A law enforcement agency's use and retention of personal data of a person obtained during an arrest. The Administrative Appeals Board affirmed the Privacy Commissioner's decision that such use and retention did not contravene DPP3 and DPP2(2).
Complainant was previously convicted and was subsequently arrested for another offence - enforcement agency did not prosecute the complainant for the subsequent offence but refused to return the personal data collected during the arrest - DPP2(2), DPP3, section 58
The complaint
The complainant was previously convicted in 1991 and was arrested by a law enforcement agency (the Agency") for another offence in 2006. During the arrest, the Agency took photographs of the complainant and obtained copy of his identity card, his telephone number and address. The Agency subsequently decided not to prosecute the complainant but refused to return the personal data to him.
The complainant complained to the Privacy Commissioner that: (i) the Agency had used his personal data obtained in 2006 to search for his previous conviction records and such use was prohibited by DPP3; and (ii) the Agency should not have kept the personal data after they decided not to prosecute him, and such retention was prohibited by DPP2(2).
Findings by the Privacy Commissioner
The Privacy Commissioner found that, as the Ordinance does not prohibit a data user from searching personal data kept in his records and there was no evidence to suggest that the Agency had disclosed or transferred the complainant's personal data for other purposes, the Agency's act of searching the complainant's previous criminal conviction records does not constitute a contravention of the Ordinance.
On the retention of the complainant's personal data, the Agency explained to the Privacy Commissioner during preliminary inquiry that, since the complainant was previously convicted, they would retain the complainant's photographs pursuant to a statutory provision and that they would retain the other personal data (identity card copy, telephone number and address) for 12 months for possible use in future investigation of offence or internal investigation. The Privacy Commissioner was satisfied that the Agency was entitled to retain the complainant's photographs under the statutory provision and that the retention period of 12 months in relation to the other personal data was reasonable in the circumstances. Therefore, the Agency has not contravened DPP2(2).
Having considered all the circumstances, the Privacy Commissioner decided not to carry out an investigation. The complainant appealed against the Privacy Commissioner's decision.
The appeal
The Board agreed with the Privacy Commissioner's findings on the Agency's use of the complainant’s personal data and further added that, in any event, the personal data obtained in 2006 should be held for the purposes of the protection or detection of crime or the apprehension, prosecution or detention of offenders and, therefore, would be exempted from DPP3 by virtue of s.58(2) of the Ordinance.
The Board was also satisfied that the Agency's retention of the complainant's photographs was permitted by the statutory provision. Moreover, having further considered the Agency's internal guidelines in which the retention period of 12 months was expressly provided, the Board found that the retention period of 12 months is reasonable and consistent with DPP2(2).
AAB's decision
The appeal was dismissed.