Police retention of biometric data

In its recent decision in Gaughran v United Kingdom (13th February 2020), the First Section of the European Court of Human Rights held that a policy of retaining a convicted person’s DNA profile, fingerprints and photograph on a police database (Northern Ireland) is a breach of the person’s right to privacy under Article 8 of the European Convention on Human Rights...


Before 2012, it was standard practice for the police to take the fingerprints, photograph and a DNA sample (from which a DNA profile was extracted) from a person arrested for, or convicted of, a criminal offence. The DNA profiles, fingerprints and photographs (hereafter referred to collectively as biometric data) were then retained indefinitely on a police national database, even where the persons in question were not actually charged with, or convicted of, an offence. The purported justification for such a gross encroachment on the privacy and personal rights of the individual was the perceived value of the resultant database in the investigation and detection of crime.

In S & Marper v UK (2008), the Grand Chamber of the European Court of Human Rights  held that the indefinite retention of the fingerprints and DNA profile of a person taken consequent to his or her arrest was a breach of the right to privacy, as guaranteed by Article 8 of the European Convention on Human Rights (ECHR). The Court acknowledged that these intimate identifying features were a valuable resource in the detection and prevention of crime. However, it found that it would be a disproportionate interference in the private life of a person to retain them indefinitely, where that person had not been charged and/or convicted of an offence.

The decision in S & Marper was limited to persons who were not subsequently charged or convicted. The question remained, therefore, whether it would also be a breach of the ECHR to retain a person’s biometric data where they had been convicted of a criminal offence. That question was addressed by a Chamber (First Section) of the European Court a few weeks ago in Gaughran v United Kingdom, Application No.4524/15 (13th February 2020).

The Facts

In October 2008, the applicant was arrested on suspicion of driving with excess alcohol in the blood in Northern Ireland. The offence in question was a recordable offence, which broadly covers any offence punishable on conviction by a term of imprisonment. The applicant was brought to a police station where the police took, among other things, his fingerprints, photograph and a DNA sample by a buccal swab (from the inside of his cheek). His DNA profile was extracted from the sample.

In November 2009, the applicant pleaded guilty to the offence of driving with excess alcohol in the blood. He was fined £50 and suspended from driving for 12 months. Under the rehabilitation of offences legislation, his conviction was spent after five years. This meant that from November 2014 evidence could not be admitted in any proceedings to prove that he had been charged with, prosecuted, convicted or sentenced for the offence. His only previous criminal conviction was for disorderly behaviour in 1990 when he was 17 years of age, and for which he was fined £25.

Two months after his conviction, the applicant’s solicitor wrote to the police requesting that his fingerprints, photograph (custody image), DNA sample and DNA profile be destroyed or returned to him. The DNA sample was eventually destroyed in 2015, but the police refused to destroy or return the fingerprints, photograph or DNA sample, and made it clear that they would retain them indefinitely.

Domestic law

The Protection of Freedoms Act 2012 was enacted, among other things, to bring the law in England and Wales into line with the decision of the European Court of Human Rights in S & Marper. The Act imposed strict limits on the retention of the DNA profile and fingerprints of a person who had been arrested for an offence but not charged or convicted. However, it left intact their indefinite retention where the person concerned was convicted of a recordable offence (and it permitted rolling retention for national security purposes).

The issue of retention of an arrested person’s photograph did not arise in the S & Marper case (or the 2012 Act). Subsequently, however, in RMC and FJ v Commissioner of Police for the Metropolis and Secretary of State for the Home Department [2012] EWHC 1681, a Queen’s Bench Divisional Court in England and Wales held that the S & Marper principle also applied to the retention of photographs.

In 2017, UK government guidelines stated that an individual convicted of a non-serious recordable offence should be able to apply to have their custody image deleted six years after conviction. In such cases, there is a presumption in favour of deletion. Police forces were required to review the custody images they held, and to update their retention policy, in accordance with the guidelines. These, and other associated privacy-friendly changes, were prompted partly by advances in technology which rendered the images searchable using facial recognition software.

Surprisingly, perhaps, the law in Northern Ireland was not brought into line with the requirements of the S & Marper decision. The police there continued to take and retain the DNA profile, fingerprints (and photograph) of a person arrested for a recordable offence, irrespective of whether he or she was subsequently charged with or convicted of an offence.

