Automated Number Plate Recognition : Data Retention and the Protection of Privacy in Public Places

The Investigatory Powers Act (IPA) was a response to concerns about surveillance in the light of a series of cases from both European courts which found the challenged regimes to be inadequately specified in law and disproportionate. The IPA is not, however, a complete regime for all types of surveillance and intelligence gathering. This article considers another such area, the use of Automated Number Plate Recognition (ANPR), which raises the difficult issue of privacy in public places and which in the main lies outside the IPA. Relying on jurisprudence on the right to a private life from the European courts, this article puts forward the argument that ANPR and the retention of ANPR data constitutes an interference with an individual’s right to privacy. As well as the concerns arising from systemic retention of data and inadequate handling arrangements, this article addresses the question of whether ANPR constitutes an intrusion into locational privacy, a subset of privacy that has not been directly discussed yet in domestic legal literature. Any intrusion into privacy must be justified: that is, it must be for a legitimate purpose, in accordance with the law, and proportionate. It is argued that the current regime regarding ANPR is deficient in a number of respects when measured against these requirements, and that the domestic courts’ approach to privacy is likewise insufficient. The ANPR regime also illustrates the problematic, minimalist response of the UK to European rulings on privacy generally and state surveillance specifically. In failing to respect the underlying principles, any regime runs the risk of being challenged and the article concludes by recognising that risk in this context. With increased deployment of ANPR, this issue is one of significance for road users and law enforcement alike. As other surveillance technologies which contribute to the erosion of privacy in public spaces, notably drones (UAV) and body worn video (BWV), become increasingly used, the questions raised here have more general significance.


Introduction
The Investigatory Powers Act (IPA) was a response to concerns about surveillance in the light of a series of cases from both European courts 1 which found the challenged regimes to be inadequately specified in law and disproportionate.The IPA is not, however, a complete regime for all types of surveillance and intelligence gathering.This article considers another such area, the use of Automated Number Plate Recognition (ANPR), which raises the difficult issue of privacy in public places and which in the main lies outside the IPA.Relying on jurisprudence on the right to a private life from the European courts, this article puts forward the argument that ANPR and the retention of ANPR data constitutes an interference with an individual's right to privacy.As well as the concerns arising from systemic retention of data and inadequate handling arrangements, this article addresses the question of whether ANPR constitutes an intrusion into locational privacy, a subset of privacy that has not been directly discussed yet in domestic legal literature.Any intrusion into privacy must be justified: that is, it must be for a legitimate purpose, in accordance with the law, and proportionate.It is argued that the current regime regarding ANPR is deficient in a number of respects when measured against these requirements, and that the domestic courts' approach to privacy is likewise insufficient.The ANPR regime also illustrates the problematic, minimalist response of the UK to European rulings on privacy generally and state surveillance specifically. 2In failing to respect the underlying principles, any regime runs the risk of being challenged and the article concludes by recognising that risk in this context.With increased deployment of ANPR, this issue is one of significance for road users and law enforcement alike.As other surveillance technologies which contribute to the erosion of privacy in public spaces, notably drones (UAV) and body worn video (BWV), become increasingly used, the questions raised here have more general significance.

Automated Number Plate Recognition and the Current Domestic Regulatory Framework
ANPR, whether mounted in cars or in fixed locations, is a form of CCTV used to read and store vehicle number plates.The police ANPR system in England stores two images in respect of each 'read': one is of the number plate; the second, an image of the whole vehicle.The time and location of the read is also recorded.The data are processed locally by police forces before being transferred to the National ANPR Data Centre (NADC).The data is then available to the police for searching nationally.The Metropolitan Police (the Met) has a separate system, which was introduced to tackle terrorist threats connected to the London Olympics.Data in NADC is stored for all vehicles, including data for vehicles that are not known to be of interest at the time of the read, if ever.The amount of data stored is vast: the NPCC ANPR Strategy suggests a figure of 40 million reads daily.While the ANPR web-page states that ANPR data is held for two years, 3 The Commissioner for Surveillance Cameras (CSC) noted that there were plans to extend the period of data retention from two years to a maximum of seven.Further, according to ANPR User Group minutes, the Met has retained data for longer than two years. 4e ANPR system can cross check ANPR data with lists of driver information.These lists include, for example, details of those without valid insurance or of suspects in ongoing investigations.In addition to immediate cross-checking for problem cases, the data may be retained for future use in criminal investigations generally.The CSC's Report for 2014/15 noted that the NADC data can be used for data mining in a number of ways: real time and retrospective vehicle tracking; identifying all vehicles that have taken a particular route during a particular time frame (vehicle matching); identifying all vehicles present in a particular place at a particular time (geographical matching); verifying alibis, locating offenders or identifying potential witnesses; linking individuals to identify vehicles travelling in convoy (network analysis); and subject analysis when ANPR data is integrated with other sources of data (CCTV, communications analysis, financial analysis) to create an in-depth profile of an individual.These different types of analysis mean that the data generated by ANPR may be used predictively and generally.In this, we see a shift from specific and suspicion-based collection and use of data to a less discriminate system which poses greater risks for individual privacy. 5ile there is no specific statutory mention of ANPR, certain legislation is relevant to its operation: the Data Protection Act 1998 (DPA), the Protection of Freedoms Act 2012 (PoFA) and possibly the Regulation of Investigatory Powers Act 2000 (RIPA) and IPA.The use of ANPR falls within the DPA as the registration number and the wider vehicle image could constitute 'personal data'. 6Data protection principles therefore apply.The Information Commissioner issued a Code of Practice 7 with regard to CCTV, including ANPR cameras, elaborating the data protection rules in this context.It does not, however, provide a legal basis for the collection of data.PoFA (which applies only to England and Wales) established the CSC, who likewise developed a code 8 on the appropriate use of surveillance cameras by relevant authorities, including the police. 9The obligation on relevant authorities is to have regard to the code; non-compliance is not in itself a civil wrong or criminal offence. 10The code reflects at a very general level some of the concerns protected by Article 8 ECHR/ Article 7 EUCFR.The two codes have principles in common, as the Information Comissioner's code makes clear, though each has separate 'enforcement' processes.In particular, the role of the CSC is not enforcement of the code but rather to encourage compliance. 11vert surveillance falls outside DPA and PoFA, being dealt with by RIPA.Part II of RIPA, which provides some basis for investigatory techniques which previously had none, applies to the use of covert directed or intrusive surveillance by designated public authorities 12 (as well as to covert human intelligence sources (CHIS) 13 ).Authorization for directed surveillance and CHIS is given by a police superintendent 14 and for intrusive surveillance the approval of a senior authorising officer is required.A failure to obtain authorization seems, however, to have no legal consequences. 15Note that electronic tracking devices are expressly excluded from the intrusive surveillance regime and other forms of surveillancesuch as CCTVdo not fit easily in the framework. 16e IPA does not regulate the creation of ANPR datasets or their analysis by the police.Part VII IPA provides some control over the use by intelligence agencies of "bulk personal datasets"."Bulk personal datasets" are defined in s. 199 IPA as a set of information that includes personal data relating to a number of individuals where the majority of those individuals are not and are not likely to be of interest to the intelligence services and where an intelligence service retains the set, which is held electronically for analysis.ANPR data could fall within this definition.Therefore, an intelligence agency seeking to analyse ANPR data would require a warrant so to do.Whether the provisions themselves are acceptable from a privacy perspective is one question, 17 and one which falls outside the scope of this article.What is clear is that the IPA does not regulate the police use of ANPR.
