The system of CRB checks (established under Part V of the Police Act 1997) is currently under review: for the review’s terms of reference, see here. At present, where an enhanced CRB check is carried out it is for the police to decide whether there is any non-conviction information that ought to be included in the enhanced CRB certificate: for instance, information about acquittals, or about allegations that have never been tested at a criminal trial. The legal principles governing this exercise – in particular, the relevance of Article 8 of the Convention – were extensively discussed by the Supreme Court in R (L) v Commissioner of Police of the Metropolis  UKSC 3.
The recent decision of the Court of Appeal in Desmond v Chief Constable of Nottinghamshire Police  EWCA Civ 3 raises a different issue: for the purposes of the law of negligence, do the police owe a duty of care to the individual who is the subject of the certificate? The Court of Appeal holds that they do not.
In Desmond, the claimant’s case (put very shortly) was that adverse information about him had been included in an enhanced CRB check; that the information disclosed was misleading; and that the decision to disclose could not be justified on the basis of the material available to the police, and had been reached without making proper enquiries. He brought a claim against the relevant Chief Constable, alleging (inter alia) breach of Article 8, breach of the Data Protection Act 1998, and negligence.
The claim in negligence was struck out, but this decision was partly reversed on appeal by Wyn Williams J, whose judgment is at  EWHC 2362 (QB). On further appeal, the Court of Appeal restored the original decision to strike out the negligence claim in full. There was no proper basis for concluding that the chief officer was to be taken to have assumed responsibility to Mr. Desmond; the structure and purpose of the relevant legislation strongly suggested that there should be no duty of care; there was no case which persuaded the Court of Appeal, by analogy, that a duty of care should be imposed; and the existence of various other remedies that Mr. Desmond could pursue also supported the conclusion that no duty of care was owed.
The Court of Appeal also states that Article 8 of the Convention is likely to be applicable in every case where non-conviction information is disclosed as part of an enhanced CRB certificate, and that a breach of Article 8 would give rise to a potential damages claim under section 8 of the Human Rights Act 1998: see paragraph 9 of the judgment. It appears from the Court of Appeal’s judgment that Mr. Desmond’s Article 8 claim still continues, as does his claim under the Data Protection Act 1998.