the Court of Appeal upheld the decision to quash the disclosure on grounds of procedural impropriety but, emphasising that the primary decision-maker was the chief constable who would take a fresh decision on the basis of the material now before him, allowed the appeal against the injunction. 118. In R (F and another) v Secretary of State for the Home Department, the respondents were convicted sex offenders subject to notification requirements under section 82 of the Sexual Offences Act 2003 (SOA 2003), whereby all those sentenced to 30 months’ imprisonment or more for a sexual offence are registered on the sex offenders register and subject to a lifelong duty to notify police of their living and travelling arrangements, with no right for review. The question in the appeal was whether the absence of any right to review rendered the notification requirements disproportionate to the legitimate aims they sought to pursue and thus incompatible with Article 8 of the Convention. Lord Phillips noted: “41. The issue in this case is one of proportionality. It is common ground that the notification requirements interfere with offenders’ article 8 rights, that this interference is in accordance with the law and that it is directed at the legitimate aims of the prevention of crime and the protection of the rights and freedoms of others. The issue is whether the notification requirements, as embodied in the 2003 Act, and without any right to a review, are proportionate to that aim. That issue requires consideration of three questions. (i) What is the extent of the interference with article 8 rights? (ii) How valuable are the notification requirements in achieving the legitimate aims? and (iii) To what extent would that value be eroded if the notification requirements were made subject to review? The issue is a narrow one. The respondents’ case is that the notification requirements cannot be proportionate in the absence of any right to a review. The challenge has been to the absence of any right to a review, not to some of the features of the notification requirements that have the potential to be particularly onerous.” 119. He found that the notification requirements were capable of causing significant interference with Article 8 rights. However, he continued (at paragraph 51): “... This case turns, however, on one critical issue. If some of those who are subject to lifetime notification requirements no longer pose any significant risk of committing further sexual offences and it is possible for them to demonstrate that this is the case, there is no point in subjecting them to supervision or management or to the interference with their article 8 rights involved in visits to their local police stations in order to provide information about their places of residence and their travel plans. Indeed subjecting them to these requirements can only impose an unnecessary and unproductive burden on the responsible authorities. We were informed that there are now some 24,000 ex-offenders subject to notification requirements and this number will inevitably grow.” 120. He concluded: “56. No evidence has been placed before this court or the courts below that demonstrates that it is not possible to identify from among those convicted of serious offences, at any stage in their lives, some at least who pose no significant risk of re-offending. It is equally true that no evidence has been adduced that demonstrates that this is possible. This may well be because the necessary research has not been carried out to enable firm conclusions to be drawn on this topic. If uncertainty exists can this render proportionate the imposition of notification requirements for life without review under the precautionary principle? I do not believe that it can. 57. ... I think that it is obvious that there must be some circumstances in which an appropriate tribunal could reliably conclude that the risk of an individual carrying out a further sexual offence can be discounted to the extent that continuance of notification requirements is unjustified. As the courts below have observed, it is open to the legislature to impose an appropriately high threshold for review. Registration systems for sexual offenders are not uncommon in other jurisdictions. Those acting for the first respondent have drawn attention to registration requirements for sexual offenders in France, Ireland, the seven Australian States, Canada, South Africa and the United States. Almost all of these have provisions for review. This does not suggest that the review exercise is not practicable. 58. For these reasons I have concluded that ... the notification requirements constitute a disproportionate interference with article 8 rights because they make no provision for individual review of the requirements.” 121. The Supreme Court issued a declaration that section 82 of the SOA 2003 was incompatible with the Convention. 122. The Council of Europe Convention of 1981 for the protection of individuals with regard to automatic processing of personal data (“the Data Protection Convention”), which entered into force for the United Kingdom on 1 December 1987, defines “personal data” as any information relating to an identified or identifiable individual (“data subject”). Article 5, which deals with quality of data, provides: “Personal data undergoing automatic processing shall be: a. obtained and processed fairly and lawfully; b. stored for specified and legitimate purposes and not used in a way incompatible with those purposes; c. adequate, relevant and not excessive in relation to the purposes for which they are stored; ... e. preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored.” 123. Article 6 deals with “special categories of data” and stipulates that personal data relating to criminal convictions may not be processed automatically unless domestic law provides appropriate safeguards. 124. Pursuant to Article 9, derogations are permitted where they are necessary in a democratic society in the interests of, inter alia, public safety, the suppression of criminal offences or protecting the rights and freedoms of others. 