As DPOs, we come across a lot of interesting situations. In this blog, we’re looking at providing information to the police.
We understand that having the police either give you a call or arrive in person may be a daunting experience. The immediate reaction of most people is just to give them what they want as it must be important if the police are asking for it.
In reality, if the police request information about a particular person, they must provide you with a standard form requesting to have the data and the reasons for the request.
If the request falls into one of the three categories below, then disclose the minimum information needed to help the police.
You must always document what you have done by recording the information disclosed, to whom, when, made on what basis and whether the data subject was informed or not.
DISCLOSE IF THE REQUEST IS ONE OF THE FOLLOWING:
1. Emergency Request?
Confirm this is an emergency request, i.e. if the information is not provided immediately it would place one or more individuals at significant risk of harm. Just because an officer is physically present does not mean it is an emergency.
2. Statutory Requirement?
Is the police officer seeking information that you are obliged to provide by law? E.g. details that might help identify someone involved in a road traffic accident or terrorism. If a statutory duty to provide information is claimed, then seek details from the police officer and record the relevant statute along with details of the information you have provided.
3. Does the public interest warrant disclosure?
Will the information help the police with a serious crime such as murder, terrorism, safeguarding children or adults at risk of abuse or neglect, rape, kidnapping, gun or knife injuries, significant public health risks, significant risk to one or more individuals?
If the request is not one of the above, then you must decide whether or not to release the information to the police, although it’s likely that you should release the information, unless you have a really good reason not to.
FOR ALL CASES, THE POLICE MUST FILL OUT A FORM CALLED A “Schedule 2 Part 1 Para. 2 Data Protection Act 2018 Exemption” (old s.29 DPA 1998 exemption)
Note that a Schedule 2 exemption does not provide a statutory requirement to disclose information, nor do permissive legislation such as the Police and Criminal Evidence Act 1984 or the Crime and Disorder Act 1988. Confirm that the officer asking for the information is doing so to prevent or detect a crime or prosecute an offender.
If a Schedule 2 exemption is claimed, get this in writing, signed by a senior officer, and ensure there are:
- A clear indication that the police are confident that they are working within the framework
of the DPA and will satisfy all relevant DPA requirements
- Clarification on whether informing the individual about the disclosure would prejudice the investigation
- A clear description of the specific information that is requested
If in doubt about any of the above, give us a call and we will be able to help you through the process and ensure that you are doing the right thing, both by the police and your data subject.