Finally, it should be noted that some police powers to investigate are based in the common law. 18In the case of Wood, 19 which involved the photography by the police of Wood, the Court approved older jurisprudence 20 which described police powers broadly as all steps necessary for preventing crime.Insofar as this is accepted, the common law basis, which is open-ended, could be used also in relation to ANPR.

Human Rights Standards
Answering the question of whether the ANPR regime is open to challenge requires the identification of standards against which that regime should be measured.In this context, the two European systems, the Council of Europe and the European Union, and their respective human rights documentsthe European Convention on Human Rights (ECHR) and the European Charter of Fundamental Rights (the Charter)appear relevant, but are both applicable to the situation at hand?
The Human Rights Act (HRA) implements the ECHR.It requires public authorities, for example the police, to act compatibly with a number of rights in the ECHR, including Article 8.When considering a question concerning the ECHR, national courts must have regard to the case law of the European Court of Human Rights (ECtHR).While the ECtHR's jurisprudence is not binding on the English courts, 21 it will normally be followed 22 and, where a discrepancy in approach arises, an individual may still bring a claim before the ECtHR.
The Charter applies only within the scope of EU law 23 but the boundaries of EU law are not precisely delineated.While the protection of rights forms part of the basis of the EU, it cannot create the grounds for its own application. 24Article 16 TFEU (and Article 39 TEU as regards common foreign and security policies) gives the EU power to take action in respect to the right to data protection (but not the right to private life).Are these provisions sufficient to bring all data protection activities within the scope of EU law?Notably, the UK takes the position that, in relation to shared competence, if the Union has not acted then the specific issue does not fall within the scope of EU law. 25 The position on this point is not yet clear, 26 though the Court of Justice is unlikely to view the matter so narrowly. 27Furthermore, there are a number of EU instruments which particularise the right: the Data Protection Directive, 28 shortly to be replaced by the General Data Protection Regulation (GDPR); 29 and Law Enforcement Data Protection Directive, 30 replacing Framework Decision 2008/977/JHA.The position remains more complex than suggesting that this legislative activity results in all data processing activity falling within the scope of EU law. 31It could be argued that, because the Framework Decision is in place, 32 the question of whether police activities fall within EU law depend on that instrument's scope.The Framework Decision relates only to cross border data flows, however.The new Law Enforcement Directive covers police processing generally but will come into force in 2018. 33This current gap may be more apparent than real because of the existence of the general data protection regime.Although there are exceptions for law enforcement in the Data Protection Directive, 34 a Member State's act of derogation still falls within the scope of EU law. 35On that basis, while there may be scope for derogating from the substantive processing rules, relevant authorities would still have to comply with the Charter in so doing.As regards the new Law Enforcement Directive, the position is complicated by the UK's position under Title V of the TFEU: the UK is not bound by measures under Title V of TFEU unless it opts into them. 36As a result, public authorities 'are not bound by the rules laid down' in the Law Enforcement Directive in respect of measures into which the UK has not opted. 37The UK government argued that the Law Enforcement Directive will not apply to internal situations in the UK. 38 is far from clear that the Government's position is correct.First, the UK has opted in to some actions, for example those relating to terrorism, child pornography and people trafficking. 39nsofar as data acquisition, retention and examination could be used in relation to those actions, the processes would have to comply with the Law Enforcement Directive and thus be within the scope of EU law.Attempting to separate data collected and retained on a bulk scale according to its use would be practically impossible.Secondly, the possibility to opt-in is provided by EU law and therefore, following NS, should fall within EU law. 40In NS, 41 the exercise of a discretionary power by the Secretary of State in the context of the Dublin Regulation on asylum seekers was held to form part of the EU system of law.The commonality between discretion and derogation is that in both instances EU law provides the framework within which Member States' choices are exercised. 42Finally, it makes little sense to suggest that an area that currently falls within the scope of EU law as derogation from the Data Protection Directive would subsequently fall outside EU law after the enactment of a directive specifically on point.It therefore seems likely that the activities of law enforcement do fall within the scope of EU law and must comply with the Charter (as well as the ECHR). 43llowing Brexit, it is unclear how much will change.The UK, unless steps are taken to change the position here too, will still be part of the ECHR and will continue to have effect through the HRA.The Charter will not be directly relevant to the UK, but it may still have an indirect effect.If the UK wants to maintain data flows with the EU an adequacy decision under the GDPR will effectively be required.Achieving this has the effect of bringing the UK into a position where its laws may be assessed by reference to the Charter, as can be seen in Schrems. 44Schrems concerned the challenge to the adequacy decision made in respect of the United States.In that case, the internal arrangements of the United States were assessed for their impact on privacy by reference to Articles 7 and 8 of the Charter and this included policy fieldssuch as national securitywhich normally fall outside the scope of EU competence.It may be that this indirect review of the UK is broader than that to which it is currently subject as a Member State.

