Privacy International defends the right to privacy across the world, and fights surveillance and other intrusions into private life by governments and corporations. Read more »

Privacy and policing databases: European Court ruling in M.M v. the United Kingdom

In November 2012 the European Court of Human Rights (ECtHR) ruled in M.M v. the United Kingdom that retention and disclosure of a job applicant’s police records to potential employers was incompatible with the European Convention on Human Rights. The Court ruled that the practice cannot be regarded as being in accordance with the law. This judgment is a key step in establishing privacy rights over data held by the police, and comes at an important time when governments are rewriting the rules around data retention and disclosure practices in the criminal sphere. 

The case concerns M.M (the applicant) who abducted her grandson for three days in 2000 in order to prevent the girlfriend of her son from going back to Australia with the applicant’s grandson. The UK Director of Public Prosecutions considered the case as a family issue and a minor offence. He therefore administered a caution, instead of pursuing court proceedings. 

In 2003, in reply to a query from the applicant, the police advised that her caution would remain on records for five years. In 2006, M.M was rejected for a job dealing with childcare due to the disclosure of her criminal record. 

In 2008 regulations were established to identify when and how information could be disclosed when offenders apply for jobs dealing with children and vulnerable adults. The purpose of the regulatory change in 2008 was to increase security of vulnerable individuals after the Soham murders. However, the new regulations led to the more frequent disclosure of data related to with very minor offences.

Subsequent to these changes, the Criminal Records Office informed M.M. that all convictions and cautions where the injured party is a child are kept on the record system for life. 

When elaborating the permissibility of the retention and disclosure of M.M’s caution data, the ECtHR evaluated first the admissibility of the complaint under Article 8. Interestingly, the Court declared the case admissible not because the applicant exhausted all domestic remedies (as is usually required) but because the UK Government did not afford reasonable prospects of success when challenging data retention. The Court came to this conclusion since data retention and data disclosure practices had never been successfully challenged in the UK.

Subsequently the Court analysed whether the violation of M.M’s right to privacy was justified under Article 8(2). The Court concluded that the UK lacked a clear legislative framework for the collection and storage of data. There was no clarity as to the scope, extent and restrictions of the powers of the police to retain and disclose caution data. Additionally, there were no mechanisms for independent review of a decision to retain or disclose data, either under common law police powers or pursuant to Part V of the 1997 Police Act. Finally, the Court also noted the limited filtering arrangements in respect of disclosures: no distinction is made on the basis of “the nature of the offence, the disposal in the case, the time which has elapsed since the offence took place or the relevance of the data to the employment sought.”

Consequently, the Court concluded that retention and disclosure of the applicant’s caution data cannot be regarded as being in accordance with the law.The judgment shows that there is a strong need to restructure data retention and data disclosure practices in the UK policing and justice sector. This requires a re-assessment of what information necessarily needs to be obtained and retained by law enforcement in order to detect and prevent crime, and of what is an illegitimate intrusion to an individual’s private life. The core of this balancing act is the establishment of a precise and well-elaborated proportionality test. According to the ECtHR this test needs to encompass parameters like evaluating the nature of the law that governs data retention and disclosure. This includes the evaluation of factors like the law’s scope, clarity, accessibility, its restrictions, and the availability of independent review.  It also includes assessing the nature of the crime, namely the seriousness of the offence, the age of the offender, the sentence imposed and the time that has elapsed since the offence was committed. The ECtHR judgment in M.M. undeniably advances the right to privacy at a time when police are collecting, retaining, and sharing more information on UK citizens. Besides the judgement's importance on the national level, it is also of relevance in the European context. With the establishment of a European Criminal Records Information System (ECRIS) in 2012 criminal records can be easily exchanged between EU member states.1 ECRIS has been criticized for not including an independent overview instrument and for a lack of filtering mechanisms while exchanging data.2 Consequently, the M.M case transcends the national context by potentially triggering a re-consideration of the European Union criminal records system. 

Interestingly, instead of thinking about revising the current legal framework on disclosure of criminal records, the UK Home Office Minister James Brokenshire stated that the UK Government does not accept the findings of the ECtHR judgment and intends to appeal to the Grand Chamber. However, the Grand Chamber accepts appeal only on an exceptional basis making it uncertain that the case will be reconsidered.