The continuance of the old non-ECHR compliant regime in Northern Ireland was explained, unconvincingly, by a combination of confusion over the division of competence in the matter between the Northern Ireland Assembly and the Westminster Parliament, technical issues, drafting errors and the dissolution of the Northern Ireland Assembly. One could also suspect the continued influence of the old ‘police state’ mentality among some powerful political and security sectors in Northern Ireland.

Domestic decisions

The applicant in Gaughran sought a judicial review of the police refusal to delete or return his biometric data. He argued that their policy of indefinite retention constituted a breach of his right to privacy under Article 8 ECHR. The High Court of Northern Ireland accepted that there was an interference with his privacy, but it also held that it was justified and proportionate within the scope of Article 8 in the interests of the prevention and detection of crime. In particular, the Court considered that adopting a conviction for a recordable offence as the threshold for indefinite retention reflected an appropriate balance between the individual right to privacy and the public interest in the detection and prevention of crime.

The UK Supreme Court upheld the High Court’s decision by a majority of four to one. As well as agreeing with the High Court’s approach, the majority attached some importance to the apparent diversity of approach among Council of Europe Member States on retention policy in respect of convicted persons. It considered that this left individual States with a wide margin of appreciation (or discretion) to set their own policy. Significantly, on the specific issue of retaining his photograph, the Court considered that the applicant’s privacy interest was very low as (at the time) it did not form part of a database that could be subject to facial recognition technology.

The decisions of the High Court and the Supreme Court reflect a heavy preference for crime control values over privacy. All persons convicted of a recordable offence are lumped together as a criminal underclass whose intimate personal identifiers (biometric data) will be held on the police national database forever. No distinction is made among categories of offence within the recordable offence classification. A person convicted of taking part in a prohibited public procession, for example, is treated the same as a person convicted of rape.

Given the incredibly broad sweep of recordable offences, and the inclusion of many relatively minor offences, it can be expected that the number of persons whose biometric data are held indefinitely on the police national database are huge and expanding relentlessly. In July 2016, for example, no less than 19 million photographs (custody images) were held, 16 million of which were searchable using facial recognition technology.

Only Lord Kerr, the dissenting judge in the Supreme Court, offered an approach that sought to refine the draconian retention policy so that it would be targeted more rationally and precisely at the aim of detecting crime and assisting in the identification of future offenders. This could entail the removal of some of the less serious recordable offence from the scheme, the adoption of a gradation of retention periods matching the seriousness of the offence and provision for periodic review of the need to retain an individual’s biometric data. Indefinite retention would be confined to offenders for whom that was necessary for the future detection and prevention of certain serious crimes.

The question for the European Court, therefore, was whether it was a breach of Article 8 ECHR to retain the applicant’s biometric data indefinitely given that he had been convicted of a recordable offence.

The ECtHR decision

The Court accepted at the outset that the indefinite retention of the applicant’s biometric data amounted to an interference with his private life within the meaning of Article 8(1) ECHR. In the case of the photograph, this represented a development of the Court’s earlier jurisprudence which held that the retention and use of photographs taken on arrest did not raise the Article 8 privacy interest. The Court felt compelled to change course on the facts of the instant case because the photograph was taken following arrest, will be held indefinitely on the police national database and, critically, could be subjected to facial recognition and facial mapping techniques by the police.

The key issue for the Court was whether the interference with the applicant’s privacy was in accordance with law and necessary in order to protect one of the interests specified in Article 8(2), most notably public safety and the prevention of crime. On this it had no difficulty in accepting that the retention policy pursued a legitimate aim of preventing and detecting crime. Whether the measure was necessary to achieve that aim was a more difficult matter.

The Court rejected the UK argument that there was sufficient diversity in retention periods across Council Member States to justify giving it a broad margin of appreciation over its own retention period. The Court found that very few States adopted indefinite retention. Most imposed defined time limits (or other checks on the duration of retention), even if they were very long and, in some cases, exceeded the life of the person concerned. In the case of DNA profiles, especially, the Court considered that indefinite retention presented a significant encroachment on the privacy rights of the offender which would continue indefinitely after the offender’s death. Accordingly, it found a degree of consensus around the adoption of defined periods of retention (even if there was variation among the periods themselves) sufficient to reject the UK government’s argument for a wide margin of appreciation in the matter.