Privacy in Public Spaces
The first consideration is whether privacy, and specifically Article 8 ECHR or Articles 7 and 8 of the Charter, apply.Article 8 ECHR is broad, comprising a number of elements: private life, family life; home; and correspondence.The Charter provides protection in similar terms in Article 7; Article 8 EUCFR provides a separate right to data protection.The ECtHR has interpreted 'private life' broadly. 45In general terms, the Charter will be interpreted in line with the ECHR. 46'Private life' includes personal, social and economic relations; moral and physical integrity; 47 personal identity; 48 personal information; 49 reputation; 50 and personal or private space. 51As the ECtHR noted in Pretty, the notion of personal autonomy is central to its understanding of Article 8 ECHR 52 and '[t]he very essence of the Convention is respect for human dignity and human freedom'. 53It is certainly not limited to confidentiality, secrecy or aloneness.Nonetheless, Article 8 ECHR, and its Charter equivalents, cannot cover every aspect of our lives or every relationship that we might form. 54In the context of a claim that a ban on hunting was an interference with Article 8 ECHR, Baroness Hale in the Supreme Court, stated that the protection of psychological and physical space protected by the right fell 'some way short of protecting everything they might want to do even in that private space; and it certainly does not protect things that they can only do by leaving it, and engaging in a very public gathering and activity'. 55This raises the question as whether individuals can rely on Article 8 ECHR (or Articles 7 and 8 EUCFR) in relation to public activities, such as driving down a road and what sorts of State activity constitute interference.The position in this area is not entirely clear, and it is arguable that there is some difference in approach especially as regards the domestic courts.
The starting point for the domestic courts and the ECtHR is similar56 ; that being observed in public does not trigger privacy. 57Equating the taking of a photograph to the act of observing with the naked eye, photography (in a public place) on its own is not contrary to English law, 58 though its subsequent dissemination might constitute misuse of private information. 59In Peck, the ECtHR distinguished between the monitoring of someone in a public place (via CCTV) and the recording of that image. 60It found that the further dissemination of the CCTV images to the media constituted an infringement of Article 8, but did not consider the question of whether the process of creating the images also constituted an intrusion because Peck did not argue this point.While in practice there may be close connections between these stages, it is important to note that there are at least three of them: the viewing of an individual; the creation of a record (howsoever structured); and use of that information.Dissemination could be a fourth state.It is an open question whether the creation of a temporary record as part of the observation process fits in stage one or two.These different stages may affect privacy to different degrees.The ECtHR has also recognised the interests affected by unwanted photography.In Reklos, 61 reasoning from the fact that Article 8 protects an individual's identity, it held that a person's image revealed his or her unique characteristics and constituted one of the chief attributes of his or her personality.Effective protection of the right to control one's image required the consent of the person concerned when the picture was being taken and not just in relation to publication of that image.The image in this case was taken in the hospital.It may not therefore translate exactly to photography/recording in public places.Although the ECtHR recognised this point about location, it is significant that the judgment was not based on spatial considerations, but on concerns for personality.
Peck reminds us that Article 8 protections are not limited to private spaces.Numerous cases affirm that there is 'a zone of interaction of a person with others, even in a public context, which may fall within the scope of "private life"' 62 .While there is no automatic claim for privacy in a public space, especially for public persons, 63 such a claim cannot be totally excluded either.In von Hannover Article 8 was held to be applicable. 64The case concerned the applicant, a public person, engaged in activities such as shopping, horse-riding or meeting her boyfriend, activities which the Court held fell within her private life.In finding that there had been an infringement, the ECtHR emphasised that the images of 'intimate "information"' were taken 'in a climate of continual harassment'. 65Although von Hannover concerned less clearly sensitive information than Peck and was more public than Reklos, it also involved an ongoing monitoring that of itself could be intrusive.In sum, in each of these cases, there was some exacerbating factor beyond the taking of the photograph, though the factor was not the same in each case.
Von Hannover also referred to the applicant's 'legitimate expectation of privacy'.This phrase, or its variant 'reasonable expectation of privacy', has become central to the jurisprudence on Article 8 ECHR and the English tort, misuse of private information, developed from Campbell. 66Following Campbell, the taking of a photograph is viewed as a use of private information in a particularly sensitive format.Many of the cases have involved intrusion by the media, rather than the State.They therefore require the balancing of two rights: the right to private life and the right of the media to freedom of expression, but before this balancing takes place, the claimants must demonstrate that there is a 'reasonable expectation of privacy' in the information. 67This is a fact sensitive analysis in which a range of factors are taken into account: the sensitivity of the information; the context in which the information was obtained; and whether the information was in the public domain. 68Significantly, in these media cases, the English courts have recently accepted that even innocuous public activities could give rise to a reasonable expectation of privacy. 69Note, however, that in these cases, photography of children who had not themselves courted publicity was involved.Without such exacerbating factors would the court have so found? 70 must also question whether the approach in Von Hannover and Campbell, which applies in the relationship between non-state actors, is -or should be applied -in exactly the same way when the intrusion is committed by the State.In Kinloch, which concerned police observation of a suspect, the Supreme Court held that a person cannot have a reasonable expectation of privacy in criminal acts, and such a person in public takes the risk that his actions will be noted. 71In the subsequent Re JR38, 72 the Supreme Court was split as to whether Article 8 ECHR was engaged.The case concerned the publication of CCTV stills in the media to facilitate the identification of an individual who had been involved in rioting.While most of their Lordships felt that the test of a reasonable expectation of privacy was the key, and that the criminal nature of a person's activities was found to be relevant in limiting that expectation, Lord Kerr in the minority held that it was an important factor but not determinative. 73Arguably, the majority over-emphasised a particular conception of 'reasonable expectation of privacy', a conception which blurs factors for the applicability of the right to private life with considerations taken into account when justifying any interference.Such an approach runs the risk of undermining the human rights protection of those suspected or convicted of an offence.Indeed, the ECtHR has ruled that the publication of images of those involved in criminal cases have violated Article 8. 