This article considers the recent judgment of AB v Chief Constable of British Transport Police [2022] EWHC 2749 (KB) and the practical implications when an individual makes a data subject access (‘DSAR’) or right to erasure request to the Police.
What are the facts of AB ?
The appellant, AB was 31-year-old-male who has Autistic Spectrum Disorder. He suffered with severe anxiety and rubbed fabric between his fingers as a coping mechanism. This is known as ‘stimming’.
On 6 December 2011, AB sat next to a woman on the train and touched her thigh. The woman reported the incident to the British Transport Police. A police officer recorded the woman’s complaint in her pocketbook. The complaint was uploaded to the respondent’s computer system by way of an Occurrence Summary Report (‘OSR’). On 9 April 2014, a similar incident occurred whereby a further complaint was uploaded to the respondent’s computer system by way of an OSR. AB was not prosecuted for either complaint.
Over the course of several years, AB’s parents and Bristol City Council made a number of complaints to the Police about the existence of the OSRs, including that they wrongly indicated that AB had committed sexual assaults. In 2017 the Police were put on notice that the continuing existence of the OSRs was causing AB serious emotional trauma.
On 28 May 2020, a data quality officer employed by the Police reviewed the OSRs and concluded that it was proportionate to retain the OSRs to “safeguard the travelling public and [AB]”.
In challenging this decision, AB claimed that the OSRs breached the fourth data protection principle (section 38(1) Data Protection Act 2018 (‘DPA’)) because they were inaccurate. AB also claimed that retention of the OSRs amounted to a breach of his right to private life under Article 8 of the European Convention on Human Rights (‘ECHR’).
The Police argued that the OSRs were an accurate account of the entries made in the police officers’ pocketbooks at the time of the complaints. The respondent stated that “is not the function of the police to ‘re-write’ a complainant’s initial account”.
What was the Court’s decision in AB ?
The matter came before Mr Justice Johnson following an appeal by the Police against a decision by HHJ Septhon KC in the Manchester County Court to order the deletion of the OSRs and to award £36,000 in damages (£15,000 in respect of loss of earnings, £15,000 for distress and £6,000 for aggravated damages).
Johnson J held that the OSRs did not record convictions. They “contain[ed] narrative information that has been received by the police”. In addition, the ‘reasonable reader’ of an OSR (i.e. a police officer) would understand that an OSR is a record of information that has been provided to the Police, the actions taken by the Police, and the underlying allegation(s) may be untrue. As a result, OSRs are accurate for the purposes of data protection legislation. However, Johnson J held that the retention of the OSRs was disproportionate. The Judge recognised that the existence of the OSRs were having a significant impact on AB and that he posed no real risk to the public. The Judge acknowledged that matters of this nature are highly fact specific and in many cases “it will be proportionate to retain crime reports of offences for long periods of time, particularly where the offences raise public protection issues”.
Mr Justice Johnson also upheld the County Court’s award of damages.
What are the practical implications of this case?
If an OSR or any other form of police record concerns a complaint about you, the Police are not required to amend or delete it on the basis that you believe the underlying allegation is inaccurate (assuming an allegation has been made). However, in appropriate cases, there may be a basis for seeking the erasure or amendment of an OSR on the basis that its continued retention is a disproportionate interference with your private life.
As indicated by AB, data controllers at police forces, or if necessary the court, will conduct a balancing exercise between your right to a private life and the public interest in records being maintained to assist with the detection and prevention of crime. Retention will be permissible where it is proportionate and necessary.
The court will consider a range of factors when conducting what will always be a fact-sensitive balancing exercise. These factors include (1) the distress/damage you are suffering by the retention of the data; (2) whether you pose any substantial risk to the public; and (3) the sensitivity of the data. For example, a claimant who is traumatised by the existence of a one-off historic allegation that never resulted in a prosecution is more likely to be successful (particularly in respect of a minor offence) than a claimant who has been the subject of several recent allegations.
How do I obtain police reports about me and/or request rectification/erasure?
Pursuant to section 45(1) of the DPA, data subjects (i.e. living individuals) are entitled to request from the Police:
- copies of the personal data held they hold;
- rectification of the personal data (section 45 of the DPA); and
- erasure of the personal data or restriction of its processing (section 47 of the DPA).
In accordance with section 54 of the DPA, the Police are required to respond to a DSAR without undue delay and in any event within one month (subject to exemptions).
The Police are entitled to restrict wholly or partly, the personal data provided under a DSAR. The Police can restrict the personal data if it is a necessary and proportionate measure to, avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences (section 45(4)(b) DPA). The Police may also withhold or redact information where its disclosure will interfere with third party data protection rights.
The Police may also refuse to rectify/erase personal data if there are good grounds for doing so (e.g. to protect the public). As per AB whether they are entitled to do this will be fact-sensitive.
If the Police have restricted access to your DSAR results, they must explain the reason(s) for the restriction. The Police must also inform you of your right to:
(1) make a request to the Commissioner under section 51 DPA;
(2) lodge a complaint with the Commissioner; and
(3) apply to court under section 167 DPA.