220708 ICO to Sussex Police

08/07/2022

From ICO Casework
Subject ICO Case reference: IC-108170-P1J8
Display Name To DC – Fl needed (4)
Date Received 08/07/2022 14:21

Dear

I am writing to you further to our previous correspondence about the complaint raised with the ICO about the disclosure of personal data. Some further information is needed from Sussex Police at this stage.

I note from your email dated 3 March 2022 the following:

Personal data was originally processed under the GDPR as processed by the DVLA. This was then further processed by the police for a law enforcement purpose. The initial processing by the DVLA would be Public Task as there is a requirement to process this data within their official functions. Due to the lawful requirement to make the disclosure under the Road Traffic Act, the information was further processed as it was compatible and necessary for the performance of a task carried out for that purpose by a competent authority.

I understand the above to mean that Sussex Police initially processed personal data under Part
3 DPA, for law enforcement purposes. You then further processed it under Part 2 DPA (General Purposes) in order to disclose it to the parties to the alleged RTA, in order to facilitate a civil claim.

Re-use of personal data

DPA Section 36(1) states that the second data protection principle is that personal data must not be processed in a manner that is incompatible with the purpose for which it was collected.

DPA Section 36(4) states that personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

Therefore, as a competent authority under Part 3, Sussex Police must determine:

1) whether the new purpose is compatible with the purpose for which the personal data was collected, and,
2) whether any disclosure, or re use, of personal data for non law enforcement purposes is authorised by law.

Please explain how your disclosure of Mr [redacted] personal data satisfied requirements 1) & 2) above.

There is guidance on the re-use of data by competent authorities for non-law enforcement purposes on our website here.

Proportionality

We have previously established that you disclosed Mr [redacted] personal data to the other party to the
alleged RTA using ‘Public Task’ as your lawful basis (see email 29 March 2022).

In order to rely on the ‘Public Task’ the disclosure/processing must be necessary – that is to say the processing must be a targeted and proportionate way of achieving the purpose. It must also be fair and lawful as a justified interference with the Article 8 ECHR rights of individuals.

Please explain how you reached the decision that the disclosure of [redacted] personal data was ‘proportionate’. As part of your response, please ensure that you explain how you have balanced:
(i) the benefits disclosing the data, against
(ii) the impact of the proposed disclosure on the rights of the drivers whose data was shared.

I would be grateful if you would provide this information no later than 14 days from the date of this email. Please feel free to contact me if necessary.

Yours sincerely,

David Hunt
Case Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF T. 0330 414 6822 F. 01625 524510 ico.org.uk

22/07/2022 from Sussex Police to the ICO

To ICO Casework
Subject Response_CIM.011.22_ICO_Case reference: IC-108170-P1J8
.
Dear David

Please find attached response in relation to your points below. I have embedded the 3 .PDF in the Word document, however in case they don’t open for you — I have also attached them as separate documents. For reference, these contain personal information relating to the data subject and other involved parties in the offence. I look forward to hearing from you should you have any further questions.

Many thanks
Information Governance Supervisor
information.governance@sussex.police.uk
Sussex Police Headquarters, Church Lane, Lewes, East Sussex, 8N7 2DZ www.sussex.police.uk

21/04/2021 letter (this appears to be the original letter to the aggrieved providing details of the data subject who subsequently complained about the disclosure)

Collision Process Unit
Operations Command Partnerships Sussex Police
Shoreham Police Station
Ham Road Shoreham-by-Sea
BN43 6DB
General Enquiries: collisions.unitsussex.pnn.police.uk 01273 404150 Mon-Fri 10am-12pm
Date: 15 April 2021

I am writing to update you regarding the incident on [redacted] at [redacted] following our initial contact

We have now completed our investigation and after careful consideration of the facts it has been decided that Sussex Police will be taking no further action. The reason for this decision is: We have now confirmed both parties involved in this incident.

We have been provided with no independent witness details to the incident therefore we have insufficient evidence to pursue the matter.

Should further evidence come to light, we reserve the right to reconsider the position.

If you or your insurers wish to pursue a civil claim, extracts from the police file can be made available to you or your representative upon payment of a mandatory fee. Any application for such information should be made to the Collision Process Unit at Shoreham Police Station, quoting the reference shown above.

Details of the driver of vehicle registration number are as follows:

Name: [redacted]
Address: [redacted]

Should you recall any new information that may assist us, please do not hesitate to contact us by e-mail at collisions.unitsussex.pnn.police.uk , by letter, or telephone using the contact details above.

