Enhanced Disclosure V

A recent appeal before the Information Tribunal found that three Police Forces had contravened the Data Protection Act by actively disclosing to the PNC and third bodies ancient history offences.

Extract from conclusions of Information Tribunal, 20th July 2008

"Conclusion and remedy

205. The Tribunal accepts that it is a police purpose to disclose conviction data held on the PNC to bodies such as the CRB and ISA who require such information in order to undertake their statutory duties. However the Tribunal finds that this does not mean that Chief Constables are required to retain conviction data on the PNC, in effect, indefinitely even if no longer required for their core purposes. Chief Constables are required to process personal data including conviction data in accordance with their statutory obligations under the DPA and HRA. If such compliance requires the erasure of conviction data, as seems to be accepted by the Appellants that it does for soft criminal intelligence or data, then that information will no longer be held on the PNC. This does not mean that the police are in breach of other statutory obligations because these other obligations, as explained above, in our view go no further than require the police to disclose information held on the PNC.

This position has existed for many years with the weeding of conviction data in England and Wales up until 2006 and seems to exist quite happily in Scotland up to this very day. If the government requires a different regime to operate then it will need to legislate accordingly with all the necessary safeguards that would be considered appropriate.

206. We find that the responsibility for complying with the DPPs is that of the data controllers in these appeals namely the Chief Constables of the police forces involved, not ACPO. Any advice or guidance from ACPO cannot replace this responsibility under the DPA. The Chief Constables responsibility is to consider each case for the stepping out of conviction data on its own individual merits taking into account all the circumstances including any advice from ACPO in accordance with the DPA. This clearly happened in the case of GMP2.

207. Having considered all the evidence and arguments of the parties in these appeals and that the burden of proof lies on the Commissioner we uphold the Enforcement Notices in these particular cases and dismiss the appeals. We require the Appellants to erase the conviction data in question from the PNC within 35 days of the date of this decision.

208. In view of this finding we do not find it necessary to make a decision on the issue raised by Home Office in paragraph 86.1 above, namely whether disclosure of the conviction data at issue in these appeals under Part V of the Police Act 1997 and in the future under SVGA 2006 is lawful and does not infringe the Data Protection Principles and Article 8 ECHR. This is because as we are upholding the Enforcement Notices which require the erasure of the conviction data at issue in these appeals, the question of the disclosure of this personal data in the future under these provisions no longer arises.

209. The Tribunal would observe that the 2006 Guidelines do not appear to be a suitable approach to the retention of conviction data in order to comply with the DPA. ACPO seems to have ignored the guidance provided in the 2005 Tribunal decision at paragraph 225 of the judgment in relation to stepping out of conviction data. We appreciate that policing requirements have changed since that decision but the 2006 Guidelines do not appear to us to even attempt to provide a proper consideration of DPPs 3 and 5 in contrast to other police codes referred to in this decision.

210. Our decision is unanimous."