R (on the application of YZ) v Chief Constable of South Wales Police 2021

In 2016, YZ stood trial for three counts of raping his ex-wife during their marriage.  YZ was a Moroccan national and his wife was British with Pakistani heritage.  YZ was acquitted on each count. However, details of the acquittals, and other details about YZ, remained on the Police National Computer (PNC).

YZ applied to the Records Deletion Unit (RDU) of the Criminal Records Office (ACRO) for the deletion of all of his personal data held on PNC. On the application form, YZ stated the grounds for deletion as "unlawfully taken" and "malicious / false allegation."

An exchange of communication ensued and resulted in YZ receiving a letter from the RDU informing him that his application had not been agreed, as there was no evidence that his case was based on a malicious or false allegation and that the PNC record will be retained until YZ was deemed to reach 100 years of age, as per guidance produced by the National Police Chief's Council. YZ was informed that his biometric data had already been automatically deleted in accordance with the Protection of Freedoms Act 2021.

YZ’s solicitors unsuccessfully appealed the decision.

YZ applied for judicial review of C’s refusal to delete his personal data which was held on PNC.

C submitted the witness statement of the member of staff from the RDU, R, who dealt with YZ’s appeal. In that statement, R stated that YZ’s application for deletion had been put on the basis that the allegations of his former wife against him were false and malicious and that his DNA and fingerprints had been unlawfully taken. R said that this request was considered by C's record deletion panel. The panel did not find any firm evidence to support the suggestion that the allegations were malicious or that YZ was dealt with unlawfully and accordingly refused the application. R also referred to other personal data of R held by C in the occurrence logs.  This included information relating to his child and concerns for their welfare and safety and how YZ had expressed extreme views such as him agreeing with suicide bombings and the actions of the Taliban. The rape case was the only apparent evidence of the potential for sexual harm, but these intelligence reports supported the potential risk of further violence. Police concerns that YZ presented himself as a liar were also documented.

YZ submitted that the provisions in the retention guidance were incompatible with the Data Protection Act 2018 (DPA) and this Act must prevail. The guidance provided that the basis for record deletion would be that an individual was no longer a suspect for the offence for which they were arrested or summonsed, that is that they have been eliminated from enquiries based on the grounds set out in Annex B. Annex B sets out that there are no set criteria for the deletion of records but that it was for chief officers to exercise professional judgment based on the information available but would include, for example, malicious or false allegations. The guidance also stated acquittal at court, dismissal at court, or a conviction being overturned on appeal or by other judicial process, is not itself ground for record deletion; insufficient evidence to convict does not necessarily mean there is sufficient evidence to be eliminated as a suspect. 

YZ stated that section 34(3) of the DPA provides that the controller in relation to personal data, is responsible for, and must be able to demonstrate, compliance with that chapter of the Act. It was asserted that the guidance was not compatible with section 35 of the DPA where the processing of personal data for any of the law enforcement purposes must be lawful and fair, because it put the onus on an applicant for deletion to give reasons for the deletion.

YZ also submitted that this was not compatible with his rights under Article 8 of the European Convention of Human Rights; his right to respect for private and family life.


Claim dismissed.

The guidance, in encouraging individuals to give reasons why records should be deleted from the PNC, does not detract from the principle that it is for the controller to demonstrate compliance with the DPA and that processing for law enforcement purposes must be lawful and fair in the ways set out in section 35.

The requirement in the guidance for positive evidence that an individual is no longer a suspect for the offence for which they were arrested or summonsed, that is that they have been eliminated from enquiries, must be read in the context that the elimination of an individual as a suspect, the withdrawal of an allegation, or a case not proceeded with because of a technical legal argument, does not itself mean that there is sufficient evidence to provide a basis for the deletion of their PNC record. It was held that this did not put the onus of proof on the application and it merely meant that something more may be required than such elimination or withdrawal.

R had not approached his decision on the basis that it was for YZ to show that his record should be deleted. R had given regard to all of the evidence at the trial to establish whether there was evidence that the allegations were malicious, and he was entitled to decide that they were not.

What was being considered in deciding whether or not to delete YZ’s data from the PNC was the issue of law enforcement and the safeguarding of individuals and in particular the welfare of YZ’s child and former wife. Therefore, it was a question of taking the allegations into account with other information to decide whether retention was necessary. It was found that the processing of all the information on YZ’s PNC record was strictly necessary for law enforcement, for the safeguarding of the child of the relationship and/or his former wife, and the guidance does amount to a policy within the meaning of that subsection. The information, taken as a whole, dealt with the risk which YZ posed to his former wife and child. The information relating to YZ's religious or political views went further than just recording such views because it included concerns of extremism, which impacted upon the safeguarding concerns. The decision to retain it was found to be rational and fair.

Further, C had shown that the 100-year rule was justified on the facts of this case, even without convictions. Although the risk to the child, and perhaps to YZ's former wife, would likely diminish in time, it could not be said that it would diminish to the point of insignificance in YZ's lifetime.

In relation to the Article 8 submission, the retention of data on PNC amounts, or can amount, to interference with the rights of the individual concerned. However, having found that the retention of the data on YZ's PNC record was in accordance with the law it was also in the interest of the prevention of crime or for the protection of the rights of others, namely YZ's child and / or his former wife.

To read more legislation about this, login to the legal database.