APPENDIX 7
Memorandum by the Data Protection Commissioner
ENQUIRY INTO THE SETTING UP OF THE CRIMINAL
RECORDS BUREAU
1. INTRODUCTION
1.1 The Commissioner welcomes the request
to provide evidence to the Home Affairs Committee on the quality
of personal data held on the Police National Computer and how
this may affect the operation of the Criminal Records Bureau when
undertaking its functions on behalf of the Secretary of State
as set down in Part V of the Police Act 1997.
1.2 The Commissioner has statutory responsibility
for ensuring compliance with the Data Protection Act 1998. Central
to the Act are the legally enforceable Data Protection Principles.
Data controllers who process personal data are required to comply
with the Principles and the Act gives individuals rights to claim
compensation from controllers where they have suffered damage
as a result of a contravention of the Act. The Principles are
set out below:
(1) Personal data shall be processed fairly
and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule
2 is met, and
(b) in the case of sensitive personal data,
at least one of the conditions in Schedule 3 is also met.
(2) Personal data shall be obtained only
for one or more specified and lawful purposes, and shall not be
further processed in any manner incompatible with that purpose
or those purposes.
(3) Personal data shall be adequate, relevant
and not excessive in relation to the purpose or purposes for which
they are processed.
(4) Personal data shall be accurate and,
where necessary, kept up to date.
(5) Personal data processed for any purpose
or purposes shall not be kept for longer than necessary for that
purpose or those purposes.
(6) Personal data shall be processed in accordance
with the rights of data subjects under this Act.
(7) Appropriate technical and organisational
measures shall be taken against unauthorised or unlawful processing
of personal data and against accidental loss or destruction of,
or damage to, personal data.
(8) Personal data shall not be transferred
to a country or territory outside the European Economic Area unless
that country or territory ensures an adequate level of protection
for the rights and freedoms of data subjects in relation to the
processing of personal data.
1.3 In this context our focus is on the
legal requirement that personal data are adequate, relevant and
not excessive (3rd Principle), are accurate and kept up to date
(4th Principle), and are not held longer than necessary for the
purpose (5th Principle). In essence, these Principles require
that personal data is of the appropriate quality.
1.4 The need for criminal record information
to be of the appropriate quality cannot be overstated. Traditionally
it has been the needs of the police and the courts in preventing
and detecting crime and sentencing offenders which have dictated
the level of quality necessary to discharge these functions. The
establishment of the Criminal Records Bureau (CRB) and the wider
availability of criminal record information through the issuing
of certificates to individuals means that increased use will be
made of the criminal record information that was previously the
preserve of the police and the courts. Central to the Criminal
Records Bureau activities will be the information held on the
Phoenix application of the Police National Computer (PNC). There
are varying estimates as to how many certificates will be issued
each year, but all projections seem to indicate that there will
be many millions of applications. This will lead to a much greater
scrutiny of criminal record information than has been the case
to date and, as certificates may be shown to third parties, this
will include examination by those who have had no experience of
interpreting criminal record information. It is essential that
information on which certificates are based is adequate, accurate
and timely. Incorrect information will not only have a significant
impact on the life of an individual applicant but also on the
ability to achieve the aims of making such information more widely
available, such as protecting vulnerable members of society.
2. CRIMINAL RECORDS
BUREAU
2.1 The Commissioner has had a number of
discussions with staff from the CRB, including its Chief Executive
and senior officers. It is clear from these discussions that the
information contained on the Phoenix application of the PNC will
be the life blood of the Bureau, and without which it cannot function.
Whilst these discussions have touched on many matters which are
in the direct control of the CRB, such as its procedures for establishing
the identity of applicants, the safeguards against impersonation
to gain criminal record information relating to another and the
Code of Practice to protect against misuse of information, the
quality of the criminal record of information available to it
is largely a legacy from many years of the police service compilation
of criminal records.
