To ICO Casework
Subject Response_CIM.011.22_ICO_Case reference: IC-108170-P1J8
Display Name DC Fl response (4 attach)
Date Received 22/07/2022 07:21
Dear David
Please find attached response in relation to your points below. I have embedded the 3 .PDF in the Word document, however in case they don’t open for you — I have also attached them as separate documents. For reference, these contain personal information relating to the data subject and other involved parties in the offence. I look forward to hearing from you should you have any further questions. Many thanks
Information Governance Supervisor
inforrnation.governance@sussex.police.uk
Sussex Police Headquarters, Church Lane, Lewes, East Sussex, 8N7 2DZ www.sussex.police.uk
Attachment 1
Collision Process Unit
Operations Command Partnerships Sussex Police
Shoreham Police Station
Ham Road Shoreham-by-Sea
BN43 6DB
General Enquiries: collisions.unitsussex.pnn.police.uk 01273 404150 Mon-Fri 10am-12pm
Date: 15 April 2021
Collision Ref:
Dear
I am writing to update you regarding the incident on at
following our initial contact
We have now completed our investigation and after careful consideration of the facts it has been decided that Sussex Police will be taking no further action. The reason for this decision is: We have now confirmed both parties involved in this incident.
We have been provided with no independent witness details to the incident therefore we have insufficient evidence to pursue the matter.
Should further evidence come to light, we reserve the right to reconsider the position.
If you or your insurers wish to pursue a civil claim, extracts from the police file can be made available to you or your representative upon payment of a mandatory fee. Any application for such information should be made to the Collision Process Unit at Shoreham Police Station, quoting the reference shown above.
Details of the driver of vehicle registration number are as follows:
Name:
Address:
- The information in this document is for the exclusive use of the applicant.
- This information must only be used for the purposes for which it has been obtained.
3_ Be aware that any improper disclosure, copying, distribution or use of the contents of this information is prohibited and criminal proceedings may follow_
2
Should you recall any new information that may assist us, please do not hesitate to contact us by e-mail at collisions.unitsussex.pnn.police.uk , by letter, or telephone using the contact details above.
For further information regarding collision data please visit \Arvm.sussexsaferroads.gov.uk.
Yours sincerely
Attachment 2
CIM.011.22 ICO Case reference: IC-108170-P1J8
I have liaised with the Collisions Team (CT) to provide a full chronology of the incident to outline the processing under Part 2 and Part 3 of the Data Protection Act, for reference:
• Veh 1: Vehicle belonging tct
• Veh 2: Vehicle belonging to
Summary of Contact and Processing:
- Veh 2 reported a damage only incident at a police station Front Office as the other driver failed to stop. Veh 2 gave the VRM belonging to Veh 1.
- CT performed a DVLA check to identify Registered Owner (RO) for Veh 1.
- This identified that was the RO (not necessarily the driver at the time).
- To determine the driver for a police investigation, a T51 (S172 notice request) was sent to the keeper of Veh 1 . This is a lawful document to request the details of the actual driver at the time of the incident. A copy of the returned letter can be seen below:
- The returned T51 confirmed that was the driver at the time of the incident.
- The incident was assessed to determine whether it met the threshold for criminal prosecution. On review it was determined that No Further Action (NFA) would be taken by the Police. However, there could be a need for civil proceedings.
- Both parties were sent S170 letters, stating that this incident would be NFA and included the names and addresses of the other driver to allow civil / insurance proceedings for damages.
- If had not fled the scene of this accident, this would mirror the details exchanged for insurance purposes,
whether police attended the scene or not. - A copy of the S170 letters can be seen below:
v.]
PDF .PDF
10.The address details provided to Veh 2 were provided by and not taken from Police systems. The details in
the above letters were sent to the drivers of the vehicles for the sole purpose facilitating civil claims. The Section 172 letters state that the information is being shared to assist with a civil claim, the exact text is below:
If you or your insurers wish to pursue a civil claim, extracts from the police file can be made available to you or your representative upon payment of a mandatory fee. Any application for such information should be made to the Collision Process Unit at Shoreham Police Station, quoting the reference shown above. Details of the driver of vehicle registration number are as follows:
This process is necessary and proportionate as the investigation needs to determine the actual driver and not just the RO. For example, the involved vehicle could be a hire car and to allow any claims for damage, the aggrieved party would need to know who was actually driving the vehicle.
