Collection of data and the right to privacy
MM v United Kingdom [2012] ECHR 1906 (13 November 2012)
Summary
In this case, the European Court of Human Rights considered the collection, retention and use of data in regards to the scope of the right to privacy.
Facts
MM (the applicant) had been offered employment as a Health Care Family Support Worker in September 2006, subject to vetting. The applicant accordingly consented to a criminal record check and disclosed details of a previous family incident in April 2000 where she had taken her grandson away for two days without the parents’ permission during a domestic dispute.
As a result the applicant was arrested but the Director of Public Prosecutions subsequently issued a “caution” instead of commencing criminal proceedings for child abduction. The applicant was later advised by police in writing that her caution would remain on record for five years and expire in November 2005.
However, the offer of employment was subsequently withdrawn on account of the applicant’s criminal record revealing a caution for child abduction.
The applicant’s caution had not been removed from her criminal record after the five year period had elapsed, because a policy change prior to the expiry of that five year period meant that “all convictions and cautions, where the injured party is a child, are kept on the record system for life”.
In correspondence with the Criminal Records Office, it was noted that “the child did not suffer any harm” and that no harm was intended. Despite attempts to have the caution removed, the applicant was informed by the Detective Superintendent of the Northern Ireland Police Service that the caution would not be removed from police records. Instead it was proposed that an explanatory note may be added to the criminal record.
The applicant was interviewed for another position as a Family Support Worker in February 2007 and consented to a criminal record check but was unsuccessful; no reasons were provided.
Submissions
The applicant argued that:
- the retention of the caution data violated the applicant’s right to respect for her private life, under article 8(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms because it had affected her ability to secure employment in her chosen field;
- the retention of the caution data on the criminal record for a prolonged period was disproportionate;
- given the applicant was not considered a general threat to children, the retention of this data was not furthering the legitimate aim of protecting children; and
- no review process existed to assess the necessity of the continued retention of the caution data.
The United Kingdom argued that the retention of criminal record data by the police was an inevitable and commonplace feature of any effective and proper criminal justice system and did not interfere with article 8 rights in any meaningful way and that in any event, it is a legitimate interference with the right, under article 8(2) of the Convention, being: public safety, the prevention of disorder and crime, the protection of health or morals or the protection of the rights and freedoms of others.
In reference to retention of the record, the United Kingdom argued that it was a judgment for the individual police force in question in accordance with a margin of appreciation.
As for disclosure of the record, the United Kingdom argued that an assessment of the need for disclosure was a policy judgment of the State and, again, fell within the margin of appreciation where regard was given to both the objectives of the legislation and the relevance of the information to the employment being sought.
Decision
The European Court of Human Rights confirmed that both the storage of information relating to an individual’s private life and the release of that information fell within the scope of article 8(1), and the UK had indeed violated article 8 of the Convention.
The Court found that the data was “personal data” under the Council of Europe’s Data Protection Convention and notwithstanding that the data contained in the criminal record is public information, the systemic retention “means that they are available for disclosure long after the event when everyone other than the person concerned is likely to have forgotten about it … thus as the conviction or caution itself recedes into the past, it becomes a part of the person’s private life which must be respected”.
In making this finding, the Court recognised that there may be a need for a comprehensive record of all cautions, conviction, warnings, reprimands, acquittals and other information. However, it found that it is unlikely that article 8 will be complied with where an indiscriminate and open-ended collection of criminal record data is not constrained by “clear and detailed statutory regulations clarifying the safeguards applicable and setting out the rules governing, inter alia, the circumstances in which data can be collected, the duration of their storage, the use to which they can be put and the circumstances in which they may be destroyed”.
Critical to the Court’s findings was the fact that there was no statutory framework in Northern Ireland which governed the collection and storage of data regarding the administration of cautions at the time. The process was in fact carried out in line with the police’s common law powers and guided by general principles set out in the Data Protection Act 1998.
There was also no statutory framework which governed the disclosure and communication of caution data in Northern Ireland by the police to prospective employers.
In the absence of a statutory regime, police officials were relied on policy documents which the Court observed revealed that:
- the recording and initial retention of caution data are intended in practice to be automatic (regardless of seriousness of the offence);
- there is a presumption in favour of retention; and
- the review schedule (introduced in 2008) requires police to retain data for “public protection matters” until the relevant person is deemed to have reached one hundred years of age.
The Court focused on the “absence of a clear legislative framework for the collection and storage of data, and the lack of clarity as to the scope, extent and restrictions of the common law powers of the police to retain and disclose caution data.” The Court further highlighted its concerns about the “absence of any mechanism for independent review of a decision to retain or disclose data”.
In relation to mandatory disclosure of the records, the Court was critical of the fact that no distinction was made on the basis of:
- the nature of the offence;
- the time which has elapsed since the offence took place (in this case almost 12 years); nor
- the relevance of the data to the employment sought.
Given the cumulative effect of these shortcomings, the Court was not satisfied that there were then, nor now, sufficient safeguards in the system for retention and disclosure of criminal record data to ensure that data relating to the applicant’s private life has not been, and will not be, disclosed in violation of her article 8 right to respect for her private life.
Commentary
This significant decision sets a benchmark for establishing when the collection of an individual’s data and records (even if collected by government bodies on public interest grounds) may interfere with an individual’s right to privacy and freedom from interference. Where the collection, retention or disclosure of such information is being challenged, the Court has suggested that consideration must be given to real effect of a statutory framework, which may violate the right to respect for one’s private life if it includes: an arbitrary and indefinite collection and retention of data; a mandatory disclosure requirement; and a requirement which limits or prohibits an independent review.
The decision is available online at: http://www.bailii.org/eu/cases/ECHR/2012/1906.html
Richard Griffin is a lawyer at Lander & Rogers currently on secondment to the HRLC.