Local authority data retention: Upholding human rights

Data protection iStock 000011177922XSmall 146X219Emily Heard and Emma Godding consider the significance of two judgments on data retention by public bodies, one where it was found to be lawful and the other where the authority involved came unstuck.

There is a rapidly growing body of both European and domestic case law on the lawfulness of data retention practices. This article considers two cases that came before the courts in 2013, and suggests how public bodies can ensure that their data retention policies comply with this developing area of law. This is particularly relevant to local authority housing departments, which process large volumes of tenants’ personal data, often spanning a number of years.

A case of unlawful retention

This issue came before the Court of Appeal in March 2013 in the case of R (T) v Commissioner of Police for the Metropolis [2013] EWCA Civ 192.

Ms T was a housing association tenant. She complained about anti social behaviour from her neighbour. He made similar complaints about her, including one allegation that she directed a homophobic comment towards him. Ms T’s neighbour was informed that a warning letter would be sent. The Metropolitan Police wrote to Ms T about that allegation, explaining that a complaint had been made, and that any further allegations of similar conduct might lead to her arrest and prosecution. The allegation was strenuously denied by Ms T and she complained that she had been given no opportunity to respond to the allegation. In accordance with the Metropolitan Police’s usual policies and practices, the letter would have remained on the police file for 12 years.

Ms T brought judicial review proceedings against the Metropolitan Police seeking an order that the letter be destroyed and that all records of and references to it be removed from the police computer. In the High Court her application was refused but the Court of Appeal allowed her appeal.

The Court of Appeal found that the processing and retention of the personal data contained within the letter amounted to an unlawful interference with Ms T’s right to respect for her private life, unless such processing and retention could be justified as a proportionate means of achieving a legitimate aim.

The Court of Appeal had no difficulty in finding that retention of the data pursued a legitimate aim, namely the prevention and detection of crime and the protection of others. However, the court found that retention of the letter on the police files for 12 years was disproportionate and therefore unlawful. The court accepted that retention of the letter served a useful social purpose but noted that the police’s blanket policy of retaining all reports for 12 years failed to discriminate between serious offences, minor offences, and incidents that did not amount to any offence at all.

The court accepted that retention of the letter would be justifiable in the short term in order to check whether the conduct alleged was part of a pattern of behaviour that amounted to harassment. However, the court said it was difficult to see how retention for a longer period could possibly be of assistance in connection with such a prosecution, or what other use it might have. Continued retention of the letter would serve no useful purpose and was unnecessary, disproportionate and unjustifiable.

Having found that retention of the letter amounted to a breach of Art.8 ECHR (right to a private life), the court did not find it necessary to conduct an analysis of the case through the prism of the Data Protection Act 1998. However, it is suggested that such an analysis would have led the court to the same conclusion. The fifth Data Protection Principle is that “personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes”. This requires organisations to review the length of time that personal data is retained, and to securely delete it once it is no longer required for the purpose for which it was originally obtained. If there had been no further complaints of harassment within a proportionate period (which the court suggested on the facts would be no more than one year), retention of the letter would have ceased to be necessary for the purposes for which it was originally created.

A case of lawful retention

The Court of Appeal stressed that such cases will turn on their own facts, and this was demonstrated almost immediately by the next occasion on which the courts were asked to grapple with this question. R (TD) v Commissioner of Police for the Metropolis and the Secretary of State for the Home Department [2013] EWHC 2231 concerned an unsubstantiated allegation of rape some nine years previously. The claimant challenged the retention of 40 pages of information relating to the allegation and his arrest. The court readily accepted that the retention of that information amounted to an interference with the individual’s Article 8 rights.

The court identified the essential question in the case as the length of time that the information would be retained. The role of the court was to strike a balance between the individual’s Article 8 rights and the use to which the police legitimately put the information. The fact that information may be of use in the future did not, on its own, justify its retention. Considering the seriousness of the allegation (while being careful to avoid any suggestion that the allegation had any foundation), the length of time that had elapsed since the allegation, and that the information could only be accessed by those investigating crime, the court found that retention was justified for the time being. The court made the important qualification that the retention must be subject to review, and that the absence of a review provision in the relevant retention policy was a significant flaw.

Learning points for public authorities

European and domestic jurisprudence clearly suggests that the retention of information about unproven allegations of criminal or anti-social behaviour will prima facie amount to an interference of the individual’s Article 8 rights and therefore has to be justified and proportionate.

What is a proportionate period of retention will depend on a number of factors, including the nature of the allegation, whether there have been subsequent allegations of a similar nature, and whether retention is subject to review.

Public authorities should:

  • ensure that data retention policies and schedules are reviewed to ensure compliance with the law as it develops
  • provide training to staff on data retention and ensure that staff are familiar with your policy in this area
  • review the length of time that personal data is retained on file on a case by case basis
  • always consider the purpose for which you hold personal data when deciding if (and for how long) to retain it
  • securely delete personal data once it is no longer needed for that purpose
  • update, archive or securely delete information if it goes out of date.

Emily Heard is a partner and Emma Godding is a solicitor at Bevan Brittan. Emily can be reached on 0870 194 8997 or This email address is being protected from spambots. You need JavaScript enabled to view it.. Emma can be contacted on 0870 194 8998 or This email address is being protected from spambots. You need JavaScript enabled to view it..