Police guidance on data deletion is flawed, says Information Tribunal

The Information Tribunal, which adjudicates on appeals against orders from the Information Commissioner's Office (ICO), said that guidance issued to forces is unsuitable. The Tribunal said that the producer of the guidance, the Association of Chief Police Officers (ACPO), ignored its previous orders on the issue.

The censure comes in a ruling by the Tribunal in which three police forces have been ordered to block access to a set of old convictions data for minor offences because their retention breaks the Data Protection Act.

ACPO has produced a number of sets of guidelines for police forces on how it should treat convictions data on the Police National Computer (PNC). Previous versions of the guidelines were produced in association with the ICO, but a 2006 version was not.

"The Tribunal would observe that the 2006 Guidelines do not appear to be a suitable approach to the retention of conviction data in order to comply with the DPA [Data Protection Act]," said the ruling. "ACPO seems to have ignored the guidance provided in [a previous Tribunal ruling]."

That previous ruling, from 2005, called the code a "blunt instrument'.

"Any code regarding weeding or deletion should be much more sophisticated in its designation of the applicable criteria and that such matters as types of offence, age of offender, modus operandi, length of retention period, nature and extent of any soft information as well as other appropriate items, some of which were canvassed in the hearing, should be specifically incorporated in any revised code," said the 2005 ruling.

In the current case, the Tribunal has backed the Information Commissioner's ruling against five forces. They had kept conviction records dating back nearly 30 years for people who had committed minor offences and not re-offended.

One of the people was refused an opportunity to pursue her chosen career as a carer because of the retention of information about a reprimand, while another involved the person attempting to cheat a slot machine at the age of 15.

The Data Protection Act governs the keeping of information about people and says that information must be relevant and the length of time for which it is kept proportionate. The Tribunal has backed the ruling from the Information Commissioner's Office (ICO) that the police's retention of conviction data was not relevant and is excessive for policing purposes.