UK Courts view any data retention as human rights compliant.

A major difference has emerged between the approaches adopted by the UK Courts and the European Court of Human Rights. In summary, the higher UK Courts have consistently stated that data retention does not significantly engage Article 8 of the Human Rights Act, whereas the European Court of Human Rights has consistently judged that the Article is fully engaged.

The consequences are important for any forthcoming public debate on data retention policy – for example, with respect to the retention of communications data, DNA data, ID Card data. It means that any legal challenge with respect to data retention has a real prospect of failure in the UK courts; this will force litigants to take a long march through the legal institutions that ends in Strasbourg at the European Court of Human Rights.

This prospect could especially important if the Conservative Party forms the next Government. The Party has promised to replace the Human Rights Act with a Bill of Rights, and if that Bill of Rights has different wording to the current Article 8, then it could weaken the protection afforded to UK citizens, and offer even more legal protection to data retention by government agencies.

In its landmark decision S v Marper, all 17 judges of the European Court of Human Rights agreed that (at para 67): “The mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8 (see Leander v. Sweden, 26 March 1987, § 48, Series A no. 116). The subsequent use of the stored information has no bearing on that finding (Amann v. Switzerland [GC], no. 27798/95, § 69, ECHR 2000-II)”.

So this is clear cut – the act of retaining personal data engages Article 8.

This is to be contrasted in the recent Court of Appeal case involving the retention of criminal records by the police where Waller LJ said (at para 50): “A further argument was addressed to the IT (Information Tribunal) on Article 8 independently from the arguments on construction under the Data Protection Act. I am not persuaded that Article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure” (emphasis by Waller LJ).

This view reflects the judgment of Lord Steyn in House of Lords (in S v Marper) who said at para 31: “Looking at the matter in the round I incline to the view that in respect of retained fingerprints and samples article 8(1) is not engaged. If I am wrong in this view, I would say any interference is very modest indeed”.

In other words, in the UK, the Courts have expressed the view that to engage Article 8 to any significant degree, there has to be something other than mere retention of personal data – for example, a further use or disclosure beyond retention.

So what does this mean in practice? Imagine a law requires the retention of personal data on millions of data subjects for law enforcement purposes. Suppose further, that this law then states that any further use or disclosure of these personal data has to be necessary “in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.

The Regulation of Investigatory Powers Act follows this construction when permitting the authorities access to communications data. The purposes in the paragraph above are the purposes where there can be legitimate interference with private and family life (and are described in Article 8(2)).

Note that in such a database there will be two kinds of data subjects: those data subjects who are being investigated and those who are not. In relation to those who are not being investigated, their personal data are not used for any investigation. Hence such personal data are merely retained, and this retention, according to the UK Courts, does not breach Article 8.

In relation to those who are investigated, their personal data are further used or disclosed for an investigation. This means that although there is a further use or disclosure (hence Article 8 is engaged), that the further use or disclosure is covered by an exemption from Article 8(1) that is described in Article 8(2).

It then follows that data retention cannot possibly breach Article 8, the Government can safely claim that all its data retention policies are compliant with its obligations to human rights (and data protection), and the public can sleep safely in their beds. Except for those neurotic privacy activists of course.

References: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008); Chief Constable of Humberside Police,  Staffordshire Police, Northumbria Police, West Midlands Police and Greater Manchester Police v the Information Commissioner,  [2009] EWCA Civ 1079), judgement delivered 19 October 2009); Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

 

Comments

[Ian Brown]

Chris - it seems that the Strasbourg court does not leave the UK the margin of appreciation they would need to get away with this approach. Is a bust-up not rather inevitable? And won't Strasbourg win, even if it takes them a decade?