Ready for impact

The UK’s automatic numberplate recognition (ANPR) network is one of the largest non-military data gathering systems in Europe. ANPR cameras capture approximately 50 million images per day, storing them on a vast database for potential future analysis. As a result, this network is extraordinarily sensitive – data mining ANPR can allow forces to understand where individuals are, how frequently they travel, etc – but unlike many other tools, use of it is entirely reliant on public consent. Despite the legislative framework that supports ANPR use, it does not have a secure statutory footing or any dedicated legislation. This renders it incredibly vulnerable. Civil liberty groups opposed to ANPR have repeatedly made it clear that they are looking for just one incident of misuse to challenge the entire system, which could have disastrous legal implications. From May, the EU General Data Protection Regulation (GDPR) will officially become enforceable, introducing new requirements for processing personal information that forces will have to comply with. While this change has been widely publicised by organisations such as the Information Commissioner’s Office (ICO), another piece of legislation due to receive Royal assent in March – the Data Protection Bill (DPB) – has received remarkably little attention, despite similar potentially significant impact. To stay ahead of proportionality requirements, forces need a solid understanding of what this law will mean for them and what they must do to ensure compliance. According to Meagan Mirza, lead for the police, justice and surveillance team at the ICO, forces are currently complying well with the requirements to ensure ANPR use is benign. Addressing the recent national ANPR conference in Broughton, she highlighted the widespread use of privacy impact assessments (PIAs) and the strong governance arrangements in place as reasons why she frequently cites the ANPR community as an example of good practice. “You have really detailed standards that support what you do, so when there have been questions about what legal basis you have to rely on, all of that comes in to play in terms of appropriate safeguards in place,” she said. “Understanding what you need to comply with has been complex. But it’s going to get slightly more complex going forward.” The DPB was first announced in June but it was only in the autumn that its implications for law enforcement became clear. While the GDPR will introduce almost identical data protection rules across Europe (and will continue to apply after March 2019, when the UK formally leaves the EU), member states have limited opportunities to make provisions for how it will apply in their own countries. This is the essence of the DPB, which will implement the GDPR in the UK, replace the Data Protection Act 1998, and will place restrictions on rights to access and delete certain kinds of data. The Bill comprises seven parts, but only the third of these, ‘Law Enforcement Processing’, is relevant to the police service. This section applies to all law enforcement agencies, classing them as ‘competent authorities’, as well as a number of other agencies that have a statutory function to perform any of the purposes to address criminality outlined in the legislation. One of the first changes the DPB will introduce is the mandatory completion of impact assessments. Although forces are now mostly conducting PIAs prior to using ANPR, this has not always been the case. One of the most infamous ANPR incidents of the past few years – Hertfordshire Constabulary’s decision to introduce a ‘ring of steel’ around the town of Royston – did not involve a PIA, and as a result, it prompted complaints by members of the public and enforcement action by the ICO. Since then, use of PIAs has been highlighted as an area of good practice and a framework document is being put together to guide forces in how to conduct them. However – perhaps to prevent a repeat of the Royston incident – the DPB will require forces to conduct an impact assessment for all