Select Committee on Home Affairs Appendices to the Minutes of Evidence


Memorandum by the Data Protection Commissioner



  1.1  The Commissioner welcomes the request to provide evidence to the Home Affairs Committee on the quality of personal data held on the Police National Computer and how this may affect the operation of the Criminal Records Bureau when undertaking its functions on behalf of the Secretary of State as set down in Part V of the Police Act 1997.

  1.2  The Commissioner has statutory responsibility for ensuring compliance with the Data Protection Act 1998. Central to the Act are the legally enforceable Data Protection Principles. Data controllers who process personal data are required to comply with the Principles and the Act gives individuals rights to claim compensation from controllers where they have suffered damage as a result of a contravention of the Act. The Principles are set out below:

    (1)  Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

    (a)  at least one of the conditions in Schedule 2 is met, and

    (b)  in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

    (2)  Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

    (3)  Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

    (4)  Personal data shall be accurate and, where necessary, kept up to date.

    (5)  Personal data processed for any purpose or purposes shall not be kept for longer than necessary for that purpose or those purposes.

    (6)  Personal data shall be processed in accordance with the rights of data subjects under this Act.

    (7)  Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

    (8)  Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

  1.3  In this context our focus is on the legal requirement that personal data are adequate, relevant and not excessive (3rd Principle), are accurate and kept up to date (4th Principle), and are not held longer than necessary for the purpose (5th Principle). In essence, these Principles require that personal data is of the appropriate quality.

  1.4  The need for criminal record information to be of the appropriate quality cannot be overstated. Traditionally it has been the needs of the police and the courts in preventing and detecting crime and sentencing offenders which have dictated the level of quality necessary to discharge these functions. The establishment of the Criminal Records Bureau (CRB) and the wider availability of criminal record information through the issuing of certificates to individuals means that increased use will be made of the criminal record information that was previously the preserve of the police and the courts. Central to the Criminal Records Bureau activities will be the information held on the Phoenix application of the Police National Computer (PNC). There are varying estimates as to how many certificates will be issued each year, but all projections seem to indicate that there will be many millions of applications. This will lead to a much greater scrutiny of criminal record information than has been the case to date and, as certificates may be shown to third parties, this will include examination by those who have had no experience of interpreting criminal record information. It is essential that information on which certificates are based is adequate, accurate and timely. Incorrect information will not only have a significant impact on the life of an individual applicant but also on the ability to achieve the aims of making such information more widely available, such as protecting vulnerable members of society.


  2.1  The Commissioner has had a number of discussions with staff from the CRB, including its Chief Executive and senior officers. It is clear from these discussions that the information contained on the Phoenix application of the PNC will be the life blood of the Bureau, and without which it cannot function. Whilst these discussions have touched on many matters which are in the direct control of the CRB, such as its procedures for establishing the identity of applicants, the safeguards against impersonation to gain criminal record information relating to another and the Code of Practice to protect against misuse of information, the quality of the criminal record of information available to it is largely a legacy from many years of the police service compilation of criminal records.


  3.1  The Commissioner and her predecessor as the Data Protection Registrar, have taken a keen interest in the quality and extent of criminal conviction data held on the PNC. Such personal data are sensitive in nature and if inaccurate or held longer than necessary can have a significant impact on the lives of individuals. The interest pre-dates the existing Phoenix application. The Commissioner does not keep specific figures identifying the precise number of complaints made to her by individuals concerning inaccuracies in policing data. However, it is fair to say that the Commissioner has received very few complaints from members of the public who have been affected. Those few complaints that have been received do illustrate the point that inaccuracies in criminal records can have significant impact on the lives on the individual, with inaccuracies resulting in people being unable to become foster parents or assume positions of responsibility. The complaints made to the Commissioner do touch on matters such as the wrong attribution of conviction information to individuals and failure to amend records to show successful appeals against conviction or acquittals. The Commissioner has never had to resort to formal enforcement action to ensure compliance when a complaint has been received, as the police force concerned has always ensured that the appropriate amendment/deletion of a record has taken place once the Commissioner has started to investigate the matter. The low level of complaints to the Commissioner may be for a number of reasons, including the low level of awareness of what criminal record information might be attributable to individuals, or perhaps due to the fact that persons affected raise their concerns directly with the police rather than the Commissioner. On the former point, if the estimates of the CRB on the likely number of applications are correct, many millions more individuals will become aware of criminal record information in the months and years to come and the handful of complaints may multiply by many times.

  3.2  The Commissioner has been concerned for some time to ensure that information held on the PNC and Phoenix is as accurate as necessary for the proper conduct of the functions of the police service and the courts. Given that the liberty of the individual could be at stake, the importance of accurate and timely information is self-evident. Compliance with the requirements of Data Protection law is assisted by the Association of Chief Police Officers? Code of Practice for data protection. The current Code of Practice is being revised to take account of the Data Protection Act 1998, but the Commissioner regards compliance even with the existing Code to be a significant step towards compliance with the Data Protection Act 1998. This document is discussed with the Commissioner during its production and contains features such as retention criteria for conviction data which acts as a form of benchmark by which the police set standards to assist compliance with the Data Protection Principles. It has been disappointing to note in the past that the standards it sets, such as on retention periods for criminal record data on the PNC, have not always been fully implemented in practice.