74 Moreover, the question of whether an assessment of the privacy right's engagement should not be solely about whether there is a reasonable expectation of privacy.Rather, as suggested by Lord Kerr in JR38, this test although important factor is not There is another line of jurisprudence which partially overlaps with that on photography; it concerns the distinctive position of the State as regards the records it holds on citizens.Consistent case law suggests that the storing of information relating to an individual's private life triggers Article 8. 75 In PG and JH, the ECtHR held that private life considerations may arise once a systemic or permanent record comes into existence; that person's expectation as to privacy may be relevant but not conclusive. 76In Rotaru, the information concerned the applicant's public protest and political affiliationsactivities that are not particularly private.In finding an intrusion, the nature of the information so recorded and the question of whether the information has been accessed are irrelevant. 77In focussing on the creation of files, the ECtHR reflects the concerns that underpinned the development of data protection rules. 78hile the Court of Justice has had little opportunity to rule on media intrusion, it has emphasised the importance of data protection, both in its own right and in connection with the right to privacy.Significantly, focusing on data storage and the State use of databases as a specific intrusion takes the courts away from considering only the 'reasonable expectation of privacy', a problematic -if not circularand potentially subjective test. 79though the vast majority of the cases concerning State storage of data have taken the view that storage of data is sufficient no matter the nature of the data, an outlier case should be noted: S and Marper. 80While it re-affirmed the previous jurisprudence, the ECtHR also seemed to limit the concern about storage to 'data relating to the private life of an individual'.In so doing, it suggested that relevant factors would not be limited to the content of the data, butreferring to the cases broadly about photography in public by authorities-also the specific context in which the information at issue has been recorded and retained, the nature of the records, the way in which these records are used and processed and the results that may be obtained. 81e approach of the Supreme Court to this issue is uneven.In Catt, 82 the police took photographs of Mr Catt at demonstrations.Although he was not convicted of any public order offences, the police kept the photographs, along with further information on Mr Catt and his relationships with other protestors.His challenge to the legality of this went through the domestic court system to the Supreme Court, and is now pending at Strasbourg. 83In Catt, one point on which their Lordships were unanimous was that Article 8 applied.Lord Sumpton stated, 'there may be some matters about which there is a reasonable expectation of privacy notwithstanding that they occur in public and are patent to all the world.In this context mere observation cannot, save perhaps in extreme circumstances, engage Article 8, but the systemic retention of information may do'. 84The question of whether the information obtained would be stored or form part of a record was not discussed in Kinloch or in JR38, suggesting that the Courts there may have thought that storage or further dissemination were also conditional on a reasonable expectation of privacy rather than separate routes to trigger privacy.
It is submitted that the systematic storage of ANPR reads, as well as their subsequent analysis in a variety of ways, constitute intrusions into privacy which must be justified.Insofar as S and Marper can be seen as imposing further requirements, either the photographing of the car and its occupants or the impact on 'locational privacy' (discussed below) satisfies any such sensitivity threshold.The argument based on photography is, however, comparatively weak.The main focus is the number plate.The photographing of the driving of a carwithout more -is unlikely to be an intimate action, even given the sensitivity of a person's image and the ECtHR's views in Reklos, unless the inside of a car is seen as private space.The argument on locational privacy is not only stronger, it raises wider questions about the impact of other interconnected surveillance and tracking devices in public spaces.
Locational privacy refers to the ability of individuals to move in public spaces in normal circumstances without their locations being systematically monitored and/or recorded.Surveillance based on location data can occur in a number of ways.It starts with capture of an individual's location at a particular point in time but can include real time monitoring of a succession of locations providing direction of movement; predictive tracking, which infers a person's near future behaviour by extrapolating from a person's direction of travel; and retrospective tracking, which uses the individual's data trail to reconstruct that person's movements, behaviour and associates, but can be used to suggest purposes and intention. 85ven without any particularly embarrassing or sensitive incident taking place, the accumulation of many points of incidental information can be intrusive affecting our 'zone of interaction'. 86o, 'privacy results not from locked door and closed curtains, but also from the way our publicly observable activities are dispersed over space and time'. 87Location data is seen as sensitive in data protection terms, particularly in the context of smart phones, 88 although other devices -e.g.bank cards and registered Oyster cards -could produce location data having a comparable impact.Locational privacy issues may arise in contexts beyond data storage and analytics; monitoring location data is akin to virtual tracking or directed surveillance of an individual. 89Recognising this category of privacy is important in understanding the extent of the intrusion into privacy created by the use of technologies including but not limited to ANPR.
While locational privacy was never perfectly guaranteed, the development of some technologies (for example BWV, UAV, devices with GPS embedded in them, as well as CCTV and ANPR) pose a greater threat to locational privacy, especially given the greater computing capacity available to store and to analyse any resulting data and the greater ubiquity of such devices.Monitoring of location has similarities to monitoring of social media activity (SOCMINT) in that both may be seen as relating to public, but nonetheless potentially sensitive, activities and the monitoring is consequently intrusive.Omand et al suggest that the use of SOCMINT needs careful control for this reason, and suggests that it is similar in impact to directed surveillance. 90e ECtHR considered some aspects of locational privacy in Uzun. 91Uzun was suspected of committing terrorist offences so he was tracked via GPS.Uzun argued that the GPS had enabled the authorities to draw up a comprehensive picture of his movements in public for months by means of a measure which was both precise and difficult to detect.The ECtHR accepted that tracking constituted an intrusion with an Article 8 right, even though the car in which the tracker was installed did not belong to Uzun, but a friend of Uzun's, S. It argued that: by the surveillance of the applicant via GPS, the investigation authorities, for some three months, systematically collected and stored data determining, in the circumstances, the applicant's whereabouts and movements in the public sphere.They further recorded the personal data and used it in order to draw up a pattern of the applicant's movements, to make further investigations and to collect additional evidence at the places the applicant had travelled to, which was later used at the criminal trial against the applicant. 92 In its analysis, the ECtHR downplayed the impact of such surveillance.It distinguished surveillance by GPS from other methods of visual or acoustical surveillance which, according to the Court, 'are, as a rule, more susceptible of interfering with a person's right to respect for private life, because they disclose more information on a person's conduct, opinions or feelings'. 93Even so, Article 8 was clearly engaged though on the facts the interference was justified.