For further information regarding collision data please visit sussexsaferroads.gov.uk.

Yours sincerely
Case Direction Manager, Operations Command Partnership

Sussex Review of the Disclosure

CIM.011.22 ICO Case reference: IC-108170-P1J8

I have liaised with the Collisions Team (CT) to provide a full chronology of the incident to outline the processing under Part 2 and Part 3 of the Data Protection Act, for reference:

• Veh 1: Vehicle belonging to [redacted]
• Veh 2: Vehicle belonging to [redacted]

Summary of Contact and Processing:

Veh 2 reported a damage only incident at a police station Front Office as the other driver failed to stop. Veh 2 gave the VRM belonging to Veh 1.
CT performed a DVLA check to identify Registered Owner (RO) for Veh 1.
This identified that was the RO (not necessarily the driver at the time).
To determine the driver for a police investigation, a T51 (S172 notice request) was sent to the keeper of Veh 1 . This is a lawful document to request the details of the actual driver at the time of the incident. A copy of the returned letter can be seen below:
The returned T51 confirmed that was the driver at the time of the incident.
The incident was assessed to determine whether it met the threshold for criminal prosecution. On review it was determined that No Further Action (NFA) would be taken by the Police. However, there could be a need for civil proceedings.
Both parties were sent S170 letters, stating that this incident would be NFA and included the names and addresses of the other driver to allow civil / insurance proceedings for damages.
If had not fled the scene of this accident, this would mirror the details exchanged for insurance purposes,
whether police attended the scene or not.
A copy of the S170 letters can be seen below
The address details provided to Veh 2 were provided by [redcated] and not taken from Police systems. The details in the above letters were sent to the drivers of the vehicles for the sole purpose facilitating civil claims. The Section 172 letters state that the information is being shared to assist with a civil claim, the exact text is below:

As an addition to ensure the protection of data subjects involved, the CT carry out risk assessments based on the nature of the incident. On this occasion, it was considered low risk as it was described. There was no verbal exchange or violence at the incident, therefore the details were shared as above.

Lawful Processing Of Data:

Point 4: Law Enforcement Processing

To determine the named driver it is essential to contact the RO using the details from the DVLA. This information is processed as necessary for the performance of a task carried out for that purpose by a competent authority. This being investigation and potential prosecution of a criminal offence of failing to provide drivers details under Section 170 of the Road Traffic Act 1988.

DVLA data only provides the name of the RO, therefore the outlined S172 process is necessary, relevant and proportionate to determine the driver at the time of the incident. Only the minimum data necessary is processed to determine this.

Point 11: Law Enforcement Processing (not Article 6 UK GDPR)

Following a further review of the CT process, we believe this falls under law enforcement processing.

In this instance, the details of the person driving the vehicle were provided by the data subject, [redacted] (obtained on the S172 form under Section C). This information was then further processed to the driver of the second vehicle for the purpose of investigation and potential prosecution (albeit through civil insurance and financial prosecution) related to a criminal offence.

Previous responses to the ICO stated that police processed [redacted] details under Public Task, under the UK GDPR. As stated this has now been reviewed and confirmed that sharing [redacted] address with the victim of Veh 2 was an extension of the law enforcement processing and is therefore compatible with the purpose under which it was originally obtained. failed to stop at the scene and exchange details, whilst there was no further action taken by the police, there is still a requirement for insurance companies to carry out a full assessment to prosecute the offending driver through civil prosecution.

This is a necessary and proportionate process to ensure enforcement of S170 of the Road Traffic Act, if driver details were not shared with the involved parties then insurance companies would not be able to represent their customers and seek the necessary compensation for damages. Once again, had stopped at the scene of the incident, he would have been required to share these with the other driver for this purpose.

ICO Queries:

Please explain how your disclosure of personal data satisfied:

• whether the new purpose is compatible with the purpose for which the personal data was collected,
• whether any disclosure, or re-use, of personal data for non-law enforcement purposes is authorised by law.

The Data Protection Act Section states that personal data must not be processed in a manner that is incompatible with the purpose for which it was collected. Furthermore, personal data collected for any of the law enforcement purposes may not be processed for a different purpose unless the processing is authorised by law.