125. The Committee of Ministers adopted Recommendation No. R (87) 15 regulating the use of personal data in the police sector on 17 September 1987, in the context of a sectoral approach to data protection intended to adapt the principles of the Data Protection Convention to the specific requirements of particular sectors. An Explanatory Memorandum (“EM”) sets out the background to the Recommendation’s adoption, and notes at paragraph 4: “Given the increased activities of police forces in the lives of individuals necessitated by new threats to society posed by terrorism, drug delinquency, etc as well as a general increase in criminality, it was felt even more necessary to establish clear guidelines for the police sector which indicate the necessary balance needed in our societies between the rights of the individual and legitimate police activities when the latter have recourse to data-processing techniques.” 126. It further observes that concerns which prompted the elaboration of the Data Protection Convention in regard to the increasing recourse to automation in all sectors are most acutely felt in the police sector, for it is in this domain that the consequences of a violation of the basic principles laid down in the Convention could weigh most heavily on the individual. 127. As regards the derogations permitted under Article 9 of the Data Protection Convention, the EM reiterates that they are only permitted if provided for by law and necessary in a democratic society in the interests of, inter alia, the “suppression of criminal offences”. It continues: “20 ... Bearing in mind that the European Court of Human Rights in its judgment in the Malone Case laid down a number of strict criteria (precision, certainty, foreseeability, etc), it is thought that the principles contained in this non-binding legal instrument can provide helpful guidance to the legislator as to the interpretation of the derogation in Article 9, paragraph 2, of the Data Protection Convention when regulating the collection, use, etc of personal data in the police sector. This point should be borne in mind, for example, in the context of paragraph 2.1.” 128. Principle 1.1 of the Recommendation provides: “Each member state should have an independent supervisory authority outside the police sector which should be responsible for ensuring respect for the principles contained in this recommendation.” 129. The EM emphasises the importance of such supervisory authority enjoying genuine independence from police control. 130. Principle 2 concerns collection of data and includes the following: “2.1 The collection of personal data for police purposes should be limited to such as is necessary for the prevention of a real danger or the suppression of a specific criminal offence. Any exception to this provision should be the subject of specific national legislation.” 131. The EM explains that Principle 2.1 excludes an “open-ended, indiscriminate” collection of data by the police and expresses a “qualitative and quantitative” approach to Article 5(c) of the Data Protection Convention. The Principle attempts to fix the boundaries to the exception in Article 9 of the Data Protection Convention by limiting the collection of personal data to such as are necessary for the prevention of a real danger or the suppression of a specific criminal offence, unless domestic law clearly authorises wider police powers to gather information. 132. Storage of data is addressed in Principle 3. Principle 3.1 provides that as far as possible, the storage of personal data for police purposes should be limited to accurate data and to such data as are necessary to allow police bodies to perform their lawful tasks within the framework of national law and their obligations arising from international law. The EM explains: “49. Personal data when collected will subsequently be the subject of a decision concerning their storage in police files. Principle 3.1 addresses the requirements of accuracy and storage limitation. The data stored should be accurate and limited to such data as are necessary to enable the police to perform its lawful tasks ... 50. This principle is important given the fact that the commitment of personal data to a police file may lead to a permanent record and indiscriminate storage of data may prejudice the rights and freedoms of the individual. It is also in the interests of the police that it has only accurate and reliable data at its disposal.” 133. Principle 5 deals with communication of data. Principle 5.1 permits communication of data between police bodies, to be used for police purposes, if there exists a legitimate interest for such communication within the framework of the legal powers of these bodies. In respect of communication to other public bodies, Principle 5.2 stipulates: “5.2.i. Communication of data to other public bodies should only be permissible if, in a particular case: a. there exists a clear legal obligation or authorisation, or with the authorisation of the supervisory authority, or if b. these data are indispensable to the recipient to enable him to fulfil his own lawful task and provided that the aim of the collection or processing to be carried out by the recipient is not incompatible with the original processing, and the legal obligations of the communicating body are not contrary to this. 5.2.ii. Furthermore, communication to other public bodies is exceptionally permissible if, in a particular case: ... b. the communication is necessary so as to prevent a serious and imminent danger.” 134. As to the possibility of communicating indispensable data to public bodies under Principle 5.2.i.b, the EM explains that it is recognised that certain public bodies engage in activities which are similar in some ways to police activities and that information held by the police may be of value to those activities. Regarding the possibility of communicating data to prevent a serious and imminent danger, the EM recalls that this will only “exceptionally” allow communication and that the danger must be both serious and imminent, given that Principle 5.2.ii is only concerned with exceptional cases justifying communication. 135. As regards communication to private parties, Principle 5.3 provides: “5.3.ii. The communication of data to private parties should only be permissible if, in a particular case, there exists a clear legal obligation or authorisation, or with the authorisation of the supervisory authority. 