The Court was also not persuaded by the UK argument that the scheme in Northern Ireland applied a minimum threshold of seriousness insofar as indefinite retention was limited to recordable offences. The Court noted that this argument was rejected in S & Marper, and it saw no reason to depart from that in respect of convicted offenders. Echoing the position of Lord Kerr, it referred to the fact that recordable offences were so broad that the regime could be characterised as applying irrespective of the nature or seriousness of the offence.

The Court rejected another argument presented by the UK to the effect that the police retention policy had already been carefully examined by the domestic courts which had applied the Convention rights in accordance with the case law and had adequately balanced the applicant’s personal interest against the public interest. In this scenario, according to the UK, it was not for the European Court to substitute its own view of the merits for that of the competent national judicial authorities, unless there was a compelling reason for doing so.

The European Court considered that there were compelling reasons for overriding the decision of the domestic authorities. In the case of photographs, it noted that the UK Supreme Court had proceeded on the basis that facial recognition technology was not applicable, whereas it was clear now that it was.  It also noted that the UK Supreme Court had proceeded on the basis that very few other States had a process of review in respect of retained biometric data, whereas it is clear that most do. Finally, it noted that the UK Supreme Court equated indefinite retention with a retention period linked to the death of the subject. As noted above, however, the European Court drew an important distinction between the two, especially in the case of DNA profiles.

The European Court concluded that there is a “narrowed” margin of appreciation for States setting retention limits for the biometric data of convicted persons. The duration of that period, however, is not necessarily conclusive in determining whether a State has overstepped the limits of that margin. Because it concerns convicted persons, there is less risk of stigmatisation than is the case in the S & Marper type situation of a person not convicted. Other important factors are whether the regime takes into account the seriousness of the offence, the need to retain the data and the safeguards available to the individual. Where the State has opted for indefinite retention, the existence and functioning of certain safeguards become decisive.

The indefinite retention policy in Northern Ireland was found to be in breach of Article 8. It failed to strike a fair balance between the applicant’s right to privacy and the public interest in the prevention and detection of crime. The key flaws were the indiscriminate nature of the powers of retention in respect of a person convicted of an offence (even though it was spent) without reference to the seriousness of the offence or the need for indefinite retention, coupled with the absence of any real possibility of review. The Court acknowledged that the State retained a slightly wider margin of appreciation in respect of the retention of photographs and fingerprints (relative to DNA profiles). In the absence of any real safeguards and provision for review, that margin is not sufficient to conclude that retention could be a proportionate interference with the right to privacy.


It is submitted that the decision in Gaughran is a welcome check on excessive police encroachment on the privacy of the individual under cover of the need to detect and prevent crime. The indefinite retention policy in respect of the biometric data of persons convicted of recordable offences has the effect of stigmatising a large and expanding portion of the population; designating them forever as criminally suspect. It is difficult to see the justification for applying that to the very large number of such persons who have been convicted of offences which are not sufficiently serious to single them out as presenting a constant and permanent risk to others or the State.

The mere fact that the retention of their intimate personal data may be convenient for the police in detecting and preventing crime is hardly a sufficiently justification. To think otherwise is an argument for a police state in which everyone’s personal data is uploaded and retained on the police database.

As explained by Lord Kerr, there is no fundamental reason why a retention policy cannot be designed to strike a rational and proportionate balance between the individual interest in privacy and the public interest in crime prevention and detection. Using recordable offences as the sole determinant in this context patently does not strike that balance. They are too broad and encompass too many offences that can be classed as less serious. Compliance with the Court’s judgment in Gaughran now requires Lord Kerr’s more nuanced and targeted approach to be introduced in Northern Ireland.

The Republic of Ireland also needs to take heed. It was identified in the Court’s judgment as one of only four other jurisdictions to apply indefinite retention to DNA profiles. It and North Macedonia are also reported as applying indefinite retention to fingerprints and photographs.

Download the March 2020 edition of Criminal Justice Notes