Given that the ECtHR accepted that the determining of the whereabouts in public falls within Article 8, the same argument could be made with regard to ANPR; given the approach to 'passenger name record data' (PNR), which includes travel habits, a similar approach is likely to be taken by the Court of Justice. 94Of course, ANPR is designed to record cars not people, so not all movements might be recordednot even all car movements may be recorded.Nonetheless, Uzun accepted the link between person and car and implicitly that a perfect record of personal movements would not be required to trigger Article 8.It also seemed to accept that the fact that a car may not have the same occupants in each instance would not undermine this link between car and person.Of course, one might argue that surveillance by ANPR is less intrusive than GPS because of these factors 95  BWV, limited to public spaces.This argument goes to the intensity of the intrusion, not whether Article 8 is engaged in the first place.
Insofar as it is arguable that ANPR gives only a partial picture, the argument becomes less convincing as increasing numbers of ANPR cameras are installed, making it hard to avoid being recorded and also facilitating a more detailed picture of individuals' movements.While the car does not equate to a person, through DVLA and insurance records likely drivers can be identified; the faces of those in the front seats may also be visible, perhaps bringing in some of the concerns about photography generally.Potentially, this increase in cameras affects our autonomy, as we lose the ability to be free from surveillance, and our choices are limited by the invisible choices of the state.Furthermore, ANPR can be used not just to help identify who drove down a particular road, but also for vehicular matching, network analysis and (possibly in conjunction with other data) in-depth individual profiling, which are more intrusive forms of location surveillance.As with other bulk collection of data, the innocent are 'transformed into potential suspects' 96 .Further, depending on the location of ANPR, some places or areas 97 could be under effectively constant surveillance: a place of worship; a sports stadium.Tracing the vehicles then gives you a means to identify individuals and their connections.This is particularly problematic, however, when specific groups are singled out, raising the risk of discrimination in terms of groups consequently the subject of surveillance.
The ECtHR has recognised that the accumulation of data and its analysis, even where the data points in isolation seem quite harmless, can be revealing.In Zakharov and in the EU communications data retention cases both European courts highlighted the impact of communications data, rather than content, being retained and analysed. 98The Court of Justice noted that such data allows the profiling of the individuals and so is no less sensitive than the actual content of communications. 99It concluded that the interference, which led to an individual feeling under constant surveillance, was 'very far-reaching and must be considered to be particularly serious'. 100A similar argument could be made in the context of ANPR, especially where there is an increased density of cameras, the fact that searches may take place across a national dataset and consequently wide geographic scope, and given the potentially broad range of analytic techniques that may be used across NADC.In sum, the courts have recognised that a high degree of monitoring, even in public of insignificant actions can cumulatively be problematic, 101 even a harassment. 102It may be that in future such 96 Case A-1/15 Canada PNR Agreement, n. 94, Opinion, para 176 97 Under Project Champion two suburbs in Birmingham were to be monitored by a network of 169 ANPR, including covert cameras, were to form "rings of steel", so that residents could not drive into or out of the areas without being tracked.Project Champion was funded from the police Terrorism and Allied Matters Fund.After this was revealed, the project was abandoned.See Surveillance Camera Commissioner, Speech to the automatic number plate recognition (ANPR) national user group, in York, 26 November 2015, available: https://www.gov.uk/government/speeches/surveillance-camera-commissioners-speech-to-the-anpr-nationaluser-group-2015,accessed 17 February 2017.A further ring of steel around Royston was subject of a complaint to the ICO, resulting in an enforcement notice 98

Justification
Both the Charter and the ECHR permit the justification of an intrusion into privacy/data protection rights provided certain requirements are met.As far as the ECHR is concerned, Article 8(2) specifies three stages.The interference must be based in law, for a legitimate aim and 'necessary in a democratic society'.For the Charter, Article 52(1) constitutes an analogous provision.While its requirements may be similar, its terminology is different. 104Any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and must respect the essence of those rights and freedoms.Further, limitations may be imposed on the exercise of those rights and freedoms only if they are necessary and if they genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. 105Finally, any restriction should apply only insofar as is strictly necessary. 106The exception should not turn into the rule.While these tests are well-established in the courts' respective jurisprudence, the framework is not always clearly applied in a structured manner.Nonetheless, the cases to date are sufficiently clear to raise questions about the acceptability about the current ANPR framework as regards acquisition of data (the categories of person whose data is acquired), access to the data and data retention.

'based in law'
Article 8(2) ECHR requires that an interference be 'in accordance with the law', which is different from the text used in relation to other Convention rights where an interference must be 'prescribed by law'.While this difference could suggest that mere compliance with general norms (such as DPA, PoFA) might suffice, in practice the difference in wording between Article 8(2) and Article 10(2) has been described as 'irrelevant'. 107Even if the ECtHR is flexible as to the form the law must take, 108 the qualitative requirements (discussed below) mean that the requirement here is more than 'not illegal'.Furthermore, this textual difference is not found in the text of Articles 7 and 8 of the Charter.Article 52(1) of the Charter specifies that exceptions 'must be provided for by law …'.It is an open question whether the form of law required should be legislative in form, 109 rather than common law based as English courts have emphasised 110 had been accepted previously -at least by the ECtHR. 111e ECtHR has set down qualitative requirements in respect of any such law: accessible; sufficiently clear as to be circumstances under which interference may be justified; and consistent with the rule of law.Situations where the law is confused are problematic. 112It specified in Zakharov: The "quality of law" in this sense implies that the domestic law must not only be accessible and foreseeable in its application, it must also ensure that secret surveillance measures are applied only when "necessary in a democratic society", in particular by providing for adequate and effective safeguards and guarantees against abuse. 113 numerous surveillance cases, the ECtHR has focussed on this element, rather than considering of the measure, perhaps because of the sensitivity of the area. 114urther, as can be seen in the quotation from Zakharov, 115 there are links, perhaps overlap, between the requirement of lawfulness and 'necessary in a democratic society'. 116Somewhat unusually, the ECtHR has introduced substantive procedural elements into the test for foreseeability/accessibility.While some have criticised this approach for blurring the boundaries between Article 8 and the right to a remedy, 117 this remains a consistent part of the ECtHR's approach in this area.Such procedural elements constrain State action and also allow individuals to understand at a general level when they might bring themselves within the scope of such measures (and to act accordingly 118 ).
