Case Summary and Outcome

The European Court of Human Rights found a violation of a peace activist’s right to privacy in relation to personal data which had been collected and retained in an “extremist database” maintained by the police, despite his never having been assessed as a threat. The Court affirmed previous case law which found the broad collection of information to prevent crime and disorder to be lawful and pursue a legitimate purpose. However, in the present case, the retention of personal data without scheduled review and beyond established limits was disproportionate and unnecessary. The Court took issue with the domestic courts failure to recognize the sensitive nature of some of the data retained on Carr, namely data revealing his political opinions and affiliations with labor unions, which are subject to greater protections. It also called attention to the “ambiguous” nature of legal framework for the database and lack of appropriate safeguards to prevent abuse or arbitrariness.

---

Facts

The applicant, Mr. John Oldroyd Catt, is a British national born in 1925. He has been a peace activist since 1948 and in 2005 he starting participating in demonstrations organized by Smash EDO. Smash EDO aims to disrupt the manufacturing of weapons and related components at a facility in Bristol which is owned by the US firm EDO MBM Technology Ltd. Although Smash EDO protests were known for becoming violent, and Catt was arrested twice over the years, he was never convicted of any offense.

In March 2010, Catt requested official records pertaining to his protest activities under section 7 of the Data Protection Act 1998. In response, he received records from the “extremism database” operated by the National Public Order Intelligence Unit of the police (NPOIU). The records included sixty-six entries on protests he attended between March 2005 and October 2009, which predominantly documented his name, date of birth, address and in some instances a description of his appearance. Only one photo of him was included. However, an additional 13 entries were related to various trade union protests as well as a pro-Gaza demonstration he attended.

In August 2010, Catt submitted a request to have entries about him in nominal records and information reports deleted, which was rejected without cause. In November 2010, Catt initiated proceedings claiming the retention of his data was not “necessary” under Article 8 (2) of the ECHR, and permission to seek judicial review was eventually granted in March 2011. (para. 12)

On 30 May, the High Court ruled that Article 8 was not engaged and that any interference was justified under Article 8 (2). The Court made this determination in part based on testimony given by the National Coordinator of the NPOIU who maintained Catt’s data had been processed legally and fairly. The Coordinator also admitted that not all the records pertaining to Catt had been disclosed “on the grounds that disclosure would prejudice the investigation or detection of crime and that the material was thus exempt from disclosure under section 29 of the Data Protection Act.” (para. 18)

On Appeal, the Court unanimously found that the collection and retention of Catt’s personal information in the national database constituted an unjustifiable interference under Article 8. The Court reasoned that his personal data could not further the stated objective of the police to anticipate the location, numbers of attendees and tactics of future protests organized by Smash EDO. The Court affirmed that the burden of proving that the interference was justified rested on the respondent and stated that it was “striking” that the National Coordinator had failed to prove that the information retained on Catt had “in fact been of any assistance to the police at all.” (para. 23)  In Summary, the Court found “[t]he systematic collection, processing and retention on a searchable database of personal information, even of a relatively routine kind, involves a significant interference with the right to respect for private life. It can be justified by showing that it serves the public interest in a sufficiently important way, but in this case the respondent has not in our view shown that the value of the information is sufficient to justify its continued retention.” (para. 23)

The Supreme Court overturned the Appellate Court ruling, holding that the interference under Article 8 was lawful and that the retention of the data was justified due to its limited scope. The information was gathered overtly, was not sensitive or intimate and “disclosure to third parties was properly restricted.” (para. 29) In assessing the proportionality, the Court considered that the retention of data in nominal records did not “carry any stigma or suspicion of guilt,” was for police purposes only, and that “sufficient safeguards existed to ensure that data was not retained for longer than required for the purpose of maintaining public order and preventing or detecting crimes.” (para. 29) One judge dissented, arguing that while the collection of the data was lawful for police purposes, its retention was disproportionate under the circumstances of the present case where Carr had never been assessed as a threat and was only exercising his democratic right to protest peacefully.

An unrelated report, published in January 2012 by the HM Inspectorate of Constabulary, concerning intelligence gathered covertly on protest movements found that much of it was being unnecessarily retained. The findings prompted a review of the “extremism” database and subsequently, all but 2 of the impugned entries related to Carr were deleted. Nonetheless, an additional four entries relating to Carr were later identified.

---

Decision Overview

The Court began by affirming that it is established in case-law that the storing of personal data constitutes an interference with the right to respect for private life under Article 8 (1) of the Convention. Referring to the Supreme Court finding that the interference in the present case was “limited” the Court determined that the primary issue was whether the interference was necessary in a democratic society.