  4.1  The Commissioner's concern regarding Phoenix data quality were heightened by the publication ofthe Home Office Police Research Group Special Interest paper No.11 (March 1998) which examined Phoenix data quality. This report highlighted a number of problems which called into question the police services? Data Protection Act compliance. The report made clear that the introduction of Phoenix and the move to the creation and maintenance of records by local forces rather than a central point, has had a significant impact on overall data quality. The report identified a number of significant problems regarding the timeliness, accuracy and completeness of Phoenix records. All these are matters which have a bearing on compliance with the Data Protection Principles. The Commissioner expressed her concerns to both the Association of Chief Police Officers and the Director of Police Policy at the Home Office. Subsequent discussions took place with representatives of the ACPO Crime Committee during the formulation of an ACPO compliance strategy aimed at remedying the identified defects.


  Thematic Inspection Report on Police Crime recording the Police National Computer and Phoenix Intelligence System Data Quality undertaken by Her Majesty's Inspector of Constabulary.

  5.1  This thematic inspection by Her Majesty?s Inspector of Constabulary (HMIC) revisited many of the areas of concern highlighted by the PRG report. Its conclusions are alarming. It identified that the overall level and nature of errors, omissions and discrepancies found were unacceptable given that these same issues were raised two year?s earlier in the PRG report. The Report contained a number of findings supporting this conclusion, including figures showing that crime record error rates ranged between 15 and 65% and that there were substantial delays in updating records in some forces Whilst the error rates may include many which would have little impact on the information appearing on a CRB criminal record certificate, more serious errors would have an impact as would a delay in updating records. After publication of "On the Record" the Commissioner once again raised the issue of Phoenix data quality with both ACPO and the Home Office. She expressed concerns at the findings of the HMIC Report for data protection compliance by the police, the lack of progress since the PRG report, but importantly highlighting the need for Phoenix records to be as accurate and timely as possible given the introduction of the CRB and the projected increase in the availability of criminal record information with greater scrutiny by those unfamiliar with criminal record information and the existing limitations in respect of quality.


  6.1  The current situation as the HMIC Report observes, is unacceptable, not only in terms of servicing the operational needs of the police and the courts, but also in ensuring Data Protection Act 1998 compliance. The wider availability of certificates containing criminal record information will mean that the scrutiny of criminal record details originating on Phoenix will be multiplied many times over and above that which takes place at present. Phoenix data will need to be of the appropriate quality to reflect the circumstance of this new purpose. Clearly individual Chief Officers have an essential role to play in terms of their local efforts to ensure that personal information is recorded accurately and quickly on Phoenix and the ACPO strategy is a welcome step towards this. However, the Home Office and its Police Information Technology Organisation (PITO) also have essential roles to play. PITO in particular has a large measure of control over the PNC and Phoenix as these are central systems upon which forces store criminal record data. Tasks such as ensuring that all records retained on Phoenix accord with ACPO retention criteria can be achieved centrally and the role of the Secretary of State in ensuring such activities are properly resourced and prioritised is an important factor. The Commissioner is looking to action by all parties concerned with the operation of the PNC to ensure that Phoenix data is compliant with the Data Protection Act. Discussions are planned with Home Office officials to try to take the matter forward.


  7.1  The Commissioner has powers to issue enforcement notices where a data protection principle has been contravened. It has always been the Commissioner?s approach to seek compliance initially through agreement rather than formal enforcement action. The Commissioner is concerned that the data on which the CRB will be issuing certificates may, in part, be inadequate for this purpose if the findings of the PRG and HMIC reports are correct. This calls into question whether some of the personal data retained on Phoenix complies with the 3rd, 4th and 5th Data Protection Principles. The Commissioner has embarked on discussions with the relevant parties aimed at securing the necessary progress to ensure that the personal data held on Phoenix are of a sufficient quality for the purposes of all users of the information on this application and accordingly that it complies with the requirement of the Data Protection Act 1998. The Commissioner is currently in the phase of trying to achieve this aim by mutual agreement. If this cannot be achieved within a reasonable time scale then consideration would be given as to whether formal enforcement action is appropriate.


  8.1  Accurate, complete and timely records are the life blood of any criminal record system. Whilst the Commissioner has not received large amounts of complaints from individuals directly affected by poor quality data being held on the Phoenix application on the PNC, it is clear from the recent PRG and HMIC reports that the low level of complaints does not reflect the true significance of the problems with Phoenix data. Whilst many of the identified errors may be relatively unimportant in terms of information appearing on a CRB issued criminal record certificate, some errors would have an impact on the veracity of the details on the certificate.

  The increased availability of certificates showing criminal record information based on Phoenix data deepens the Commissioner?s concerns particularly as this will be read by many who are not aware of the current problems with such data. The current state of Phoenix data must call into question how well the Secretary of State, in the guise of the CRB, can discharge his responsibilities under Part V of the Police Act 1997 when issuing conviction certificates. It should be borne in mind that inaccurate or incomplete information may not only be to the detriment of individuals who are applying for Certificates; there is also a real risk that employers and others who are basing their judgements on certificates may not have available to them complete and accurate information, and therefore vulnerable members of society and others may be put at risk. If the CRB is to function correctly there needs to be an improvement in the existing quality of criminal record data available to it on the Phoenix application of the PNC.

19 January 2001

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2001
Prepared 28 March 2001