As an addition to ensure the protection of data subjects involved, the CT carry out risk assessments based on the nature of the incident. On this occasion, it was considered low risk as it was described
There was no verbal exchange or violence at the incident, therefore the details were shared as above.
Lawful Processing Of Data:
Point 4: Law Enforcement Processing
To determine the named driver it is essential to contact the RO using the details from the DVLA. This information is processed as necessary for the performance of a task carried out for that purpose by a competent authority. This being investigation and potential prosecution of a criminal offence of failing to provide drivers details under Section 170 of the Road Traffic Act 1988.
DVLA data only provides the name of the RO, therefore the outlined S172 process is necessary, relevant and proportionate to determine the driver at the time of the incident. Only the minimum data necessary is processed to determine this.
Point 11: Law Enforcement Processing (not Article 6 UK GDPR)
Following a further review of the CT process, we believe this falls under law enforcement processing.
In this instance, the details of the person driving the vehicle were provided by the data subject, (obtained on
the S172 form under Section C). This information was then further processed to the driver of the second vehicle for the purpose of investigation and potential prosecution (albeit through civil insurance and financial prosecution) related to a criminal offence.
Previous responses to the ICO stated that police processed details under Public Task, under the UK GDPR. As
stated this has now been reviewed and confirmed that sharing address with the victim of Veh 2 was an
extension of the law enforcement processing and is therefore compatible with the purpose under which it was originally obtained. failed to stop at the scene and exchange details, whilst there was no further action taken by the police, there is still a requirement for insurance companies to carry out a full assessment to prosecute the offending driver through civil prosecution.
This is a necessary and proportionate process to ensure enforcement of S170 of the Road Traffic Act, if driver details were not shared with the involved parties then insurance companies would not be able to represent their customers and seek the necessary compensation for damages. Once again, had stopped at the scene of the incident, he would have been required to share these with the other driver for this purpose.
ICO Queries:
Please explain how your disclosure of personal data satisfied:
• whether the new purpose is compatible with the purpose for which the personal data was collected,
• whether any disclosure, or re-use, of personal data for non-law enforcement purposes is authorised by law.
The Data Protection Act Section states that personal data must not be processed in a manner that is incompatible with the purpose for which it was collected. Furthermore, personal data collected for any of the law enforcement purposes may not be processed for a different purpose unless the processing is authorised by law.
The information requested from related to who was driving the vehicle at the time of the incident. The purpose
of processing was necessary and consistent throughout all steps outlined in this response, this being the requirement of a driver to stop and give details at the scene of an accident (Road Traffic Act, S170). This includes the investigation of criminal offences by both the Police and the intended re-purposing for insurance claims.
The Road Traffic Act 1988 (section 170) places a duty on a driver to stop, report accident and give information or documents. As did not stop and, as required to do so by any person having reasonable grounds, give their name and address and VRM, was likely to be found guilty of an offence.
Although the matter was N FA by the police, there is still a requirement for investigation from the insurance company of Veh 2. Therefore, the Police shared only the relevant, necessary and proportionate details for this purpose, this being the name, address and VRM of the other driver involved in the incident. Other means, such as insurers contacting the DVLA directly, would only identify the RO whereas the policing investigation identified the driver at the time of the incident (which greatly impacts on what damage drivers are insured for).
Please explain how you reached the decision that the disclosure of personal data was ‘proportionate’. As
part of your response, please ensure that you explain how you have balanced:
• the benefits disclosing the data, against the impact of the proposed disclosure on the rights of the drivers whose data was shared.