There must be clear, detailed rules specifying the conditions subject to which interferences are legitimate. 119The minimum safeguards as regards interception of phone calls 120 are: the nature of the offences which may give rise to the intrusion; a definition of the categories of people liable to be affected; a limit on the duration of telephone tapping; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which recordings may or must be erased or the tapes destroyed.While rules can be set down in secondary legislation and codes, 121 any such documents must be publicly available 122 and legally binding. 123In principle, the same points about lawfulness will arise in relation to the Charter.Here, however, while the Opinion of the Advocate General in Watson/Tele2 suggested that any such laws or codes must be binding on the relevant authorities, 124 the judgment did not pick up this issue.As noted 125 , however, the Charter must provide at least the protection of the ECHR, which supports the position of the Advocate General. 126is requirement of lawfulness gives rise to problems for the ANPR regime.The assertion in the Home Office Document that '[t]he DPA and RIPA provide the framework to support Article 8 ECHR' 127 is at best questionable.The DPA, as we have noted, safeguards how data is processed but does not provide a legal base; it does not authorise or require the acquisition of data through this type of activity.It does not fulfil all the functions the ECtHR has ascribed to 'law', specifically it gives no indication of when and to whom intrusive measures might apply.So while it might provide some safeguards against abuse, on its own it is not enough.A similar point could be made about PoFA.Further, there are no sanctions for non-compliance with the PoFA code.Any common law basis for police action is very broad and vague, probably beyond acceptable limits for allowing individuals to predict its application.
RIPA remains as a possible legal base but there are two difficulties with seeking to ground ANPR in it.The first is that ANPR does not fit clearly into the categories of surveillance 128 that are regulated by RIPA Part II.Part II covers covert surveillance -that is, surveillance carried out in a manner to ensure that persons who are subject to the surveillance are unaware that it is taking place. 129While some specific operations with ANPR cameras located in unmarked cars might satisfy this test, it is much less likely that static cameras do so.Even if the police are unwilling to publicise locations, the cameras are potentially visible to the road user, even ifas street furniturethey are part of the background and thus practically invisible.The PoFA Code describes ANPR, moreover, as overt surveillance.It has been questioned whether the definition of covert surveillance works in the context of mass surveillance, where individuals may be aware that the techniques existand so do not satisfy a strict view of RIPA but are unaware that the techniques are being used in their respective instances. 130In any event, to fall within RIPA, covert surveillance must be one of the following: directed surveillance; intrusive surveillance; or the use of CHIS, the last of which is clearly not relevant here.ANPR does not fit these categories.Directed surveillance is for the purposes of a specific investigation, rather than general monitoring; intrusive surveillance relates to activities taking place on residential premises 131 or in any private vehicle.It would be an expansive view of this latter element that might cover ANPR, especially as the use of trackers has been expressly excluded.The second aspect is that surveillance can be carried out even in the absence of authorization under Part II. 132The regime has been criticised in this regard, 133 being described as 'no more than a voluntary code'. 134This is a weakness indeed when we consider the requirement of lawfulness, especially as regards the binding nature of the law.As noted above, the IPA only partially covers use of ANPR data; it would not constitute relevant 'law' in this context.
It has been suggested 135 that the Criminal Procedures and Investigations Act 1996 (CPIA) justifies the retention of data.This argument is weak.The CPIA was introduced to allow the review of evidence after trial so as to avoid miscarriages of justice.It does not deal with creation, storage or access and cannot relate to individuals not of interest to the police.Furthermore, this obligation to retain evidence has not been found to be sufficient justification for retention of data in other contexts (communications data, biometric data) 136 and concerns have been expressed about using CPIA justifying keeping biometric data on a 'just in case basis'. 137The Anti-Social behaviour, Crime and Policing Act 2014 clarified that, once CPIA no longer applies, the sample must be destroyed, and it must not be used other than for the purposes of proceedings for the offence in connection with which it was taken. 138It therefore undermines the possibility of relying on CPIA as a general justification for retention of data.
There may also be problems about clarity of the regime.Insofar as it is possible to rely on the statutory framework, it consists of overlapping systems with different enforcement mechanisms.This is potentially confusing.In all, any framework is undermined by the lack of coherence of piecemeal legislative responses, arguably with different rationales. 139Further, the fact that there is no authorisation regime setting down conditions of access and use makes it difficult for individuals to foresee the applicability of the regime, even if the bulk collection of ANPR data is acceptable at a level of principle.There are insufficient specific safeguardsas suggested by Weber & Saravia and subsequent cases-to prevent arbitrary behaviour. 140The ANPR system would seem to fail on these rule-of-law criteria.

