By Jurij Toplak
The ECHR’s Article 8 guarantees a right to have data related to criminal procedures reviewed and, after some time and in most cases, removed. In this blog post, I will first summarise the case law of the European Court of Human Rights (ECHR or “the Court”) on the retention, review, and removal of data stored during a criminal procedure and the data on convictions, generally known as “criminal records”. I will focus on two judgments, issued on 13 February 2020. They are Gaughran v. the United Kingdom and Trajkovski and Chipovski v. North Macedonia. Then I will present and analyse cases currently pending before the Court and issues on which the Court will decide shortly.
Article 8 and data stored during and after a criminal procedure
The mere storing of data relating to an individual by a public authority amounts to an interference within the meaning of “private life” and Article 8 (Leander v. Sweden, par. 48; Rotaru v. Romania, par. 43–44).
The consequences of data being stored may be profoundly damaging. European countries generally prohibit anyone with a criminal record from serving in public administrative positions, and people with criminal records are often discriminated against in employment.
Most of the cases brought before the ECHR concerning data stored on criminal procedures fall into either of two groups. One group is concerned with the retention of fingerprints, photographs, and DNA, while the other is about the preservation and erasing of criminal records.
Retention of fingerprints, photographs, and DNA data
The leading case on the retention of fingerprints and DNA data is S. and Marper v. the United Kingdom, in which the Grand Chamber in 2008 unanimously held that the permanent retention of such data of people suspected but not convicted of crimes violated their right to privacy.
On 13 February 2020, the Court issued two unanimous judgments which confirmed standards set in that case, and extended the protection of persons whose fingerprints and DNA data were being held by government to convicted felons. Gaughran v. the United Kingdom concerned a drunk driver fined GBP 50 and disqualified from driving for one year for a recordable offence punishable by imprisonment. Trajkovski and Chipovski v. North Macedonia dealt with felons convicted of aggravated theft.
Those two judgments are valuable for the comparative data they present. Two member states retain fingerprints and photographs indefinitely, 21 have fixed retention periods, and five states provide for various substantive limitations and a requirement for a periodic assessment of the need for further retention. Cyprus, Ireland, North Macedonia, and Montenegro are among those which retain indefinitely either the DNA, fingerprints, or photographs.
On the matter of review mechanisms, the Court’s research found that in six of the reviewed states there was a possibility of an administrative, and in 18 states judicial review of the necessity for data retention. In six states there was no possibility of a review, or no regulation about it. These states are Denmark, Estonia, Latvia, the Netherlands, Liechtenstein, and San Marino.
In both the above cases, the Court unanimously concluded that the applicant’s right to respect of private life was violated. The Court made it clear that the indiscriminate retention of DNA profiles, fingerprints and photographs of convicted people, without reference to the seriousness of the offence or the need for indefinite retention, and in the absence of any genuine possibility of review, violated the Convention.
The Court deemed it relevant whether the data retained was about people convicted of major or minor criminal offences or misdemeanours. In the Trajkovski case, the police were vested with the power to delete personal data from the registers, but the law was silent on the conditions under which the erasure could be carried out, and on the procedure to be followed. There was no provision under which a person could apply to have his or her data deleted, if its retention no longer appeared to be necessary.
The retaining and deleting of criminal records
Most European countries provide for the expunging of records of conviction once the sentence has been served and a waiting period has passed. When a record is expunged, the person is presumed rehabilitated and enjoys the same constitutional rights as a person with no criminal history, as if the violation never happened.
In Gardel v. France, the Court in 2009 held that the right to privacy of a person, sentenced to 15 years’ imprisonment for raping a child, was not violated when his name was put on a sex offenders’ list while he was imprisoned. The Court ruled that the law provided for sufficient safeguards to protect the applicant’s rights. It provided time limits for which the information was to be kept; the data would be deleted automatically on the expiry of 20 or 30 years, depending of the severity of the rape; the person concerned might ask the prosecutor to delete the data if its retention no longer appeared necessary, and the prosecutor’s decision could be appealed against before the court.
In M.M. v. the United Kingdom the Court, relying on a large number of international documents, unanimously held that indefinite retention of data on a person’s caution in a criminal matter breached the applicant’s privacy rights. Article 8 also requires states to have clear and detailed laws clarifying the safeguards, and circumstances in which data can be collected, the duration of their storage, the use to which they can be put and the circumstances in which they may be destroyed.
In 2019, the Court in Catt v. the United Kingdom found a violation of a political activist’s privacy rights in the retention of his data in a “domestic extremism” database. The Court agreed that there was a “pressing social need” to collect such data, and that the law provided for a review after six years. In Court’s view, however, there was no assurance that the review would be “conducted in any meaningful way” and the data could potentially be held indefinitely. Adequate safeguards were lacking, and “personal data revealing political opinions attract a heightened level of protection.” The Court concluded that the deletion of the data did not seem “so burdensome as to render it unreasonable.”