3. PHOENIX DATA
QUALITY
3.1 The Commissioner and her predecessor
as the Data Protection Registrar, have taken a keen interest in
the quality and extent of criminal conviction data held on the
PNC. Such personal data are sensitive in nature and if inaccurate
or held longer than necessary can have a significant impact on
the lives of individuals. The interest pre-dates the existing
Phoenix application. The Commissioner does not keep specific figures
identifying the precise number of complaints made to her by individuals
concerning inaccuracies in policing data. However, it is fair
to say that the Commissioner has received very few complaints
from members of the public who have been affected. Those few complaints
that have been received do illustrate the point that inaccuracies
in criminal records can have significant impact on the lives on
the individual, with inaccuracies resulting in people being unable
to become foster parents or assume positions of responsibility.
The complaints made to the Commissioner do touch on matters such
as the wrong attribution of conviction information to individuals
and failure to amend records to show successful appeals against
conviction or acquittals. The Commissioner has never had to resort
to formal enforcement action to ensure compliance when a complaint
has been received, as the police force concerned has always ensured
that the appropriate amendment/deletion of a record has taken
place once the Commissioner has started to investigate the matter.
The low level of complaints to the Commissioner may be for a number
of reasons, including the low level of awareness of what criminal
record information might be attributable to individuals, or perhaps
due to the fact that persons affected raise their concerns directly
with the police rather than the Commissioner. On the former point,
if the estimates of the CRB on the likely number of applications
are correct, many millions more individuals will become aware
of criminal record information in the months and years to come
and the handful of complaints may multiply by many times.
3.2 The Commissioner has been concerned
for some time to ensure that information held on the PNC and Phoenix
is as accurate as necessary for the proper conduct of the functions
of the police service and the courts. Given that the liberty of
the individual could be at stake, the importance of accurate and
timely information is self-evident. Compliance with the requirements
of Data Protection law is assisted by the Association of Chief
Police Officers? Code of Practice for data protection. The current
Code of Practice is being revised to take account of the Data
Protection Act 1998, but the Commissioner regards compliance even
with the existing Code to be a significant step towards compliance
with the Data Protection Act 1998. This document is discussed
with the Commissioner during its production and contains features
such as retention criteria for conviction data which acts as a
form of benchmark by which the police set standards to assist
compliance with the Data Protection Principles. It has been disappointing
to note in the past that the standards it sets, such as on retention
periods for criminal record data on the PNC, have not always been
fully implemented in practice.
4. POLICE RESEARCH
GROUP REPORT
4.1 The Commissioner's concern regarding
Phoenix data quality were heightened by the publication ofthe
Home Office Police Research Group Special Interest paper No.11
(March 1998) which examined Phoenix data quality. This report
highlighted a number of problems which called into question the
police services? Data Protection Act compliance. The report made
clear that the introduction of Phoenix and the move to the creation
and maintenance of records by local forces rather than a central
point, has had a significant impact on overall data quality. The
report identified a number of significant problems regarding the
timeliness, accuracy and completeness of Phoenix records. All
these are matters which have a bearing on compliance with the
Data Protection Principles. The Commissioner expressed her concerns
to both the Association of Chief Police Officers and the Director
of Police Policy at the Home Office. Subsequent discussions took
place with representatives of the ACPO Crime Committee during
the formulation of an ACPO compliance strategy aimed at remedying
the identified defects.
5. ON THE
RECORD
Thematic Inspection Report on Police Crime
recording the Police National Computer and Phoenix Intelligence
System Data Quality undertaken by Her Majesty's Inspector of Constabulary.
5.1 This thematic inspection by Her Majesty?s
Inspector of Constabulary (HMIC) revisited many of the areas of
concern highlighted by the PRG report. Its conclusions are alarming.
It identified that the overall level and nature of errors, omissions
and discrepancies found were unacceptable given that these same
issues were raised two year?s earlier in the PRG report. The Report
contained a number of findings supporting this conclusion, including
figures showing that crime record error rates ranged between 15
and 65% and that there were substantial delays in updating records
in some forces Whilst the error rates may include many which would
have little impact on the information appearing on a CRB criminal
record certificate, more serious errors would have an impact as
would a delay in updating records. After publication of "On
the Record" the Commissioner once again raised the issue
of Phoenix data quality with both ACPO and the Home Office. She
expressed concerns at the findings of the HMIC Report for data
protection compliance by the police, the lack of progress since
the PRG report, but importantly highlighting the need for Phoenix
records to be as accurate and timely as possible given the introduction
of the CRB and the projected increase in the availability of criminal
record information with greater scrutiny by those unfamiliar with
criminal record information and the existing limitations in respect
of quality.
