Proportionality in numbers

The UK’s automatic number plate recognition (ANPR) camera network is one of the largest data-gathering systems in the world. There are some 8,000 cameras on UK roads, capturing between 30 and 40 million images a day – and this volume of data is set to increase significantly in the coming years as the National ANPR Data Centre (NADC) is replaced by the National ANPR Service, with the team behind the programme confident it will be able to handle as many as 50 million readings a day (see PP534). Alongside basic vehicle tracking and matching, mined ANPR metadata can also be used for other purposes, such as creating in-depth behaviour patterns for members of the public. Not surprisingly, this has led to accusations of ANPR becoming overly invasive. As such, one of the prime considerations for the police is to demonstrate the legitimacy of ANPR use, but for such a widely used system, ANPR has some serious inherrent flaws in areas of data protection. Aside from accusations of ‘over-surveillance’, the fact that ANPR records are legally classed as personal data means forces must be cautious in their capture and retention or risk damaging public confidence and the principle of policing by consent. At the National Police Chiefs’ Council ANPR conference in November, leading intelligence figures discussed the implications of these challenges and how they might be overcome. Proportionate use Under human rights law, ANPR ‘reads’ are classed as personal data. This means their use is partially governed by the Data Protection Act 1998 an as a result, even though it is undoubtedly useful for fighting crime, forces cannot use ANPR cameras at their discretion. A careful balance must be struck to ensure that while serious offenders are caught, the best interests of the public are always considered. According to Jonathan Bamford, head of strategic liaison at the Information Commissioner’s Office (ICO), this balance has yet to be achieved. “The first time I had to really grapple with how the Data Protection Act applied to ANPR was in the early days of the NADC,” said Mr Bamford. “We were getting complaints from civil society groups that were concerned about the extent of data being collected and the fact it appeared to be retained forever.” Around the time of the technology’s introduction, ANPR records could be held for between five and six years. After raising its concerns, the ICO successfully campaigned to lower this to two years. It also successfully managed to have around seven billion pieces of information that had been ‘over-kept’ deleted, and encouraged forces to analyse whether the new retention period was justified. But since then, the use of ANPR has grown way beyond what was ever anticipated, with tens of billions of reads captured every year. Data is still being retained for longer than it should be, and research by forces into the new ‘retention period’ remains outstanding. This is gradually being rectified, but progress is slow and leaves the service open to serious challenges on the grounds of disproportionality, as well as undermining public confidence. Questions have been raised about the proportionality of a two-year retention period for a system that captures far more images of innocent people than hardened criminals. Surveillance Camera Commissioner Tony Porter has even drawn attention to police plans to raise the retention limit again, to around seven years, which he found problematic. This view is shared by William Perrin, director of technology consultancy Talk About Local, who described over-retention of data as “obviously wrong”. “The liability of having that data sitting in the system is really quite horrendous given the scale of the ANPR system,” he said. “It’s the first thing the service needs to deal with. “Then, in my view, you need to cut the retention period back to a year. A year is the level of data protection Parliament has agreed upon for communications data, and it is generally common across the system.” Need for legislation Anyone