Page 162 - Deception at work all chapters EBook

Planning Investigations and Legal Background for Tough Interviews 163

THE SOHAM MURDERS Protection Act his force had deleted
intelligence records after a month, in the
We should never forget the tragic murder of process removing those relating to Huntley.
Holly Chapman and Jessica Wells in Soham He was rightly pilloried and should have lost
and the outcry that followed the conviction his job, but the Information Commissioner,
of Ian Huntley. It emerged that this man whose statements and guidelines had run
had been recruited as the caretaker of the amok, ran for cover. He too should have
school, which the girls attended, without been required to resign as most people
the management being told of his previous involved in law enforcement had long
history of sex with under-aged girls and complained that his interpretations of the
alleged rape. act had been far too liberal and pervasive.

The Chief Constable of Humberside
suggested that to comply with the Data

In December 2003, the Court of Appeal in the case of Michael John Durant and Financial
Services Authority (see www.courtservice.gov.uk/judgementsfiles/j2136/durant v FSA) struck
a blow to the heart of those that were building empires from data protection legislation by
ruling on the definition of ‘personal data’ and the extent to which non-computerized manual
filing systems fell within the provisions of the act. It was a landmark decision that totally
exposes many of the Information Commissioner’s guidelines on such things as CCTV moni-
toring, interception of communications and HR policies and procedures.

On the matter of what is and what isn’t ‘personal data’, the Court of Appeal gave a very
narrow definition (remember, in any event, in only applies to automatic processing) and ex-
cluded ‘information which has as its focus something other than the individual (for example a
transaction or document)’ and continued that not all information retrieved from a computer
search on an individual’s name is necessarily personal data.

The court also ruled on what did and did not constitute a ‘relevant filing system’, result-
ing in the Information Commissioner conceding, ‘… Following the Durant judgement it is
likely that very few manual files will be covered by the Data Protection Act’. For convenience,
we refer to ‘relevant filing systems’ that might be covered by the data protection regime as
‘structured’; there will be very few of them. For example investigation case files (and thus
data collected in respect of them) and most personnel files do not fall within the provisions
of the data protection legislation. It is also likely that CCTV recordings will also be excluded,
although this aspect has yet to be challenged in court. The bottom line of the Durant case is
that it brought reality back to the data protection world: and not before time!

The Data Protection Act is based on the following important principles for the processing
of personal data when it is being processed by means of equipment operating automatically.
It must be:

• fairly and lawfully processed;
• processed for limited purposes;
• adequate, relevant and not excessive;
• accurate;
• kept no longer than is necessary;
• processed in accordance with the data subject’s rights;
• not transferred outside Europe.