Eleven pending cases
There are at least 11 pending cases at the ECHR on the retention of criminal records. Nine of them concern Russia, and Moldova and Slovenia have one each.
The A.G. v. Russia and 3 other applications concern suspects whose procedures were discontinued and who were never convicted. The applicants in N.F. v. Russia and 4 other applications were sentenced to periods of imprisonment. Their sentences were served or lifted by a court.
In all nine Russian cases, the authorities recorded the data relating to the criminal procedures or convictions in a special database. Several years later, the authorities refused to delete the data.
The ECHR asked the Russian authorities to describe the procedures for the collection, storage, and destruction of data on criminal proceedings which had been discontinued, the use to which those data can be put, the duration of storage, and the circumstances in which those data may be disclosed. The Court also asked for an exhaustive list of the authorities, officials and persons who may access data on spent (convictions that can be effectively ignored after a specified amount of time) or lifted convictions, or who may request the disclosure of that data.
In its communication with authorities, the Court suggested that the criteria set in M.M., par. 195-207, should be followed. The law should be clear to give applicants an indication that the data would be processed after proceedings had been terminated, and the maximum duration of such processing. For each stage of the data processing, the law should provide adequate safeguards against arbitrary and disproportionate interference with the right to respect for private life.
The Court was concerned about the scope and application of the recording system, the duration of data processing, and the procedures for collecting, storing, accessing, examining, using, communicating, disclosing, and destroying the recorded data. There should be a procedure for notifying an individual of the recording of data, and a procedure open to individuals to apply for a review of the accuracy of their data, its correction and destruction.
Similarly, in Mereuta v. Moldova, which has been pending for seven years, the Court will examine whether Moldovan law provides sufficient safeguards on the retention and disclosure of criminal record data.
Robberies and murders erased, but not a drink-drive offence
In the Slovenian case, the applicant was fined in 2010 for an administrative offence of driving under the influence of alcohol, and his driving licence was revoked. In 2015 he requested a local administrative officer to print the information on him held in the database. The printout stated that he was convicted of a misdemeanour, and included the date of the violation, the number and date of the judgment, the sanction, which was the “Termination of the driver’s licence”, a note that he was not allowed to obtain a new permit for six months, and some other data. The document also stated that his driving licence was currently “Invalid”.
The record of an “invalid” driving licence prevented the applicant from obtaining a new permit under the same criteria that apply to others. Much stricter rules apply to people whose licences have been revoked, and this different treatment endures for life.
The applicant asked the authorities to erase all the above data, except the note that his driving licence was invalid. He explained that under Slovenian law all misdemeanour data should be deleted after three years, and if not erased, the authorities should not consider it when making decisions, and it should not lead to any legal consequences. He argued that the indefinite retainment of records violated his rights. He also claimed that a life-long differential treatment compared to other applicants for driving permits was incompatible with the Convention. In Slovenia, the records of most robberies are erased after eight years, and murders after 10 or 15 years after the sentence was served.
The applicant referred to the ECHR’s Article 8 and case law, Art. 16 of the Treaty of the functioning of the EU, Art. 8 of the EU Charter of fundamental rights, Art. 13 of EU Directive 95/46/EC, and Council of Europe documents.
His request was denied, as were his judicial appeals. The courts held that keeping drivers’ records forever pursues the aim of “increasing road traffic safety”. According to the court, the constitutional right to privacy “is not unlimited and not absolute”, and measures taken were necessary and proportional.
The future of criminals’ data retention
The Court’s cases on conviction records on one, and those on DNA and photographs retention, on the other hand, place very similar requirements on states, which are very similar to cases on health data retention (Surikov v. Russia). They allow states to keep data only for a limited time, in line with the proportionality principle, and they need to provide for an independent review of the justification for retention and afford adequate and effective safeguards of privacy rights.
In many jurisdictions, political and interest groups’ pressure resulted in drink-drive misdemeanors being treated differently from most other breaches. A proper proportionality review should prevent excessive interference with drivers’ rights. In Britain, for example, legislative drafts had proposed permanent data retention for drink-drive offences. After they were reviewed in light of the ECHR, the data is now retained for crimes where a drunk driver caused death or injury. For minor violations, a conviction will be “filtered out” after three or six years. The ECHR may soon answer whether it allows states to treat drunk driving records differently from those of other misdemeanors.
In Gaughran and Trajkovski the Court listed some of the states that provide for indefinite retention or for no review. Hopefully, these and other states lacking limits or possibilities of reviews will take note of it and assess their laws without waiting for the Court to examine legislation of each of them separately.
Jurij Toplak is Professor of Law at the University of Maribor, Slovenia (email@example.com) and Visiting Professor at Fordham Law School, New York (firstname.lastname@example.org)