Police forces may be forced to destroy images they hold of innocent people after the high court ruled that the Metropolitan police breached the human rights of a woman and boy they arrested, by keeping their custody pictures after deciding to take no action against them.

Campaigners welcomed the landmark verdict that the force's policy – based on a Home Office code of practice and guidance from the Association of Chief Police Officers (Acpo) – was unlawful, adding that it was vital that police used their powers proportionately and fairly.

Unless the policy is revised within months, or there is a successful appeal, police are very likely to have to destroy "photographs of anyone who is innocent of any crime", said the Equality and Human Rights Commission (EHRC), which had intervened in the case.

The ruling was won by two people, referred to as RMC and FJ, who must not be identified for legal reasons. RMC is a 60-year-old woman from Chelsea, west London, who was arrested five years ago on suspicion of causing actual bodily harm to a community support officer who had stopped her riding a bicycle on a footpath. She had DNA samples, fingerprints and photographs taken of her, but after the Crown Prosecution Service decided not to charge her the Met refused to destroy her records.

FJ, from Peckham, south London, was 12 when he was arrested three years ago on suspicion of raping his second cousin. No charges were brought after a third party witness did not confirm an offence had taken place. The Met again refused to destroy DNA, fingerprints or photographs and retained a record of his arrest and other information on the police national computer (PNC).

In a written judgment, Lord Justice Richards said the challenge was another in a line of cases dealing with the retention of data by the police "after a person has been arrested on suspicion of an offence but has subsequently not been proceeded against, or has been charged and acquitted".

The courts had already ruled indefinite retention of fingerprints and DNA was an unjustified interference with the right to respect for private life under the human rights convention, so claims for a judicial review of these issues in the cases of RMC and FJ had been refused. This left open the question with regard to photographs of arrested people in the same category.

The home secretary issued a code of practice on management of police information in July 2005. Guidance on how this should be applied to custody photographs was produced by the National Policing Improvement Agency on behalf of Acpo. The Acpo guidance came into effect in 2006, with a second edition in 2010.

Richards warned "that a 'reasonable further period' for revising the policy [on photographs] is to be measured in months, not years".

The judge rejected the Met's argument that keeping photographs was necessary for preventing crime and disorder. He said the "just and appropriate order" was to declare the Met's existing policy, based on the code and guidance, unlawful.

However, he said the police were justified in keeping information about FJ on the police national computer: "It seems to me that a PNC record that did not include the basic history of FJ's involvement with the police would be an incomplete and potentially misleading record. Moreover, if a similar allegation were made against FJ in future, it would be profoundly unsatisfactory if it fell to be considered without knowledge of the earlier allegation and the arrest and investigation to which it gave rise."

Richards said the Met commissioner, Bernard Hogan-Howe, had indicated he did not intend to seek permission to appeal, but that the home secretary, Theresa May, wished to consider her position on the ruling, which has nationwide implications. The court gave her two weeks to make any appeal application.

John Wadham, general counsel at the EHRC, said: "Without the protection of our human right to a private life, the police would be able to hold on to your DNA, fingerprints and photographs even if you had done nothing wrong. There is no good reason why the police should hold on to information about people who have not committed any crime.

"However, we recognise the importance of retaining the identification of people who have been charged with, or convicted of, offences. But it is essential that the police use these powers appropriately, proportionately and fairly."

James Welch, legal director for Liberty, said: "Until now the police have felt entitled to keep hold of photographs of those arrested but never convicted of any offence for far too long. The court has rightly recognised the implications for people's privacy and insisted that this disproportionate policy be tightened."

A Home Office spokesman said: "We are urgently examining the implications of the ruling and its potential impact on police operations. This will guide what further action may be appropriate."

It is difficult to know how many photographs of people would be held unlawfully under the judgment. In 2008-9 nearly 1.5 million people entered police custody in England, Wales and Northern Ireland but this does not establish how many of those had been charged and convicted before or how many were charged and convicted after arrest during the year.