In Catt v United Kingdom [2019] ECHR 76, the European Court departed from and disagreed with the Supreme Court, holding that the police’s collection and retention of data of a peaceful protestor was an unlawful interference with Article 8 of the Convention.
Mr Catt was a 94-year-old man from Brighton; a peaceful protestor who regularly attended public demonstrations since 1947. In 2005, he began attending demonstrations held by ‘Smash EDO’. Although there was often serious disorder and criminality at Smash EDO’s protests, Mr Catt only ever attended in a peaceful capacity and was never charged with anything.
In 2010, he made a ‘subject access request’ to the police, to identify what records, if any, they held on him. The police disclosed sixty-six entries identifying his attending protests between 2005 and 2009. Some were EDO Smash protests, many were other protests. All of these records were held on the police’s “Extremism Database”.
The Association of Chief Police Officers, ‘ACPO’, refused to delete the entries on Mr Catt. They failed to give any reasons for this refusal, and so Mr Catt judicially reviewed ACPO’s decision. In so doing, he claimed a breach of his article 8 right to privacy.
Decision of the Supreme Court
By the time Mr Catt’s claim against the Commissioner of the Police of the Metropolis reached the Supreme Court, R (Catt) v Commissioner of Police of the Metropolis [2015] UKSC 9; [2015] AC 1065, it was clear that the Police had obtained and retained substantial data on his attendance at protests. This ranged from noting his date of birth and address to a written description of him – including a photograph taken of him at a protest. Some of these records had been deleted prior to the Supreme Court hearing, but a number remained on the police’s ‘Extremism Database’.
The Supreme Court recognised very briefly that there had been an interference with Mr Catt’s Article 8 rights, holding that it was clear that the state’s systematic collection and storage in retrievable form even of public information about an individual was an interference with private life [6].
The Supreme Court further found that police’s policy on data collection and retention was in accordance with the law. Lord Sumption went to great pains to stress that, to be in accordance with the law, the police policy need not rely on express statutory rules. Rather the test was whether the law contained principles “capable of being applied predictably to any situation” [11].
The principles applicable in this instance were to be found in the Data Protection Act 1998 (including the Data Protection Principles), the statutory Code of Practice on the Management of Police Information, attendant administrative Guidance and the police’s common law power to obtain and store information for policing purposes [12]. Lord Sumption gave a careful and considered judgment of the police’s exercise of its powers under each of those legal sources. He noted that these were all public documents, and thus accessible. On this basis, the Supreme Court held that the retention of data in police systems in the United Kingdom was in accordance with the law.
The court further found that the retention of the data was proportionate. The data was “in no sense intimate or sensitive information”. The data was retained for “proper policing purposes”; it was not used for any purpose other than policing; and the data was periodically reviewed for retention [27]-[30]. On this basis, it satisfied the test of being necessary in a democratic society.
Decision of the European Court of Human Rights
The UK government accepted that there had been an interference of Mr Catt’s Article 8 rights: that was uncontroversial. However, the ECtHR took a very different stance as to whether the policy of data collection and retention had been lawful.
The ECtHR recognised a legal base for data retention, in the Data Protection Act 1998 and the MoPI Code of Practice. However, it expressed grave misgivings over the data collection. Although the data was collected in accordance with the police’s common law powers, the ECtHR found that “there was significant ambiguity over the criteria being used by the police” as to what data to collect [97]. In particular, it stated that “concern that the collection of data for the purposes of the database did not have a clearer and more coherent legal base” [99]. This was at odds with the seemingly clear framework identified by Lord Sumption.
The ECtHR’s views on the lawfulness of data collection were, however, obiter. Perhaps to avoid conflict, the ECtHR did “not find it necessary to decide whether the interference was ‘in accordance with the law’”.
This was because the ECtHR answered the third question in the negative – that the collection and retention of Mr Catt’s data was not necessary in a democratic society:
- First, the ECtHR accepted that there was a pressing social need to collect the data. Data collection was an inherent feature of intelligence gathering [117] and it was all the more necessary as EDO Smash perpetrated violent and potentially criminal activities [118]. However, the court held that there was no pressing social need to retain the data, stating that there had to be safeguards in place to enable the deletion of the data once continued retention became disproportionate [119].
- Second, the policy of retention was not proportionate: material could be retained indefinitely. The regular reviews were not necessarily targeted at deleting data records [120].
- Third, the ECtHR found that data revealing political opinion was ‘sensitive’ data, contrary to the judgment of the Supreme Court. In the ECtHR’s view, the sensitive nature of the data attracted a higher level of protection [112]. In this respect, the policy was not justifiable. It may be that such a finding is culturally sensitive – with knowledge of persons’ political opinions historically presenting less concern (and danger) in the UK than in other European countries.
For these reasons, the ECtHR allowed Mr Catt’s claim against the UK and held there to be an unlawful interference with Article 8.
Lessons for Police Forces
It does seem odd that the entirety of this case was decided on article 8 rather than the right of freedom of assembly under article 11. Regardless, since the ECtHR failed to determine decisively whether or not the UK’s police of data collection was or was not lawful, police forces can still take comfort in the decision of Lord Sumption in the Supreme Court. Police powers on collection and retention of data are founded in the Data Protection Act, the MoPI Code of Practice and Guidance, and common law.
However, the ECtHR’s obiter comments and concerns muddy the waters somewhat. It may be sensible for forces to ensure that their procedures for data collection identify some legal bases for collection.
Nonetheless, the ECtHR’s decision does highlight the importance of forces carrying out meaningful reviews of data retained. The data must be held for a legitimate policing purpose and in any event for no longer than necessary. It remains to be seen what impact GDPR and the Data Protection Act 2018 will have in this area.