6. THE NEED
FOR REMEDIAL
ACTION
6.1 The current situation as the HMIC Report
observes, is unacceptable, not only in terms of servicing the
operational needs of the police and the courts, but also in ensuring
Data Protection Act 1998 compliance. The wider availability of
certificates containing criminal record information will mean
that the scrutiny of criminal record details originating on Phoenix
will be multiplied many times over and above that which takes
place at present. Phoenix data will need to be of the appropriate
quality to reflect the circumstance of this new purpose. Clearly
individual Chief Officers have an essential role to play in terms
of their local efforts to ensure that personal information is
recorded accurately and quickly on Phoenix and the ACPO strategy
is a welcome step towards this. However, the Home Office and its
Police Information Technology Organisation (PITO) also have essential
roles to play. PITO in particular has a large measure of control
over the PNC and Phoenix as these are central systems upon which
forces store criminal record data. Tasks such as ensuring that
all records retained on Phoenix accord with ACPO retention criteria
can be achieved centrally and the role of the Secretary of State
in ensuring such activities are properly resourced and prioritised
is an important factor. The Commissioner is looking to action
by all parties concerned with the operation of the PNC to ensure
that Phoenix data is compliant with the Data Protection Act. Discussions
are planned with Home Office officials to try to take the matter
forward.
7. POTENTIAL
FOR FUTURE
ACTION BY
THE COMMISSIONER
7.1 The Commissioner has powers to issue
enforcement notices where a data protection principle has been
contravened. It has always been the Commissioner?s approach to
seek compliance initially through agreement rather than formal
enforcement action. The Commissioner is concerned that the data
on which the CRB will be issuing certificates may, in part, be
inadequate for this purpose if the findings of the PRG and HMIC
reports are correct. This calls into question whether some of
the personal data retained on Phoenix complies with the 3rd, 4th
and 5th Data Protection Principles. The Commissioner has embarked
on discussions with the relevant parties aimed at securing the
necessary progress to ensure that the personal data held on Phoenix
are of a sufficient quality for the purposes of all users of the
information on this application and accordingly that it complies
with the requirement of the Data Protection Act 1998. The Commissioner
is currently in the phase of trying to achieve this aim by mutual
agreement. If this cannot be achieved within a reasonable time
scale then consideration would be given as to whether formal enforcement
action is appropriate.
8. CONCLUSIONS
8.1 Accurate, complete and timely records
are the life blood of any criminal record system. Whilst the Commissioner
has not received large amounts of complaints from individuals
directly affected by poor quality data being held on the Phoenix
application on the PNC, it is clear from the recent PRG and HMIC
reports that the low level of complaints does not reflect the
true significance of the problems with Phoenix data. Whilst many
of the identified errors may be relatively unimportant in terms
of information appearing on a CRB issued criminal record certificate,
some errors would have an impact on the veracity of the details
on the certificate.
The increased availability of certificates showing
criminal record information based on Phoenix data deepens the
Commissioner?s concerns particularly as this will be read by many
who are not aware of the current problems with such data. The
current state of Phoenix data must call into question how well
the Secretary of State, in the guise of the CRB, can discharge
his responsibilities under Part V of the Police Act 1997 when
issuing conviction certificates. It should be borne in mind that
inaccurate or incomplete information may not only be to the detriment
of individuals who are applying for Certificates; there is also
a real risk that employers and others who are basing their judgements
on certificates may not have available to them complete and accurate
information, and therefore vulnerable members of society and others
may be put at risk. If the CRB is to function correctly there
needs to be an improvement in the existing quality of criminal
record data available to it on the Phoenix application of the
PNC.
19 January 2001
| 
