or click here to request site subscription to search and view all judgments
Although now 3 years in operation, the GDPR remains as much a mystery to many as it did when it was first introduced. Data protection has become particularly topical in the criminal law sphere as challenges to the manner in which the Gardaí obtain and record data, such as that in the Dwyer case, rumble through the Supreme Court and the European Courts, in the hope of some clarity. One particularly interesting aspect which does not seem to have been explored in any great depth yet is the interaction between the data protection, Garda “PULSE” records and the National Archives Act.
What is PULSE?
Anyone working in criminal law will be familiar with the Garda “PULSE” system. The PULSE system – being the ‘Police Using Leading Systems Effectively’ system – is an electronic database on which information in relation to investigations, interactions with the public, complaints, and other data is recorded and stored. Data which is contained on PULSE is for the most part inputted by individual Gardaí carrying out their duties. For this reason, PULSE has a reputation for inaccuracy and in some cases inquiries have been established to assess the veracity of records entered into the system. (See Garda Pulse records were 'altered' says whistleblower, and Garda did not record 18% of reported crimes on Pulse).
Challenges to information contained on PULSE
In the 2016 case of M.M. -v- Commissioner of An Garda Siochana  IEHC 254, the Plaintiff sought to have a record on the PULSE system which made reference to her children removed. The factual background to the case involved a former priest, Mr Z, against whom complaints of child sexual abuse had been made by two children, Ms A and Ms B, which were alleged to have occurred when Mr Z was a priest in their parish. The children chose not to proceed with the complaints and ultimately prosecution was not pursued by the DPP, however, Mr Z had subsequently married and had two children with Ms MM. Arising out of a child protection policy in place at the time, a referral was made to the HSE in relation to Mr Z. Insofar as the PULSE record was concerned, it contained the following information in relation to the children of Ms MM “[Mr Z] has two children under the age of 18 years and may be child protection issues”. Ms MM sought to have this data erased from PULSE; her request was refused and she sought to judicially review this refusal.
Garda approach to PULSE data
Within the judgment, Mr Justice White quotes in full the letter received by Ms MM in which her application for erasure of the information was refused. From both this letter and the judgment more generally, the following matters emerge:
- It is the policy of an Garda Síochána not to delete information contained on the PULSE system
- The practice of the Gardaí is to “update” rather than erase data where inaccuracies arise
- The PULSE system seeks to maintain an accurate “history of events”
- The Gardaí referred to the PULSE data as a “historical record”
Ultimately, the Court performed a balancing exercise and refused the relief sought, however, the case does raise questions as to the legal status of PULSE and the policies in place in An Garda Síochána insofar as these records are concerned.
Obligations under the National Archives Act
One issue which was pleaded but not explored in any great depth is the interplay between PULSE records and the National Archives Act. The National Archives Act 1986 and the National Archives Regulations 1988 regulate the manner in which specified state bodies, including An Garda Síochána (as per the schedule to the 1986 Act), manage, retain and erase certain data. The breath of information covered by the Act is detailed in section 2(2) and includes books, maps, plans, drawings, papers, files, photographs, films, microfilms and other micrographic records, sound recordings, pictorial records, magnetic tapes, magnetic discs, optical or video discs, other machine-readable records, other documentary or processed material made or received, and held in the course of its business, by a Department of State. This definition would seem to include PULSE records.
Bodies subject to the 1986 Act are not permitted to dispose of departmental records – including written and electronic records - without the permission of the Director of the National Archives. Records can also be kept indefinitely where permissible by the Act. The 1988 regulations allow bodies to establish internal policies for the maintenance, retention and erasure of data in accordance with the Act.
Obligations under the Data Protection Act
The MM case preceded the introduction of the GDPR and so the relevant provisions of the GDPR and the Data Protection Act 2018 (“DPA”) were obviously not considered. A number of sections of the DPA are relevant to the retention of records on the PULSE system. First, section 71(1) of the DPA requires Gardaí to “ensure that data processed … is kept accurate, and, where necessary, up to date, and that every reasonable step is taken to ensure that inaccurate data, having regard to the purpose for which it is processed, is erased or rectified without delay”. Inaccurate is defined in section 92(17) of the DPA as being “incorrect or misleading as to any matter of fact, or if it is incomplete in a material manner”. Articles 16 and 17 of the GDPR contain similar provisions and give a data subject the right to have inaccurate personal data rectified or erased – though these articles seem to have little applicability in the criminal law context where the Law Enforcement Directive applies.
However, it would seem that the DPA does not alter the position with regard to the obligations under the National Archives Act. Article 89 of the GDPR allows for the processing of personal data for ‘archiving purposes in the public interest’ and the DPA itself allows for the processing of data for law enforcement purposes. Data can be collected by the Gardaí (or any other relevant body) where it is necessary for the performance of a statutory function. In the case of PULSE records, data is required for the investigation and prosecution of offences.
The status of PULSE and personal data
It seems that PULSE records can either be classed as a historical record, in which case they are covered by the National Archives Act, or as information relevant to law enforcement matters, in which case the DPA applies. It seems that both Acts apply though some clarity in relation to the legal status of PULSE would be helpful. Were the records on PULSE trusted to be an accurate account of events, as intended, their retention would probably be relatively uncontroversial. Issues do arise, however, where such a large volume of complaints and questions as to accuracy have been raised. In circumstances where the data on PULSE has frequently been found to be incorrect, can PULSE records really be categorised as a historic account? Is the policy of the Gardaí to potentially amend but never erase data one which is legally sound? And what impact, if any, does the DPA have on the system as a whole?