Skip to main content
Legal case

Court of Appeal dismisses data retention appeal

YZ v Chief Constable of South Wales


The Court of Appeal dismissed an appeal in respect of a judicial review challenging the respondent’s decision to retain data on PNC and on local records relating to an allegation of three counts of rape for which the appellant had been acquitted. The Court of Appeal found that the retention of the data was in accordance with the national guidance; it was strictly necessary and proportionate in compliance with the Data Protection Act 2018 (‘DPA’) and any interference with the appellant’s Article 8 ECHR rights were lawful, necessary and proportionate.


In March 2018 the appellant made an application to ACRO for the deletion of his PNC record, DNA profile and fingerprint samples following an acquittal at trial for the charge of 3 counts of rape against his ex-wife. The request was forwarded to the respondent and the application was reviewed by the South Wales Police Record Deletion Panel (‘the panel’). A response was sent in May 2018 confirming that the DNA profile and fingerprint samples had been automatically deleted prior to the submission of the application, which left the issue of the data pertaining to the rape charges and acquittal on PNC remaining. The request for deletion was refused.

The appellant sought to challenge the panel’s decision by way of judicial review. Proceedings were issued and then stayed for the appellant to exhaust an informal internal appeal avenue. The request for deletion was reconsidered and in doing so the decision maker took into account all of the data relating to the appellant, that being data on PNC and local records which referenced the appellant’s extremist views, mental health and a history of allegations of domestic abuse and safeguarding concerns over his ex–wife and child. The decision maker upheld the panel’s decision.

In respect of each decision the relevant policy was applied by the decision makers. The policy applicable to requests for the deletion of records on the PNC was a national policy reflected in guidance published by the National Police Chiefs’ Council (“the Guidance”). It is of note that Guidance provides that:

  • Individuals seeking the deletion of an “Event History” from the PNC are encouraged to complete a formal application and state the grounds for having their records deleted.
  • 2.1. states that “Acquittal at court… is not in itself grounds for record deletion… Insufficient evidence to convict does not necessarily mean that there is sufficient evidence for an individual to be eliminated as a suspect.”

In respect of local records, the retention of such data is governed by Authorised Professional Practice on Management of Police Information published by the College of Policing (MoPI).

The judicial review recommenced challenging both the initial decision and the decision on appeal. In particular it was contended that the encouragement of individuals within the Guidance to give reasons as to why records should be deleted from PNC was incompatible with the first data protection principle, albeit no direct challenge as to the lawfulness of the policy reflected in the Guidance or MoPI was raised.

The application was dismissed. The judge found that the Guidance was compatible with the first data protection principle and the encouragement of individuals to give reasons did not detract from it. The judge pointed out that an individual may be able to put forward reasons, previously unknown to the controller, which make it unlawful or unfair to retain the data for law enforcement purposes. The judge further found that the processing of all the information on the claimant’s PNC record was strictly necessary for law enforcement, and the decision to retain it was rational and fair. He concluded that the challenged decision complied with the requirements of the DPA 2018 and in respect of the Article 8 challenge, the interference was in accordance with the law and in the interest of the prevention of crime or the protection of the rights of others, namely the appellant’s child and/or his former wife.

The appeal

It was challenged by way of appeal that the judge (1) erred in law in holding that the onus had not been placed on the appellant to justify the deletion of the data; (2) applied the wrong legal test, namely, a test of rationality, instead of the test of "strict necessity", and found that the decision was "rational and fair"  instead of asking whether it was lawful, fair and proportionate and carried out for a law enforcement purpose under the Data Protection Act 2018 s.31s.35(1) and s.35(2)(b); (3) erred in concluding that it was strictly necessary to retain the sensitive data; and (4) erred in holding that there was no breach of ECHR article 8 in retaining the data.

In a leading judgement given by Lady Justice Andrews, which was agreed by Lady Justice Simler and Lord Justice Peter Jackson, the appeal was dismissed on all grounds. The Court of Appeal determined that:

  • The judge was correct to reject the contention that the Guidance placed the burden on establishing compliance with the DPA on the applicant. The decision as to whether it was strictly necessary to retain data for law enforcement purposes remained a decision for the data control and that is clear from the Guidance when read as a whole.
  • Read in context, the judge's description of the decision to retain the sensitive information as "rational and fair" could not possibly be an application of the wrong legal test. He had said that the processing of all the information was strictly necessary for law enforcement, for the safeguarding of the child and/or the appellant's ex-wife. He then explained his own reasons for coming to that conclusion.
  • There was ample legal justification for retaining the information. A review of the information demonstrated that the safeguarding risk, and a further potential risk to members of the public, were genuine risks and that the retention of the information was indeed strictly necessary for law enforcement purposes. The fact that the appellant was charged with three counts of rape and subsequently acquitted was an important part of the overall picture. It was plainly necessary to retain that information and there was no justification for its deletion from the PNC (or local records) at this stage. The data was being retained in accordance with the application of the Guidance and MoPI APP.
  • In respect of the Article 8 ECHR challenge the court determined that it added nothing to the other grounds and could not stand alone. If the retention was compliant with the DPA, which it was, it was also compliant with Article 8 ECHR. The limited interference with the appellant’s right to a private life was plainly proportionate when balanced against the safeguarding and other risks identified by the police, and the purposes of law enforcement for which the data has been retained.


This succinct judgement is a useful judgement for legal practitioners and those within forces dealing with challenges to the ongoing retention of data on PNC and within local records to have in their armoury. The case usefully highlights that the fact of an acquittal does not automatically lead to an outcome that data concerning that crime should be deleted. If the force can show that the relevant policy/guidance was applied and that it is necessary and proportionate for the data to be retained for a law enforcement purpose any subsequent challenge to its retention should be capable of being contested.

For more information on the services that we can offer to police forces, please contact our emergency services lawyers. For guidance on data retention, contact our data protection solicitors.