Data Protection - Good Practice
Note issued by the Information Commissioner
(Law Society Edit -- In most cases, information held by solicitors will be covered by the obligation of client confidentiality but the Note may be of interest to solicitors who are asked to provide information not covered by that obligation.)
Releasing information to prevent or detect crime
This good practice note explains what you need to consider when you are asked to release personal information because it is needed to prevent or detect a crime, or catch and prosecute a suspect. It is intended as a guide for organisations that do not normally receive requests of this kind.
Does the Data Protection Act 1998 stop me from releasing this personal information?
No. There is an exemption in the Data Protection Act 1998 (the Act) that allows you to give out personal information for these purposes (Section 29 –
Crime and Taxation), but there are limits on what you can release.
Who might ask me to release personal information under this exemption?
The police are most likely to ask you to release personal information under this exemption. However, you may get requests from other organisations that can rely upon this exemption because they have a crime prevention or law enforcement function, for example, the Department for Work and Pensions –
Benefit Fraud Section. For the sake of clarity, in this note we will continue to refer to releasing information to the police.
What personal information can I release under this exemption?
The exemption does not cover the disclosure of all personal information, in all circumstances. It only allows you to release personal information for the stated purposes and only if not releasing it would be likely to prejudice (that is, significantly harm) any attempt by police to prevent crime or catch a suspect.
What questions do I need to ask?
For every request for personal information you receive (and about each separate individual), you need to ask yourself the following questions:
· Am I sure the person is who they say they are? (For this reason particular care should be taken if the request is made over the telephone.)
· Is the person asking for this information doing so to prevent or detect a crime or catch or prosecute an offender?
· If I do not release the personal information, will this significantly harm any attempt by the police to prevent crime or catch a suspect? (The risk must be that the investigation may very well be impeded.)
· If I do decide to release personal information to the police, what is the minimum I should release for them to be able to do their job? v1.0
08.08.06
· What else (if anything) do I need to know to be sure that the exemption applies?
There are times when you may release personal information relating to more than one person who the police do not name, but who fit a particular description.
For example: the police may not have the name of the particular suspect, but they believe he is an employee of your organisation and have a particular description (for example, white male, between 20 and 30 years old with brown hair). In this situation, you may release the personal information of all the employees who match that particular description.
However, you would need to be satisfied that the police have narrowed the description of the suspect as much as they reasonably can.
Do I have to release the personal information requested?
We understand that most people will want to help the police to prevent crime or catch a suspect, but it is up to you to decide to release personal information under this exemption. Even if you decide that the exemption applies, you still do not have to release the personal information. If you have genuine concerns about releasing the personal information (for example, because you think you have other legal obligations such as the information being confidential), then you can ask the police to come back with a court order requiring the release of the personal information. If the court decides you should release the information, you will not break the Act by obeying the order.
For example: Why is it necessary for us to provide this personal information (can you not get this personal information from another source)?
Or
How will this personal information assist your attempts
to prevent crime or catch a suspect?
Recommended good practice
· Select a person or group of people within your organisation to make the decision whether or not to release personal information under the exemption.
· Ask for the request to be made in writing and signed by someone of sufficient authority.
· Make a record of each decision you make and the reasons why you came to that particular decision.
More information
If you need any more information about this or any other aspect of data protection, please contact us.
Phone: 01625 545745
E-mail: please use the online enquiry form on our website
Website: www.ico.gov.uk