'legitimate aim'
This aspect raises few problems.The European courts seem unwilling to challenge States' claims, 141 sometimes inferring the legitimate purposes on behalf of governments. 142Here, the data is used for the fight against crime.The investigation of crime is a legitimate public interest in both EU 143 and ECHR systems, although the multiplicity of possible uses for the ANPR data may give rise to concerns about 'purpose creep', where data obtained for one purpose is used for another.The nature of the public interest is also a relevant factor for assessing proportionality, and the distinction between crime and serious crime may be significant in that context.Further, the scope of activities that could fall within the prohibited behaviour must be sufficiently clear to satisfy the foreseeability requirement. 144While the definition of offences is in principle a matter for States, it is also possible that the Court of Justice might start filling in the meaning of 'serious crime': a reference on the meaning of 'serious crime' has been made, albeit in a different context. 145ecessary in a democratic society' 'Necessary in a democratic society' for the ECtHR means that the interference meets a "pressing social need" but also that it is proportionate to the aim pursued.146 It is not found in the Charter or its jurisprudence.While not meaning 'indispensable', necessity expects more than 'useful', 'reasonable' or 'desirable'.147 Further, the reasons adduced to justify the measures must be 'relevant and sufficient.148 The level of review takes into account all the circumstances, and the intensity of review may vary.The ECtHR has been deferential to State concerns about national security, but measures such as powers of surveillance are more closely scrutinised.149 Given the importance of data protection for the effective exercise of privacy rights, the margin of appreciation is limited in this context too.150 Another aspect is whether the measure is appropriate for achieving the aim, a question which goes beyond just a logical connection.There must be some degree of success or effectiveness, 151 although it is debateable the extent to which any such effectiveness has been required to be clearly evidenced. 152A proportionality assessment may also return to some of the issues relevant for the lawfulness assessment.While some commentators have been critical of the ECtHR's approach, 153 especially its earlier jurisprudence, more recent case law in this area shows a greater willingness on the part of the ECtHR to engage with a proportionality assessment.154 The Court of Justice will consider whether the essence of the right has been destroyed and whether an instance of interference is proportionate.While the essence test may show another formal distinction between the tests applied by the two courts, 155 it is a high barrier to cross and the Court of Justice has not often found this test satisfied even in some cases involving mass surveillance.156 An infringement was found in Schrems, however, in relation to the content of communications.157 In terms of proportionality, there are similarities to the approach taken by the ECtHR.Any room for national discretion was in this context limited.In reaching this conclusion, the Court of Justice emphasised the importance of data protection to ensuring respect for private life, 158 impliedly reflecting early concerns about the power of the state being enhanced by databases. Sine Digital Rights Ireland, the Court of Justice has been willing to engage in extensive analysis of the proportionality of State measures in the context of national security and the fight against terrorism considering critically both the idea of 'necessity' and the level of safeguards provided by the system; the issue of appropriateness has received less attention.
In the context of ANPR, the case law of both European courts on mass surveillance 159 are relevant.ANPR collects and retains the data of all vehicles, which can be linked back to individuals, whether or not those vehicles are wanted in connection with a particular offence.The system is therefore indiscriminate, rather than suspicion-based.Such a system requires particularly strong justification (especially with the retention of data for increasingly long periods) given both European courts have been critical of systems of mass surveillance in the context of communications. 160As noted, it may be that GPS and passenger name records in relation to international flights are less intrusive than communications surveillance, but this does not mean that such intrusions have no weight 161 especially where a detailed individual picture may be generated. 162While data retention and data mining may be appropriate, perhaps identifying persons of interest hitherto unknown, problems arise when considering necessity/proportionality. Of particular concern is the fact that the data collected and retained is 'general and indiscriminate', so that in the view of the Court of Justice, even a relatively serious objective (the fight against serious crime and terrorism) could not be justified.While some note that it may be possible always to find some examples of cases that have needed retained data to solve them, 163 the Court of Justice has side-stepped this type of argument.In an indiscriminate system, there is no link between the data retention and the threat posed by a specific individual and, in its view, therefore goes beyond what is 'strictly necessary'. 164While bulk powers may be acceptable where they distinguish quite finely between categories of people (or perhaps activities), blanket bulk powers are not. 165Even where bulk powers might be acceptable, stringent safeguards to prevent abuse would be of central importance in determining whether such powers were proportionate.
The position appears less emphatic in the jurisprudence of the ECtHR.In the chamber decision in Szabó, 166 the ECtHR appeared to accept that mass acquisition of data may be necessary for the fight against terrorism, but on the facts in issue there were inadequate safeguards.A concurring opinion, however, expressed a strong view that the Grand Chamber in Zakharov imposed a requirement for a more specific level of suspicion even in the context of serious crime. 167Previous cases, for example S and Marper 168 , took a similarly strong line against blanket and indiscriminate State acts.If indiscriminate acquisition of data remains in principle possible, the safeguards are of central importance to proving that the resulting intrusion is necessary in a democratic society.
The general retention of ANPR data may be disproportionate in the light of both courts' jurisprudence.ANPR affects all road users in England indiscriminately.Further, the objectives for which ANPR data is used cover a wide range and, crucially, include low-level offences (e.g.untaxed or uninsured cars) suggesting that even if location data is less intrusive than communications data, the justification for intrusion is less strong.There is little evidence that the acquisition or retention of this data is 'strictly necessary', rather than 'useful', insofar as it is effective at all. 169There is no discrimination in the system between retention of data relating to those of interest to the police, nor of distinguishing between offences of different levels of seriousness.
It is open to question whether the decision to install ANPR cameras and the choice of location/intensity are activities requiring justification.Such choices are clearly caught in the context of locational privacy; less obviously so in relation to an analysis based on systemic storage of data.It may, however, be difficult or artificial to distinguish between acquisition/monitoring and storage where the acquisition method is the creation of a photographic record. 170Certainly, the PoFA Code suggests that any 'decision to use any surveillance camera technology must, therefore, be consistent with a legitimate aim and a pressing need' and designed to meet the stated purpose and deployed only for the necessary time; essentially a proportionality analysis. 171The phraseology -especially the word 'use'blurs the issue of acquisition and storage whilst making it clear that 'use' needs to be justified.While PoFA may suggest useful constraints on ANPR use, it cannot be seen as an adequate safeguard in human rights terms because it is not binding.Additionally, PoFA also does not directly consider location.The Information Commissioner's Code on CCTV, which is binding, suggests that data controllers consider whether the location for CCTV cameras is appropriate for purpose and does not intrude on private property.It does not directly address the locational privacy concerns arising from accumulation of data and an intensity of cameras.The Information Commission has taken action against the use of ANPR, notably against the Royston 'ring of steel'. 172While demonstrating that ex post enforcement mechanisms exist, 173 the Data Protection Act in terms of ex ante safeguards requires internal review only.The installation of ANPR cameras can in this context be contrasted with the collection of communications data.There, although the collection of data is potentially widespread, it must be triggered by a notice to the telecommunications operator.ANPR is distinctive in having no link to governmental or external oversight at this stage.It is questionable whether this is sufficient. 167Szabó n. 1, para 20 168 S and Marper, n. 80 169 Big Brother Watch noted that the levels of crime in Royston did not increase after the dismantling of the 'ring of steel', see https://www.bigbrotherwatch.org.uk/2014/08/loss-roystons-ring-steel-hasnt-caused-crimewave/,accessed 27 th February 2017 170 Laws in Wood, n. 51 171 PoFA Code, n. 8, para 2.4. 172See n. 97 173 The text of the notice, 24 th July 2013, no longer seems to be available.Press reports state that the ICO found the collection of the information to be unlawful, breaching principle 1 of the Data Protection Act, and excessive, breaching principle 3 The Tele2/Watson case considered the adequacy of safeguards around access to data and examination of the data.In this there are similarities with the ECtHR's approach.Indeed, that court recently noted "a certain level of consensus" about the level of safeguards, based on acceptance of data protection principles. 174Again objective criteria must be established which limit access, and following Tele2/Watson, access to a person's data should be granted 'only to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime'175 , with further access to people indirectly connected to such activities being allowed in exceptional circumstances (such as terrorist activities).
