Indefinite police retention of DNA, fingerprints and photos held a violation of Article 8

The applicant, Mr Gaughran, was arrested in Northern Ireland in 2008 for driving with excess alcohol, following which his fingerprints, a photograph and a non-intimate DNA sample were taken from him. Mr Gaughran pleaded guilty when he appeared at the Magistrates’ Court. He was fined £50 and disqualified from driving for twelve months.

A little over two months after Mr Gaughran’s guilty plea, his solicitor wrote to the Police Service of Northern Ireland, claiming the retention of Mr Gaughran’s photograph, fingerprints and DNA sample was unlawful and requesting they be destroyed or returned to him. When they did not do so, Mr Gaughran brought an application for judicial review, in which the High Court found that the retention of his biometric data was an interference under Article 8 of the Convention (right to respect for private life) but that the interference was justified and not disproportionate. Among the reasons given by the court for this finding was that the building up of a database of such data from those convicted of offences provides a very useful and proven resource in the battle against crime.

On appeal, the Supreme Court of the United Kingdom also found the indefinite retention of Mr Gaughran’s data proportionate. Having considered the ECtHR’s judgment in S. and Marper v. the United Kingdom [GC] nos. 30562/04 and 30566/04, in which it was held that the indefinite retention of an “unconvicted” person’s data was a disproportionate breach of Article 8, the Supreme Court held the ruling only extended to unconvicted persons. As Mr Gaughran had been convicted, the Supreme Court held that the retention of his personal data fell within the state’s margin of appreciation, despite his conviction being spent some 18 months earlier.

The ECtHR, however, disagreed. While it held the retention of biometric data and photographs pursues the legitimate aim of the detection and, therefore, prevention of crime, it could not conclude that the state’s margin of appreciation was widened to the extent claimed by the UK government. Rather, it found that the indiscriminate nature of the state’s powers of retention in respect of Mr Gaughran’s DNA profile, fingerprints and photograph, without reference to the seriousness of his offence or the need to retain his personal data indefinitely and in the absence of any real possibility of review, constituted a disproportionate interference with his right to respect for private life and could not be regarded necessary in a democratic society.

The ECtHR’s judgment is particularly interesting for its finding that the retention of Mr Gaughran’s photographs (in addition to his biometric data) amounted to an interference with his Article 8 rights. The Court has not previously considered the retention of custody photographs to breach Article 8. Its shift perhaps reflects its acknowledgement in the judgment of rapid advances in facial recognition and facial mapping technology. The Court appears to be recognising that the gap is narrowing between data sources that have historically been viewed as containing less information (such as fingerprints) and those which contain more extensive data (such as DNA profiles).

As governments build and store increasingly complex profiles of citizens’ lives, drawing in personal data from CCTV cameras and other forms of surveillance (like contact-tracing apps, as the current pandemic has made prominent), judgments such as Gaughran may become all the more important for questioning where the boundaries of personal data are and for shaping personal data retention and review policies.