Human rights ruling against UK in police data case
The United Kingdom has been found in breach of the European Convention on Human Rights in the case of a Northern Ireland man who complained of the indefinite retention of his personal data by the police following his conviction for drink driving.
A seven judge chamber of the European Court of Human Rights in Strasbourg unanimously ruled that there had been a violation of article 8, the right to respect for private and family life, in the case of Fergus Gaughran, from Newry, who was caught driving with excess breath alcohol in October 2008.
Mr Gaughran pleaded guilty and was fined and disqualified from driving for 12 months. The police also took his photograph, fingerprints and a DNA sample. His conviction became spent in 2013 and his DNA sample was destroyed in 2015 at his request. However the Police Service of Northern Ireland (“PSNI”) continued to retain on an indefinite basis the DNA profile (digital data) extracted from his DNA sample, his fingerprints and photograph. He unsuccessfully challenged the PSNI’s continued retention of his data in the domestic courts.
In finding a violation the court underlined that it was not the duration of the retention of data that had been decisive, but the absence of certain safeguards. In Mr Gaughran's personal data had been retained indefinitely without consideration of the seriousness of his offence, the need for indefinite retention and without any real possibility of review. Noting that the technology being used had been shown to be more sophisticated than that considered by the domestic courts in this case, particularly regarding storage and analysis of photographs, the court considered that the retention of the applicant’s data had failed to strike a fair balance between the competing public and private interests.
The court considered that the majority of member states had regimes which put a time limit on retaining the biometric data, that is, fingerprints and DNA profiles, of convicted persons. The UK was one of the few Council of Europe jurisdictions to permit indefinite retention of DNA profiles. The margin of appreciation, in particular in respect of DNA profiles, had therefore been narrowed.
Having chosen to allocate itself the most extensive power of indefinite retention, the UK had put itself at the limit of the margin of appreciation. So, it had to ensure that certain safeguards were present and effective for the applicant. However, the applicant’s biometric data and photographs had been retained without reference to the seriousness of his offence and without regard to any continuing need to retain that data indefinitely. Moreover, the police in Northern Ireland were only empowered to delete biometric data and photographs in exceptional circumstances. Therefore the applicant could not request a review of the retention of his data, as there was no provision permitting deletion if conserving the data no longer appeared necessary in view of the nature of his offence, his age, or the time that had elapsed and his current personality.
The court held that the finding of a violation was in itself sufficient just satisfaction for any non-pecuniary damage sustained.