Judgment Approved by the court for handing down. R (Bridges) -v- CC South Wales & ors that the use of AFR Locate on 21 December 2017 (Queen Street) and 27 March 2018 (Motorpoint Arena) struck a fair balance and was not disproportionate. The Divisional Court further said (at 108]), regarding any future use of AFR Locate, that, on the evidence before them as to the manner in which AFR Locate was currently deployed by SWP, they were satisfied that there is no systemic “proportionality deficit” such that it can be said that future use of AFR Locate by SWP would be inevitably disproportionate. Data Protection claims 45. The Divisional Court recorded (at [109]) that, although none of the deployments by SWP of AFR in issue in the proceedings took place after the commencement of the DPA 2018 (25 May 2018), all parties had requested that the legality of the deployments of AFR Locate be considered as if they had taken place after 25 May 2018 and the Divisional Court were content to do so. The Divisional Court addressed the data protection claims under three headings: (1) the claim under the DPA 1998, (2) the claim under section 35 of the DPA 2018, and (3) the claim under section 64 of the DPA 2018. 46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate entails processing personal data, SWP contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name. Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others. 47. The Divisional Court rejected, however, the Appellant’s case that SWP acted unlawfully under section 4(4) of the DPA 1998 by failing to comply with the first data protection principle, in particular that personal data must be processed lawfully and fairly. Given their conclusion on the Appellant’s Article 8 claim, the Divisional Court were satisfied that the use of AFR Locate in December 2017 and March 2018 satisfied that condition of lawfulness and fairness. 48. Turning to the requirement in section 34 of the DPA 2018 that SWP, as a “competent authority”, had to be able to demonstrate compliance with the provisions of Chapter 2 of Part 3 of the DPA 2018 concerning law enforcement processing, the Divisional Court identified the issues in dispute as being: (1) whether (as the Appellant contended but SWP contested) the processing of the biometric data of members of the public whose faces are captured by the CCTV cameras entails “sensitive processing” as described in section 35(8) of the DPA 2018, and (2) whether (as the Appellant contended but SWP contested) AFR Locate failed to meet the requirements of section 35(5). Those requirements are that: (a) the processing is strictly necessary for a law enforcement purpose; (b) the processing meets at least one of the conditions in Schedule 8; and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place. The Appellant contended that none of those requirements was satisfied.