The Court said that the policy contained "deficiencies" that provided the police with a disproportionate right to retain photographs of previous suspects that were either never charged or had been acquitted of any offence for too long, and in particular in the case of children.

The Court said that the retention of individuals' photographs on police databases engages individuals' privacy rights and that in the case of two former suspects the retention of their photos had not been justified under the existing police policy. However, the Court said that The Met should be given time to revise their policy and re-assess whether the retention of the two individuals' photographs is justified under the new terms.

"I am not satisfied that the existing policy strikes a fair balance between the competing public and private interests and meets the requirements of proportionality," Lord Justice Richards, ruling on the case with Mr Justice Parker, said. "In my judgment, therefore, the retention of [RMC's and FJ's] photographs in application of the existing policy amounts to an unjustified interference with their right to respect for their private life and is in breach of [their privacy rights under the Human Rights Act]."

RMC and FJ are a middle-aged woman and 15 year old boy respectively who have had their identities protected by a court order. RMC had her photo taken at a police station after she was arrested on suspicion of "occasioning actual bodily harm" on a police community support worker. FJ had his photo taken at a police station after being arrested on suspicion of raping his second cousin when he was 12. In both cases though, no charges were pursued.

Both RMC and FJ challenged the right of the police to retain their photographs on their database. They argued that the retention of the information infringed on their privacy rights.

Under the Human Rights Act "everyone has the right to respect for his private and family life, his home and his correspondence."

However, the right to privacy is a qualified one as "a public authority" can legitimately interfere with it "in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

The Met had argued that RMC and FJ's privacy rights were not engaged by retaining their photographs on file and that even if they were such retention was justified.

Under the Police and Criminal Evidence Act (PACE) the police can legitimately take the photograph of individuals detained at a police station "with the appropriate consent; or if the appropriate consent is withheld or it is not practicable to obtain it, without it."

Under PACE the photograph "may be used by, or disclosed to, any person for any purpose related to the prevention or detection of crime, the investigation of an offence or the conduct of a prosecution or to the enforcement of a sentence; and after being so used or disclosed, may be retained but may not be used or disclosed except for a purpose so related."

Under The Met's code of practice on the management of police information and related guidelines, information collected as part of police investigations can be held for as long as is necessary and proportionate to the purpose for which it is retained for the force to retain it. Providing it is "necessary, adequate and up-to-date" personal records are stored for at least six years.

The guidance provides "presumption in favour of retention" of individuals' records as long as the retention of the data is not "excessive" and it is "necessary for a policing purpose, is adequate for that purpose and is up to date". An assessment must also be made about the risk of harm that individuals pose when determining whether it is legitimate for personal records to be retained, whilst the storage must also comply with the principles of the Data Protection Act (DPA). Those principles require, amongst other things, that personal data processed is not kept for longer than is necessary for the purpose for which it was first obtained.

The Met challenged whether the retention of individuals' photographs on their police database actively engaged those individuals' privacy rights. The High Court said that it did. The Court said that rulings on data retention by the European Court of Human Rights (ECHR) provided legal precedent on the issue. It rejected claims that there was an overriding "domestic" case that would have required an assessment to be made of whether the individuals had a "reasonable expectation of privacy" that photographs taken by the police would not be retained.

The Court said that such an assessment "is not the only or determinative factor" in reviewing whether privacy rights are engaged, but that even if that test had been applied the privacy rights of RMC and "especially" FJ, as a minor, would be said to have been engaged.

The judges then determined that the engaged privacy rights had been unjustifiably interfered with as a result of The Met retaining the information under an "unlawful" data retention policy.

"[Under The Met's code and guidance] no adequate distinction is drawn between the convicted and those who are either not charged (the position of [RMC and FJ]) or are charged but acquitted," Lord Justice Richards said. "There is nothing to meet the concern expressed by the [ECHR] about the risk of stigmatisation of those entitled to the presumption of innocence, or the perception that they are not being treated as innocent."

"The reasons given by Commander Gibson [of The Met in a witness statement] in support of the individual decisions to continue retention of [RMC and FJ's] photographs underline that concern: notwithstanding that no charges were brought (let alone proved) against either [of them], the reasons rely [on the face of it] on the fact that the allegation against each [of RMC and FJ] remains recorded as a substantive crime and [RMC and FJ] was in each case the only suspect," the judge added.

Further reasons why The Met's code and guidance are unlawful include that the "retention of the photographs is on any view for a long period (a minimum of 6 years), is likely in practice to be much longer (given that a scheduled review is due only after 10 years in RMC's case, and there is provision for retention until the age of 100 in FJ's case), and is potentially indefinite," Lord Justice Richards said.

"The particular concern of the Strasbourg court that retention of unconvicted persons' data may be especially harmful in the case of minors applies here too, given FJ's age at the time of arrest," he added.

However, the High Court judges said that The Met should not be ordered to delete RMC and FJ's photographs from their files until the organisation has had a chance to draw up a new data retention policy on photographs and re-assess the justification for storing them under the new terms.

"I am inclined ... to allow [The Met] a reasonable further period within which to revise the existing policy, rather than to grant relief that might have the effect of requiring the immediate destruction of [RMC and FJ's] photographs without the possibility of re-assessment under a revised policy," Lord Justice Richards said. "In my view, the just and appropriate order is to declare that [the Met's] existing policy concerning the retention of custody photographs (namely, to apply the MoPI Code of Practice and the MoPI guidance) is unlawful."

"It should be clear in the circumstances that a 'reasonable further period' for revising the policy is to be measured in months, not years," the judge added.

In his witness statement to the Court Met Commander Allan Gibson had said that The Met already plans to "promulgate further policy" on data retention following the enactment of the Protection of Freedoms Act earlier this year.