Regarding the collection of data, the Court found that it was difficult to determine the scope of the content collected due to the lack of a legal basis for the establishment of the database and the variety of definitions for “domestic extremism” used by the government agencies.  The Court then turned to the provisions relating to the retention and use of data. Citing the Data Protection Act and the 2005 Code of Practice on the Management of Police Information, the court noted that the police were at liberty to retain data at their discretion in so far as it was necessary for policing, was not excessive and was up to date. The Court affirmed that the legitimate aim of the data collection, to preventing disorder or crime, is not disputed. Despite concerns over the legal “ambiguity” of the collection of the personal data, the Court decided not to focus on the quality of the law, but rather on the related issue of whether it was necessary.

To assess whether the interference was necessary, the Court first had to determine if it addressed a “pressing social need,” was proportionate, and whether the justification offered by the national authorities was relevant and sufficient. The Court also recognized the margin of appreciation granted to the domestic authorities.

The Court took issue with the domestic courts failure to recognize the sensitive nature of some of the data collected and retained on Carr, specifically data revealing his political opinions and affiliations with labor unions, which are subject to greater protections. Under relevant domestic law and practice, the Court referenced M.M. v. the United Kingdom and The Data Protection Act 2018 which provides higher protection for the processing of “sensitive” personal data including data which reveals “political opinions,” racial or ethnic origin of the subject or trade union membership. It also noted that the realization that additional entries had been retained but not revealed until after the national proceedings, called into question the effectiveness of the available safeguards against arbitrariness and abuse.

Next, the Court found that there was a pressing social need to collect data relating to Carr. It concurred with the finding of the Supreme Court that the nature of intelligence gathering required the broad collection of information in the first instance in order for its value to be properly assessed. In the present case, the Court found the police were fully justified in collecting data on Carr due to his repeated involvement with Smash Edo protest’s which had a tendency to turn violent or lead to criminal conduct. However, the Court found that there was no pressing social need to retain the personal data beyond established limits and once “its continued retention becomes disproportionate,” it must be deleted. In Carr’s case, these safeguards were not sufficiently applied and hence his data was not properly reviewed or deleted, despite the domestic Court’s ruling that he posed no danger to anyone.

Further, the Court noted that the police failed to adhere to their own policies by retaining sensitive data related to Car’s affiliation with trade unions and his political opinions, despite the fact that his activities were peaceful and lawful. The Court affirmed that Article 11 of the Convention protects the right to peacefully protest as an integral part of the democratic process. Under the circumstances of the present case, the Court found that the retention of sensitive personal data was not “absolutely necessary,” nor required for a particular inquiry, and hence could have a chilling effect. The Court also referred to Principle 7 of Recommendation R (87) which required that Carr’s age, 93 at the time of the ruling, should have been taken into consideration.

The Court rejected the Government’s argument that it would be an unreasonable burden to conduct regular reviews of the database to delete unnecessary information, as the State’s own “MoPI Code of Practice” (A Code of Practice on the management of police information, based on the Data Protection Act) requires data to be reviewed every six years. Moreover, it would be a violation of the right to private life protected under Article 8 for the Government to maintain databases which could not be revised and then use that as a justification not to delete irrelevant data. (Para. 127)

The Court concluded that there had been a violation of Article 8 of the Convention and awarded EUR 27,000 in costs and expenses.

Concurring Opinion

Judges Koselo and Felici issued a concurring opinion which argued that the Chamber, rather than simply focusing on necessity, should have assessed the “quality of the law” which they believed was “extremely vague” and thus enabled the “processing of sensitive personal data without effective safeguards.” (para.6)  They further agreed with the applicant’s submission that “a system that must rely on whistleblowers, litigation and press disclosure to ensure proper conduct is not adequate in terms of protections against abuse or arbitrariness.” (para.14)

Third Parties’ Submissions

The Equality and Human Rights Commission and Privacy International were both granted leave to submit interventions.

The Equality and Human Rights Commission focused its comments on the lawfulness of the Extremism Database which is not established under any legislation, statutes or published policy. Further, as the database collected information on sensitive data, such as political activities, it could have a chilling effect on the legitimate right to protest.  Relying on case law from the European Court of Human Rights and the Court of Justice of the European Union it presented four core principles for ensuring regimes, such as the Extremism Database in the present case, are in accordance with the law:

(i) the creation of police powers must be published and accessible to the public;

(ii) clear and publicly accessible safeguards are required to ensure that the interference does not occur in an arbitrary, inappropriate or unnecessary manner;

(iii) there must be clear and accessible criteria enabling individuals, whose personal data is stored, to secure its deletion, including by way of independent review;

(iv) information relating to those not suspected of criminal activity must be removed.

It concluded by noting that the operation of the Extremism Database failed to meet the above standards.

Privacy International argued that the Supreme Court’s finding that the interference was minor on the grounds that the information was gathered overtly, could lead to wide scale abuse. It noted that the lack of adequate legislation “governing the collection and use of data,” especially in light of rapid technological developments, leaves the door open to the gathering of information from social media, CCTV, face recognition software and other technologies.

---