Key paragraph(s) can be found below the document.
100. The Court has recently examined the provisions governing the retention of the data in the present case in M.M.¸ cited above. Those provisions were the Data Protection Act and the 2005 Code of Practice on the Management of Police Information. In the present case, those rules on retention of data stated that there was a presumption in favour of retention where data is not excessive, is necessary for a policing purpose, and is up to date. After the initial decision to retain, data must be retained for a minimum of six years. After that point it should be reviewed, and may be deleted. There is no fixed point in time identified for when reviews must take place, or when the data must be deleted. The police retain a general discretion to retain data if it is necessary to do so.
101. In M.M.¸ cited above, the Court found a violation of Article 8 on the basis that the retention and disclosure of personal data was not in accordance with the law. It observed that the indiscriminate and open-ended collection of criminal record data was unlikely to comply with the requirements of Article 8 in the absence of clear and detailed statutory regulations clarifying the safeguards applicable and setting out the rules governing, inter alia, the circumstances in which data can be collected, the duration of their storage, the use to which they can be put and the circumstances in which they may be destroyed. It also noted the absence of any mechanism for independent review of a decision to retain or disclose data (see M.M., cited above, §§ 199- 206).
102. However, whilst the provisions on retention of data in this case bear some similarity to those in M.M., other elements are not the same.
103. In the first instance, the Court notes that M.M. concerned the retention of criminal record data which the Court identified as not only personal but also sensitive, with “potentially devastating consequences” if disclosed. Moreover, the complaint in M.M. did not relate to police intelligence gathering but focussed on the disclosure regime for criminal records, and the Court criticised the absence of a statutory framework governing the (in some cases obligatory) communication of such data by the police to prospective employers in Northern Ireland at the time (see M.M., cited above, § 203).
104. Against this background, the Court also notes that in contrast to the applicant in M.M., the applicant in the present case had the possibility to make a request for the review and deletion of his data which he exercised (see a contrario M.M., cited above, § 206).
105. The Court has concerns about the ambiguity of the legal basis for the collection of the applicant’s personal data. In particular the Court notes the loosely defined notion of “domestic extremism” and the fact that applicant’s data could potentially be retained indefinitely. However, the data retained would not be disclosed to third parties; and the applicant had the possibility to apply for the deletion of his data.
106. In this connection, the Court recalls that the question of whether the collection, retention and use of the applicant’s personal data was in accordance with the law is closely related to the broader issue of whether the interference was necessary in a democratic society (S. and Marper, cited above, § 99, ECHR 2008).
117. As to whether there was a pressing need to collect the personal data about the applicant, the Court accepts that there was. It agrees with the Supreme Court that it is in the nature of intelligence gathering that the police will first need to collect the data, before evaluating its value (see paragraph 27, above). In this respect, the Court again recalls that the personal data in question was overtly obtained.
118. The Court also agrees with the domestic courts that the police had an obvious role to monitor protests of Smash EDO where the activities of that group were known to be violent and potentially criminal. Therefore, even if the applicant himself was not suspected of being directly involved in that group’s criminal activities, it was justifiable for the police to collect his personal data. He had after all decided to repeatedly and publicly align himself with the activities of a violent protest group.
119. As to whether there was a pressing need to retain the applicant’s data, the Court considers there was not. It shares the domestic courts’ concern that there is a need for caution before overriding the judgment of the police about what information is likely to assist them in their task (see paragraph 22 above). In this respect, the Court underlines that its conclusion does not call into question the fact that there may have been a pressing need for the police to retain the applicant’s personal data for a period of time after it was collected. However, in the absence of any rules setting a definitive maximum time limit on the retention of such data the applicant was entirely reliant on the diligent application of the highly flexible safeguards in the MOPI to ensure the proportionate retention of his data. Where the state chooses to put in place such a system, the necessity of the effective procedural safeguards becomes decisive (see mutatis mutandis S.M.M. v. the United Kingdom, no. 77450/12, § 84, 22 June 2017). Those safeguards must enable the deletion of any such data, once its continued retention becomes disproportionate.
122. Also, whilst the applicant could and did request the disclosure and destruction of his data, this safeguard appears to have been of limited impact given the refusal to delete his data or to provide any explanation for its continued retention – including the later disclosure without explanation of the retention of additional data (see paragraphs 11 and 15-17 above). So far as the Court is aware, at least some of the applicant’s personal data concerning his involvement in non-violent protest was collected over six years ago and remains in the domestic extremism database (see paragraph 16, above) despite the fact that the police concluded, and the domestic courts affirmed that the applicant was not considered a danger to anyone (see paragraph 31, above).
123. Moreover, the absence of effective safeguards was of particular concern in the present case, as personal data revealing political opinions attracts a heightened level of protection (see paragraph 112 above). Engaging in peaceful protest has specific protection under Article 11 of the Convention, which also contains special protection for trade unions, whose events the applicant attended (see paragraph 10, above). In this connection it notes that in the National Coordinator’s statement, the definition of “domestic extremism” refers to collection of data on groups and individuals who act “outside the democratic process”. Therefore, the police do not appear to have respected their own definition (fluid as it may have been (see paragraph 105)) in retaining data on the applicant’s association with peaceful, political events: such events are a vital part of the democratic process (see Gorzelik and Others v. Poland [GC], no. 44158/98, § 92, ECHR 2004‑I). The Court has already highlighted the danger of an ambiguous approach to the scope of data collection in the present case (see paragraph 97 above). Accordingly, it considers that the decisions to retain the applicant’s personal data did not take into account the heightened level of protection it attracted as data revealing a political opinion, and that in the circumstances its retention must have had a “chilling effect”.
124. Moreover, principle 2 on the collection of data in Recommendation R (87) 15 (see paragraph 65 above) states that the collection of data on individuals solely on the basis that they belong to particular movements or organisations which are not proscribed by law should be prohibited unless absolutely necessary or for the purposes of a particular inquiry (see mutatis mutandis Segerstedt-Wiberg and Others, cited above, § 79). The Court considers that the retention of the applicant’s data in particular concerning peaceful protest has neither been shown to be absolutely necessary, nor for the purposes of a particular inquiry.
127. Accordingly, the Court is not convinced that deletion of the data would be so burdensome as to render it unreasonable. In general terms the Court would add that it would be entirely contrary to the need to protect private life under Article 8 if the Government could create a database in such a manner that the data in it could not be easily reviewed or edited, and then use this development as a justification to refuse to remove information from that database.