Police Scotland data ruling a ‘helpful reminder’ of erasure rights

Laura Gillespie of Pinsent Masons said the case was a “helpful reminder that the right to erasure is not an absolute right” and that, “in this instance, evidence gathered in response to a complaint should be maintained, even if the content was challenged.”

Her comments come after taxi driver Robert Bartosik sought orders under the 2018 Data Protection Act (DPA) for the erasure of personal data held by Police Scotland, and for compensation for distress caused by the failure to erase it. In May 2020, Bartosik told police about eight instances in which individuals had allegedly made off without paying him after taxi journeys. Two months later, Bartosik submitted a complaint to Police Scotland, claiming that officers had failed to record and investigate the allegations and had not responded to his report.

During its investigation into his complaint, Police Scotland took a statement about his report from a person who worked in the police office. The statement also included other information about Bartosik which was not relevant to the investigation, and which was later confirmed to be inaccurate. When he became aware of the statement, Bartosik requested that officers erase the inaccurate information. But Police Scotland refused to do so on the ground that, under its data retention procedure, a record of the information was required to be maintained until January 2026, albeit for a restricted purpose given its inaccuracy.

Bartosik argued that the decision to refuse the request for erasure breached s37 and s38 of the DPA because the data was not “adequate, accurate and relevant to the petitioner”. Bartosik said the information did not concern him and interfered with his private life. He argued that Police Scotland’s decision to refuse the erasure was “invalid” and should be revoked under s167 of the DPA. Bartosik also sought compensation under s169 of the Act for the “distress” caused by Police Scotland’s refusal to delete the inaccurate information.

Police Scotland argued that no order should be made under s167 because the statement is relevant to Bartosik’s complaint against the force and is evidence of the way it was dealt with by officers. It said that it had already restricted how the statement could be used and added that the content of the statement was innocuous and that no prejudice flowed from it. Police Scotland argued that there had been no breach of Bartosik’s data protection rights and that he should not be awarded damages under s169.

In its decision (14 pages / 521KB PDF), the Outer House of the Court of Session held that that Police Scotland was correct to refuse the initial request for erasure. While s38 of the DPA requires data held for law enforcement purposes to be accurate, it noted that witness statements are inevitably subjective and potentially inaccurate. It found that officers should not be required to correct such statements, since this would force them to rectify witness statements retrospectively. The court held, therefore, that s38 did not apply to the accuracy of the content of witness statements.

The court also held that, even if the statement was to be regarded as not a witness statement due to a lack of formality, it should still be retained as it was part of an ongoing investigation into the allegedly unpaid taxi fares. It rejected Bartosik’s application for an order to erase the information under s167 and ruled that no compensation under s169 was due as a result.

Gillespie said: “Interestingly, the court also commented that while a decision was not required as to the level of compensation, the judge commented that the sum of £10,000 claimed was difficult to justify as a ‘fair and reasonable’ amount of compensation. The information in dispute was found to be ‘innocuous’ and as such, the judge found it difficult to see how that would cause distress to the petitioner.”

Mitchell Abbott of Pinsent Masons said: “The case is notable as there are relatively few judgments on s167 and s169 of the DPA. Although it concerns the police, it offers wider guidance on how data should be retained in ongoing investigations and proceedings. At issue in this case was whether Police Scotland complied with its obligation to reply to Mr Bartosik’s request within one month. The case also serves as a reminder to organisations to ensure that they have procedures in place to meet the statutory response deadlines.”