5.3.ii. Communication to private parties is exceptionally permissible if, in a particular case: ... b. the communication is necessary so as to prevent a serious and imminent danger.” 136. The EM acknowledges that it may occasionally be necessary for the police to communicate data to private bodies, although not on the same scale as envisaged in the case of mutual assistance between the police and other public bodies. It continues: “Once again, Principle 5.3 treats these as exceptional cases, requiring a clear legal obligation or authorisation (for example the consent of a magistrate), or the consent of the supervisory authority. In the absence of these factors, Principle 5.3 repeats the same conditions set out in Principle 5.2.ii.” 137. Concerning Principle 5 generally, the EM notes: “Outside the framework of communication within the police sector, the conditions governing transfer are stricter, given the fact that the communication may be for non-police purposes stricto sensu. The exceptional nature of the circumstances allowing communication set out in Principles 5.2 and 5.3 is stressed. It will be noted that circumstances a and b in both Principles 5.2.ii and 5.3.ii are specifically referred to as ‘exceptional’.” 138. Principle 7 deals with length of storage and updating of data. Pursuant to Principle 7.1 measures should be taken so that personal data kept for police purposes are deleted if they are no longer necessary for the purposes for which they were stored. It further provides: “... For this purpose, consideration shall in particular be given to the following criteria: the need to retain data in the light of the conclusion of an inquiry into a particular case; a final judicial decision, in particular an acquittal; rehabilitation; spent convictions; amnesties; the age of the data subject, particular categories of data.” 139. The EM explains that it is essential that periodic reviews of police files are undertaken to ensure that they are purged of superfluous or inaccurate data and kept up to date. It notes that Principle 7.1 lists certain considerations which should be borne in mind when determining whether or not data continue to be necessary for the prevention and suppression of crime or for the maintenance of public order. 140. Principle 7.2 provides: “Rules aimed at fixing storage periods for the different categories of personal data as well as regular checks on their quality should be established in agreement with the supervisory authority or in accordance with domestic law.” 141. The EM notes that domestic law may authorise the means for laying down such rules or that, alternatively, rules could be formulated by the supervisory authority itself in consultation with police bodies. It explains that where the police themselves elaborate rules, the supervisory authority should be consulted as to their content and application. 142. Recommendation No. R (84) 10 of the Committee of Ministers on the criminal record and rehabilitation of convicted persons (adopted on 21 June 1984) notes in its preamble that any use of criminal record data outside the criminal trial context may jeopardise the convicted person’s chances of social reintegration and should therefore be restricted “to the utmost”. It invited member States to review their legislation with a view to introducing a number of measures where necessary, including provisions limiting the communication of criminal record information and provisions on rehabilitation of offenders, which would imply the prohibition of any reference to the convictions of a rehabilitated person except on compelling grounds provided for in national law. 143. The TFEU sets out in Article 16 the right to the protection of personal data concerning them. It requires the European Parliament and the Council to lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law; and the rules relating to the free movement of such data. 144. The EU Charter of Fundamental Rights includes the right to protection of personal data. Article 8 of the Charter reads: “1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.” 145. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Data Protection Directive”) provides that the object of national laws on the processing of personal data is notably to protect the right to privacy as recognised both in Article 8 of the European Convention on Human Rights and in the general principles of Community law. The Directive sets out a number of principles in order to give substance to and amplify those contained in the Data Protection Convention of the Council of Europe. It allows Member States to adopt legislative measures to restrict the scope of certain obligations and rights provided for in the Directive when such a restriction constitutes notably a necessary measure for the prevention, investigation, detection and prosecution of criminal offences (Article 13). 146. Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (“the Data Protection Framework Decision”) was adopted on 27 November 2008. Its purpose is to ensure a high level of protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data in the framework of cross-border police and judicial cooperation in criminal matters while guaranteeing a high level of public safety. 147. Article 3 of the Data Protection Framework Decision provides that personal data may be collected by the competent authorities only for specified, explicit and legitimate purposes and may be processed only for the same purpose for which data were collected. Processing of the data must be lawful and adequate, relevant and not excessive in relation to the purposes for which they are collected. Article 5 provides that appropriate time-limits must be established for the erasure of personal data or for a periodic review of the need for the storage of the data. Procedural measures must be in place to ensure that these time-limits are observed. 148. In January 2012 the European Commission published proposals, based inter alia on Article 16 TFEU, for the comprehensive reform of the EU’s data protection framework. The proposals are currently under negotiation.