When should we share information with the police and other statutory bodies?
The police or other law enforcement agencies may occasionally ask your organisation for access to personal information. However, whether or not you should provide this information depends on a number of factors. Charlotte Lewendon, information management, governance and risk manager at the Guinness Partnership, explains why.
The Data Protection Act 1998 (DPA) allows for personal information to be disclosed to a third party for several reasons, such as:
- if the third party is attempting to prevent or detect crime
- if an offender is due to be apprehended or prosecuted
- if the third party is due to assess or collect any tax or duty, or is investigating any imposition of a similar nature
Personal information can be disclosed without breaching the Act where:
- the data in question is only released for a specified purpose
- divulging the information is for any of the crime and taxation purposes (listed above)
- applying those requirements in relation to the disclosure would be “likely to prejudice” the criminal investigation
The Act does not give a definition of “likely to prejudice”. However, for these exemptions to apply there would have to be a substantial chance (rather than a mere risk) that not complying with the request would noticeably damage one or more of the crime and taxation purposes.
Example: The police ask a housing association for the home address of one of its employees, as they wish to find them urgently in connection with a criminal investigation. The employee is absent from work at the time. The association had collected the employee’s personal data for its HR purposes, and disclosing it for another purpose would ordinarily breach the Data Protection Act. However, not providing the requested information in this case would be likely to prejudice the criminal investigation. The association may therefore disclose the employee’s home address without breaching the Act.
This exemption does not make it essential that the association discloses the requested information to the police or to other law enforcement agencies, but it can do so without breaching the DPA. The association can still decline to provide the information should it wish to do so and can advise the person requesting the information to obtain a court order.
Any request for information should be made in writing – verbal requests should not be considered. Requests from the police will use a standard form or a consent to disclose form, which will always be signed by an inspector. Other bodies that do not have a standard form need to make any request in writing, clearly explaining why they require the information.
Find out how we can help you
- Discover more about keeping your data safe
- Training: Data protection in practice (29 July, CIH Scotland office)
- Training: Data protection in practice (3 November, Glasgow)
- Event: How safe is your data? (10 September 2015, CIH London office)
- Event: How safe is your data? (30 September, Manchester)