Spent Convictions in the law of Privacy and Data Protection: Part Two – Aidan Wills

In Part 1 of this post I looked at “spent convictions” in the context of the law of privacy. The other important legal perspective on such convictions is that of the law of data protection.

For the purposes of the Data Protection Act 1998 (“the DPA”), information pertaining to convictions is “sensitive personal data” pursuant to section 2(1)(g) and (h). By Schedule 1, para 1, a data controller publishing such information must either comply with at least one of the conditions in each of Schedules 2 and 3 in order for the data to be processed fairly and lawfully or must rely on an exemption in Part IV of the DPA.

The most relevant of these exemptions for present purposes will be that under section 32 which concerns processing for journalistic, artistic and literary purposes with a view to publication.  Journalism is now understood so broadly that section 32 could be relied on by almost anyone publishing or posting information online.

It is unlikely that a Schedule 3 requirement would be met in relation to the publication of information about a spent conviction. Even if the data is already in the public domain (owing to the data subject’s conviction in open court and contemporaneous reporting) it could not be said that this was on the basis of steps deliberately taken by him or her. Further, explicit consent is unlikely to be sought or granted.

Schedule 3 paragraph 10 provides possible additional bases for processing sensitive personal data.  These are set out in The Data Protection (Processing of Sensitive Personal Data) Order 2000.  These additional bases all require a “substantial public interest”.  Paragraph 3 relates to the disclosure of information concerning the commission of an unlawful act for the purposes of journalism and with a view to publication. It appears, however, that this only covers a disclosure or publication of the information and not other journalistic activities (see the ICO’s Data Protection and Journalism: a guide for the media [pdf], pp.41-42).

To rely on the section 32 exemption from compliance with the data protection principles, a publisher of data relating to a spent conviction would have to establish that s/he reasonably believed that:

1) having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

2) in all the circumstances, compliance with the given provision(s) of the Act is incompatible with the special purposes (i.e. journalism for present purposes).

Establishing a reasonable belief that publication would be in the public interest requires demonstrating the basis for that belief. If the data was published in ignorance of the fact that the conviction was spent, the failure to check would make such an argument difficult. Alternatively, if the data is published in the knowledge that the conviction is spent, the publisher would face the same difficulties identified in Part 1 of this post in relation to a privacy claim.

A further question arises as to the status of articles published at or around the time of sentencing which remain online beyond the expiry of the rehabilitation period. Arguably this may amount to the processing of inaccurate or excessive sensitive personal data. A publisher may be in breach of the DPA unless s/he corrects or removes such material.

Articles remaining online and liability of search engine providers

Another difficult issue concerns the liability of search engine providers such as Google.  This is, of course, a data controller as a result of the Google Spain decision. It is difficult to see how section 32 could apply to Google as it is not itself a publisher and does not undertake processing “with a view to publication” by another person.

The following observations of the Court of Justice’s in Google Spain v APED and Gonzalez [2014] C‑131/12, (“Google Spain”) on the impact of search engine results on data subjects are especially apposite in relation to spent convictions:

“[S]ince the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page” [87].

Under the so-called ‘right to be forgotten’, recognised in that case search engine providers would, upon request, be required to delist/remove search results pertaining to spent convictions unless there is a

“preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question” [99].

The continued processing of sensitive personal data relating to spent convictions is likely to be in breach of the DPA unless the search engine provider can establish that there is such an interest in generating search results relating to the convictions.

The Article 29 Data Protection Working Party’s Guidelines on the implementation of Google Spain set out factors relevant to the assessment of the public interest in delisting cases. These guidelines include a number of considerations that, in many cases, will militate in favour of delisting data relating to spent convictions, notably: data being sensitive personal data, data being made available for longer than is necessary, the data’s (enduring) relevancy and prejudice to the data subject.

Also significant is the backdrop of parliament having decided through the 1974 Act that the balance of the public interest lies in facilitating the rehabilitation offenders. How this right to be rehabilitated interacts with the right to be forgotten in the context of data protection remains to be determined.

The challenge for publishers

Calculating whether a sentence is spent can be a formidable challenge. First, it is not always easy to find out the period of imprisonment to which a person was sentenced, particularly if the conviction was a long time ago. Second, for lower level sentences, such as conditional discharges and community orders, one may need to see the order to know when the rehabilitation period will end – it may vary from case to case. Third, parliament has amended the 1974 Act on a number of occasions and most significantly in 2012. Changes have been made to convictions/sentences qualifying for rehabilitation and the length of rehabilitation periods (which are shorter than they used to be). Finally, the 1974 Act scheme is complex – calculating a convict’s status requires an understanding of how the Act operates. All of this suggests that publishers may have to invest more time ascertaining whether convictions are spent.

Conclusion

The status of spent convictions in the law of privacy and data protection remains uncertain. Surprisingly, there are no reported cases of rehabilitated persons bringing privacy or DPA claims following the publication of information about their spent convictions.  In the light of the case law discussed in this post it seems likely that these issues will be brought before the courts in the near future.

Aidan Wills is a barrister at Matrix Chambers. He specialises in media and information law, public law and employment law.