Are the police unlawfully retaining your data?

In order to investigate crimes and protect the public, the police collect large amounts of highly sensitive personal data. This includes everything from names and addresses to criminal records and even biometric information such as fingerprints and DNA profiles.

While gathering and storing this kind of data is essential for the police to perform their role, it also poses a risk to the public. If the police don’t protect your personal data properly, this can have serious repercussions. It can result in identity theft, financial losses and reputational damage, as well as anxiety and distress.

That’s why the police are only allowed to collect and store your personal data for certain purposes. There are also limits on how long the police can retain your personal data. If they store your data longer than is necessary and without a valid reason, they may be breaking the law and infringing on your human rights. As a result, you may be entitled to compensation.

In this post, we’ll look at some recent news stories that have highlighted this issue, as well as exploring the legal background. Finally, we’ll explain how you can seek compensation if you believe the police have unlawfully retained your data.

The legal challenge to the Gangs Violence Matrix

A number of recent legal rulings, alongside investigations by journalists and civil rights groups, have revealed that police forces across the country may be storing personal data without legal justification. It has become increasingly clear that this is not only a breach of data protection regulations, but that it can pose a significant risk to those whose data is being retained.

The issue of retention of data by police made headlines in 2022 when the Metropolitan Police was forced to accept that its controversial “Gangs Violence Matrix” was unlawful. This database was established in 2012 to monitor those considered to be at risk of committing gang violence. At its peak, the database held the details of 3881 people.

The admission that the Matrix was unlawful – which ultimately resulted in the database being scrapped entirely – was the result of a legal challenge by the campaign group Liberty. It was argued that the database breached the human rights of those included – particularly Article 8 of the Human Rights Act 1998, the right to respect for your private and family life.

Further, the database also disproportionately affected Black people – 80% of those named in the database were Black as of 2022. This served to highlight ongoing debates around the institutional racism of the police.

A landmark case on unlawful retention of data

The decision to overhaul the Gangs Violence Matrix was followed by an in-depth investigation by Liberty, alongside the news organisation OpenDemocracy, into unlawful retention of data by the police. This investigation found that police forces across the UK were unlawfully retaining information about people who had been arrested and then released. According to Liberty’s analysis, there were potentially millions of people who had never been charged with a crime but who had custody images retained by the police.

In October 2022, a landmark case revealed the distress that this kind of unlawful retention of data can cause for those affected – and the compensation they could be owed as a result. AB, an autistic man in his early 30s had been accused on two occasions of inappropriately touching women on public transport. AB maintained that, in both cases, he was “stimming” – rubbing fabric between his fingers – as a coping mechanism for anxiety. He claimed this was misinterpreted by the two women who had made complaints against him.

While he was not prosecuted on either occasion, the police force retained Occurrence Summary Reports (OCRs) referring to accusations of sexual assault against him. AB’s parents complained on numerous occasions about the accuracy of the records, and AB suffered significant mental distress due to their being retained.

Ultimately, a judge ruled that the OSRs had contained inaccurate information and that the retention of this data was “not proportionate to the policing purposes said to justify retention”. Given the impact this had on AB, the judge awarded £36,000 in damages. Further, the police were ordered to delete records of these historic complaints.

What is the law around police retention of data?

As this particular case clearly shows, police retention of data can be deeply distressing, particularly for those who were suspected of a crime but not subsequently prosecuted or convicted. With this in mind, it’s important to know that there are legal limits on the data that the police can retain.

The UK’s data protection legislation – principally the Data Protection Act (DPA) 2018 and the UK General Data Protection Regulation (GDPR) – acknowledges that the police have to store and retain sensitive personal data to safeguard the public and investigate crimes. But this must be balanced against our right to privacy and to retain control over our personal information.

The DPA 2018 sets out clear principles that govern the collection and storage of personal data for law enforcement purposes. These principles state that the data collected must be used for some explicit and legitimate law enforcement reason, and that the data collected must not be excessive for this purpose. The data must be accurate and kept up-to-date, and it should not be retained for any longer than is necessary for the stated purpose.

This final point is particularly important. As the College of Police’s Code of Practice on police information and records management states, it is essential that “retention of information is the product of a deliberate and purposive decision, rather than a default position of non-deletion.”

What are the risks of the police unlawfully retaining my data?

The unlawful retention of data by the police can have a wide range of negative consequences for those affected. In the first instance, there is the ever-present risk of data breaches. A number of UK police forces have suffered significant data breaches in recent years, including a high-profile incident involving the Police Force of Northern Ireland (PFNI) in August 2023.

While the PFNI breach affected the data of officers and staff rather than members of the public, an independent review called the incident “a wake-up call for every force across the UK to take the security of data as seriously as possible”. The PFNI has since been fined £750,000 by the Information Commissioner’s Office (ICO), which found that the “internal procedures and sign-off protocols for the safe disclosure of information were inadequate.”

There have been other recent incidents which have directly affected both suspects and victims of crime, including the Suffolk Police data breach. This incident involved 1,230 people having their data made public on the force’s website for a brief period.

The risks of your data being exposed unintentionally is no doubt deeply concerning. But you may also worry that the police could share your data with employers – through a DBS check, for instance – or with social services. If this information is inaccurate or should not have been retained in the first place, this can lead to reputational damage and loss of income.

Ultimately, even if your data is not exposed in a breach, the simple fact that it is being unlawfully retained by the police can lead to significant stress and anxiety. The recognition of this fact was key to the judge’s decision to award damages to AB in the case discussed above.

Can I claim compensation if the police unlawfully retain my data?

Recent news stories have brought to light the fact that many police forces across the UK may be unlawfully retaining data. Importantly, they’ve also highlighted that there are steps you can take to seek redress if you are affected. This includes seeking compensation through civil action against the police.

HNK Solicitors recently pursued such an action against the police on behalf of our client, W. Our client had been arrested by Bedfordshire Police but subsequently released without further investigation or any action being taken. However, Bedfordshire Police retained W’s personal data, including their:

• Name
• Address
• Ethnicity
• DOB
• Gender
• Occupation
• Telephone number
• Biometric data (special category data)

This data was not being retained for any lawful purpose, and its retention caused significant anxiety to W, who was particularly concerned that their data had been shared with social services and their daughter’s school. In recognition of the distress caused to W, the claim was ultimately settled for £10,900.

HNK Solicitors can support your unlawful retention of data claim

Recent legal cases and investigations by media organisations have shown the extent to which the police may be unlawfully retaining data. With millions of people potentially affected, it’s important to be aware of the risks of your data being retained in this way by the police – and the steps you can take if you’ve been impacted.

Here at HNK Solicitors, we have extensive experience pursuing both civil actions against the police and data breach claims. As a result of this combined expertise, we can provide in-depth and tailored support for your unlawful retention of data claim.

If you believe the police have unlawfully retained your data, get in touch with us today for a free consultation. One of our highly experienced solicitors will discuss your case and assess whether you may be entitled to compensation. If we do think you are owed compensation, we can offer to take up your case on a no-win, no-fee basis.

To arrange your consultation, call us on 0151 668 0809, or email us at enquiries@hnksolicitors.com.