The information requested from related to who was driving the vehicle at the time of the incident. The purpose
of processing was necessary and consistent throughout all steps outlined in this response, this being the requirement of a driver to stop and give details at the scene of an accident (Road Traffic Act, S170). This includes the investigation of criminal offences by both the Police and the intended re-purposing for insurance claims.
The Road Traffic Act 1988 (section 170) places a duty on a driver to stop, report accident and give information or documents. As did not stop and, as required to do so by any person having reasonable grounds, give their name and address and VRM, was likely to be found guilty of an offence.

Although the matter was NFA by the police, there is still a requirement for investigation from the insurance company of Veh 2. Therefore, the Police shared only the relevant, necessary and proportionate details for this purpose, this being the name, address and VRM of the other driver involved in the incident. Other means, such as insurers contacting the DVLA directly, would only identify the RO whereas the policing investigation identified the driver at the time of the incident (which greatly impacts on what damage drivers are insured for).

Please explain how you reached the decision that the disclosure of [redacted] personal data was ‘proportionate’. As part of your response, please ensure that you explain how you have balanced:

the benefits disclosing the data, against the impact of the proposed disclosure on the rights of the drivers whose data was shared.

The initial processing of this data (to identify the driver at the time of the incident) was essential to allow a police investigation. The further processing (sharing with named drivers) was also required to allow civil proceedings for the alleged damage to the vehicles. The Police considered the processing to be necessary, relevant and proportionate in both challenges from the ICO, had stopped at the scene of the incident, he would have been required to share these with the other driver for this purpose.

Having reviewed the process with the CT, I am satisfied that this is a proportionate process which provides only the minimum necessary data for a victim of a RTC to make a claim through their insurer. Therefore I am satisfied that this is a targeted and proportionate process that is compatible with the reasons why the data was initially, obtained.

Whilst sympathetic to [redacted] that followed, consideration of Article 8 of their Human Rights were
considered and a necessary risk review was carried out.

What appears to be the associated NIP (Notice of Intended Prosecution):

OFFICIAL SENSITIVE
PLEASE RETURN FORM TO
Collision Process Unit
Sussex Police
Shoreham Police Station
Ham Road Shoreham-by-Sea
BNL13 6DB

General Enquiries: collisions.unita.sussex.;Nin.police,uk
01273 404150 Mon-Fri 10an-i-12prn
Date: 19 March 2021

NOTICE OF INTENDED PROSECUTION

In accordance with Section 1 of the Road Traffic Offenders Act 1988, I hereby give you notice that consideration is being given to taking proceedings against the driver for the alleged offence of Careless or Inconsiderate Driving. At
at, Motor vehicle as involved in a road traffic accident whereby it is alleged damaged caused to another vehicle. The driver did not stop and details were not exchanged in accordance with Section 170 of the Road Traffic Act.
If you have received this notice on behalf of a limited company, this form is for the attention of the Company Secretary. For companies who do not have a Company Secretary this form is for the attention of any other responsible person.

Request for information as to the driver

On behalf of the Chief Constable of Sussex Police under Section 172 of the Road Traffic Act 1988 you are required to supply any information requested below within 28 days of the date of this notice,

WARNING: DO NOT IGNORE THIS NOTICE
FAILING TO PROVIDE THE NECESSARY INFORMATION WILL RENDER YOU LIABLE TO PROSECUTION. SUPPLYING
FALSE INFORMATION Is A FAR MORE SERIOUS OFFENCE AND WILL BE PROSECUTED IN EVERY CASE

lf you are the keeper of the above vehicle at the time of the alleged offence, you are required to provide the full name and address of the driver at the time of the alleged offence,
OR
If you are not the keeper of the vehicle at the time of the alleged offence, you are required to give any information in your power which may lead to the driver’s identification

The form MUST BE COMPLETED AND SIGNED BY THE ADDRESSEE or in the case of a company. by the person completing this form in which case you must state your position in the company.

IF YOU WERE THE DRIVER at the time of the alleged offence you are required to complete section A in all cases. If your details are not correct then fill in section C as well.
IF YOU WERE NOT THE DRIVER at the time of the alleged offence you are required to tick the appropriate boxes in sections A & B and supply, at section C, the name and address of the driver of the vehicle.

If you are unable to identify the driver, use a separate piece of paper to explain why and ensure this is returned with the Section 172 form.

Yours sincerely
Case Direction Manager, Operations Command Partnership
On behalf of the Chief Constable of Sussex Police

The ICO’s response of 07/11/2022 can be read here.