Police storing images of millions of people thanks to “culture of retention”

We live in a world in which organisations of all kinds amass huge amounts of data about us. Online stores collect our names and addresses to help fulfil their deliveries, while our employers collect health and financial information. Organisations such as the police often store even more sensitive data, including images of our faces, our fingerprints, and even our DNA.

In this context, we must all confront the question: what do these organisations do with this data? With news stories of data breaches and cybercrime becoming ever more common, it’s vital that we can trust organisations to store our data appropriately – and only to keep what is necessary.

Unfortunately, recent news stories have revealed that police forces across the UK may be storing huge quantities of sensitive personal data about people who have never even been charged with a crime. This data poses a significant security threat if it’s not properly safeguarded – and it can even impact your reputation or your financial security.

In this post, we’ll look in more detail at the problem of unlawful retention of data in the police. We’ll explain the legal protections you have against indiscriminate data collection, and the steps you can take if you’ve been affected.

Unlawful retention of data by the police: A growing issue

In August 2023, the news organisation OpenDemocracy and the campaign group Liberty published the results of a joint investigation into retention of data by the police. The results were shocking, revealing a “culture of retention” among police forces that may have resulted in millions of people having their sensitive personal data stored for prolonged periods. Many of those affected have never been convicted or even charged with a crime.

The investigation centred on a number of reports by the government’s biometrics and surveillance commissioner, Fraser Sampson. Sampson, who stepped down in October 2023, was responsible for ensuring that government bodies and local authorities used biometrics and surveillance in an appropriate and responsible way.

According to Sampson, UK police forces were repeatedly failing to abide by data protection regulations, with retention of data being a particular issue. Across two years of investigations, 17 police forces were found to have data protection issues. Custody images were a repeated concern – more than half of the police forces examined were found to be retaining them indefinitely.

Despite the watchdog raising these issues on multiple occasions, it seems that no progress has been made. In February 2023, Sampson made clear to the government’s Joint Committee on Human Rights that, despite the practice being ruled illegal in 2012, many forces were routinely keeping custody images and fingerprints, even if no further action was taken against the suspect. This amounted to “several million” records.

In response to the Liberty and OpenDemocracy reports, Sampson was even more explicit: “It really isn’t good enough. Not only do you have potentially millions of people whose images are in police records, even though there are no guilty findings against them, but you can’t even know how many there are… It is an intractable problem.”

This leaves people who have been taken into custody but not charged or convicted of a crime in a difficult position. The police may well be retaining your sensitive personal data for no defined purpose – data that is at risk of being exposed in a data breach.

Let’s look more closely at the legal protections you have against this kind of data retention.

What is the law around police retention of data?

The UK currently has two key pieces of legislation related to data protection: the UK General Data Protection Regulation (GDPR) and the Data Protection Act (DPA) 2018. The GDPR and the DPA 2018 are both designed to ensure that organisations only collect and retain your personal data for a defined and legitimate purpose.

In the case of the police, there are many reasons why they may need to legitimately collect and store your personal data. For instance, if you are a suspect in an ongoing investigation or you have been a victim of crime, they will need to have access to a range of personal information to support their work.

However, this does not mean they can indiscriminately collect your personal data and store it as long as they wish. Any data collected or retained by police forces must have an explicit and legitimate purpose. Further, it must not be retained any longer than is necessary for that purpose – that is, it cannot be retained “by default”.

The risks of police retention of data

If the police do store your personal data without good reason, this can be a deeply concerning matter. You may understandably object to this as an infringement of your right to respect for your private and family life. But there are also specific risks you can face as a result of this retention of data.

A number of recent news stories have revealed the danger of having your personal data exposed through a police data breach or cyberattack. For instance, in 2023 the Suffolk and Norfolk Police Forces both suffered significant data breaches, resulting in 1,230 people – including victims of crime and witnesses – having their data exposed to the general public.

There are also concerns about the use the police could make of this data. Fraser Sampson, in his comments to Liberty and OpenDemocracy, noted that some police forces were routinely using fingerprints of arrestees to perform immigration checks as standard, without any legitimate reason to do so.

Can I claim compensation for police retention of data?

The UK’s data protection regulations don’t just set out strict guidelines that organisations must follow when it comes to processing and storing personal data. They also guarantee you the right to seek compensation if an organisation has unlawfully stored your data and this has led to damages.

When it comes to unlawful retention of data by the police, the damage this can cause can be significant. It can lead to anything from financial losses and reputational damage to distress and anxiety. In a recent landmark ruling, a judge awarded £36,000 in compensation to a man who had experienced severe distress after the police retained Occurrence Summary Reports (OSRs) without appropriate justification.

In order to seek compensation for the police retaining your data unlawfully, you’ll need to take the police force responsible to court as part of a civil action against the police. While this may seem like a significant step, with the support of an experienced solicitor you can secure the compensation you deserve while receiving tailored support to ensure the process is simple and streamlined.

HNK Solicitors can support your unlawful retention of data claim

The police – like many other organisations – are collecting and storing ever-larger amounts of our personal data. As advances in facial recognition and biometric data processing continue, this indiscriminate data collection can pose significant risks. Thankfully, the UK’s data protection regulations are designed to safeguard against unlawful retention of your personal data – and that includes giving you the right to seek compensation.

Here at HNK Solicitors, we have extensive expertise in both data breach claims and civil actions against the police. This unique combination ensures we can help our clients achieve the best possible results and ensure they secure the full amount of compensation they are entitled to. In one recent case, we were able to secure a £10,900 settlement from Bedfordshire Police following their unlawful retention of our client’s data.

If you have suffered damages due to the police unlawfully retaining your data, we can help. We offer free consultations in which you can discuss your case with one of our experts, who will be able to advise you on whether you could be entitled to compensation. If we believe you are owed compensation, we can offer to take up your claim on a no-win, no-fee basis.

Get in touch today to arrange your free consultation – you can call us on 0151 668 0809, or email us at enquiries@hnksolicitors.com.