It is questionable whether the handling arrangements currently in place for access to and analysis of the ANPR data are adequate despite the data protection and PoFA codes.The Information Commissioner's code states that use of ANPR must be justified.Further, databases must be kept up-to-date and accurate (in particular to prevent mismatches).Data must be kept secure and retention periods must be the minimum necessary for the purpose for which the data was collected and immediately thereafter be deleted.These requirements provide some safeguards but, by comparison with the requirements from the surveillance jurisprudence, lack specificity and allow too much room for manoeuvre on the part of the processor.Moreover, retention periods determined by reference to a purpose are problematic in terms of bulk acquisition and retention of data.The access arrangements for communications data under the Data Retention and Investigatory Powers Act 2014 (DRIPA) were challenged in Tele2/Watson.The Court of Justice required independent supervision of access; indeed, it suggested that such independence would be found through prior authorisation by a judge or other independent body, where a request for access is made on the basis of a 'reasoned request'176 .Such independent supervision is a safeguard against fishing expeditions, in that such a system could ensure that there was some form of justification for investigating a particular car/owner prior to that investigation taking place.Note that Tele2/Watson concerns a system that requires signoff by a senior officer but involves the "Single Point of Contact", an officer separate from an active investigation, trained in surveillance and matters pertaining to human rights.The ANPR system has no equivalent level of protections, so is more vulnerable to challenge on this issue.
Finally, data must be deleted in a timely manner, in accordance with any internal rules or data handling codes.This seems not always to have been the case, at last as regards the Met.Case law makes clear that there are limits on how long any data can be retained.The nature of the offences sought to be prosecuted and the nature of the data affect the permissible retention period, as does the nature of the data held.Both the Data Retention Directivewhich permitted two years' retentionand DRIPA which specified one yearwere seen as problematic in terms of period of retention.The concern arises partly from the undifferentiated nature of the retention; it is one thing to retain data on suspicion or in relation to a prosecution, it is another thing entirely in relation to a person of no interest to the police.This is the trap into which ANPR falls.Even if a two year period in relation to terrorism or other serious offences is acceptable, which is dubious in the light of recent case law, the not very serious nature of some of the offences for which ANPR is used may weigh against such long retention.An extension would make any justification still harder; indeed the ICO has raised this point, questioning whether the operational case for such an extension has convincingly been made.177

Conclusion
This paper has argued that the ANPR system constitutes an intrusion into the private lives of road users based on both the ECHR and EU Charter.By contrast, English case law has not consistently recognised the concerns around privacy in a public space.ANPR has not been considered directly.Data retention triggers the application of the right to private life whether seen in Charter or Convention terms and must therefore be justified in accordance with the ECHR and the Charter.Beyond this is the question of locational privacy, the importance of which has not yet been directly addressed by any of the courts.It has been argued that if we look to the concerns that the courts have highlighted, then locational privacy should be protected.Even focussing just on systemic retention of ANPR data, the system needs to be justified.Here the ANPR regime runs into multiple problems: the inadequate basis in law; the bulk nature of the data retained; the lack of safeguards against abuse; and the disproportionate extent of the retention period.In short, the regime is fundamentally defective.It would seem far better to set up a legislative regime, with appropriate safeguards and oversight mechanism, rather than to allow the current system to continuethough bulk acquisition of ANPR data may remain problematic in the light of jurisprudence on blanket data gathering.Not only is the current position undesirable from the perspective of the road-user but the police use of ANPR data is exposed to legal challenge with potentially far-reaching consequences.Given that it is not just ANPR which may give rise to these issues, a broader review should be undertaken.All police surveillance in public space should be consideredsuch as that relating to the use of drones and BWVto produce a coherent and appropriately calibrated system rather than one which is once again reactive, piecemeal and possibly still incomplete.
monitoring103  -because of this particular pervasive and on-going characteristic -itself engages Article 8 ECHR and Article 7 of the Charter.
Police and Secretary of State IPT/03/32/H, para 42; C.f. Tugendhat J. in AJK v Commr of Police of the Metropolis [2013] 1 WLR 2734 . 16C Walker Terrorism and the Law (Oxford: OUP, 2011), para 2.70. 17See Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Ors [2016] UKIPTrib 15_110_CH.Bulk personal datasets are among the provisions being challenged by Liberty in a judicial review action launched 28 February 2017. 18O'Floinn and Omerod suggest that the common law could be used in respect of police activity which does not clearly fit into the existing statutory framework in the context of social media surveillance: 'Social Networking Sites, RIPA and Criminal Investigations' (2011) 10 Crim LR 766, p. 775.
Shedding Light on the Nature of Heat: Defining Privacy in the Wake of R v. Tessling (2005) 23 CR (6 th ) 229, p.234-5 made this point in the Canadian context 102 Von Hannover n. 62; The English courts have also recognised the impact of ongoing surveillance, admittedly obiter and not in this context: Bernstein v. Skyways [1978] 1 QB 479; contrast a one -off instance where the photography by the police and its context was clear: Catt n. 82, para 34 but note comments of Lord Collins of Mapesbury as to the potentially chilling effect of such police behaviour, para 97.