The initial processing of this data (to identify the driver at the time of the incident) was essential to allow a police investigation. The further processing (sharing with named drivers) was also required to allow civil proceedings for the alleged damage to the vehicles. The Police considered the processing to be necessary, relevant and proportionate in both challenges from the ICO, had stopped at the scene of the incident, he would have been required to share these with the other driver for this purpose.
Having reviewed the process with the CT, I am satisfied that this is a proportionate process which provides only the minimum necessary data for a victim of a RTC to make a claim through their insurer. Therefore I am satisfied that this is a targeted and proportionate process that is compatible with the reasons why the data was initially, obtained.
Whilst sympathetic to that followed, consideration of Article 8 of their Human Rights were
considered and a necessary risk review was carried out.
Attachment 3
Collision Process Unit
Operations Command Partnerships Sussex Police
Shoreham Police Station
Ham Road Shoreham-by-Sea
BN43 6DB
General Enquiries: collisions.unitsussex.pnn.police.uk 01273 404150 Mon-Fri 10am-12pm
Date: 15 April 2021
Collision Ref:
Dear
I am writing to update you regarding the incident on at
following our initial contact
We have now completed our investigation and after careful consideration of the facts it has been decided that Sussex Police will be taking no further action. The reason for this decision is: We have now confirmed both parties involved in this incident.
We have been provided with no independent witness details to the incident therefore we have insufficient evidence to pursue the matter..
Should further evidence come to light, we reserve the right to reconsider the position.
If you or your insurers wish to pursue a civil claim, extracts from the police file can be made available to you or your representative upon payment of a mandatory fee. Any application for such information should be made to the Collision Process Unit at Shoreham Police Station, quoting the reference shown above.
Details of the driver of vehicle registration number are as follows:
Name:
Address:
- The information in this document is for the exclusive use of the applicant.
- This information must only be used for the purposes for which it has been obtained.
3_ Be aware that any improper disclosure, copying, distribution or use of the contents of this information is prohibited and criminal proceedings may follow_
Should you recall any new information that may assist us, please do not hesitate to contact us by e-mail at collisions.unitsussex.pnn.police.uk , by letter, or telephone using the contact details above.
For further information regarding collision data please visit \Arvm.sussexsaferroads.gov.uk.
Attachment 4
OFFICIAL SENSITIVE PLEASE RETURN FORM TO:• Collision Process Unit
Sussex Police
Shoreham Police Station
Ham Road Shoreham-by-Sea
BNL13 6DB
General Enquiries: collisions.unit
Date: 19 March 2021
Collision Rcr: –
NOTICE OF INTENDED PROSECUTION
In accordance with Section 1 of the Road Traffic Offenders Act 1988, I hereby give you notice that consideration is being given to taking proceedings against the driver for the alleged offence of Careless or Inconsiderate Driving. At [redacted] at, [redacted] Motor vehicle was involved in a road traffic accident whereby it is alleged damaged caused to another vehicle. The driver did not stop and details were not exchanged in accordance with Section 170 of the Road Traffic Act.
If you have received this notice on behalf of a limited company, this form is for the attention of the Company Secretary. For companies who do not have a Company Secretary this form is for the attention of any other responsible person.
Request for information as to the driver
On behalf of the Chief Constable of Sussex Police under Section 172 of the Road Traffic Act 1988 you are required to supply any information requested below within 28 days of the date of this notice,
WARNING: DO NOT IGNORE THIS NOTICE
FAILING TO PROVIDE THE NECESSARY INFORMATION WILL RENDER YOU LIABLE TO PROSECUTION. SUPPLYING FALSE INFORMATION IS A FAR MORE SERIOUS OFFENCE AND WILL BE PROSECUTED IN EVERY CASE
lf you are the keeper of the above vehicle at the time of the alleged offence, you are required to provide the full name and address of the driver at the time of the alleged offence,
OR
If you are not the keeper of the vehicle at the time of the alleged offence, you are required to give any information in your power which may lead to the driver’s identification.
The form MUST BE COMPLETED AND SIGNED BY THE ADDRESSEE or in the case of a company. by the person completing this form in which case you must state your position in the company.
IF YOU 1NERE THE DRIVER at the time of the alleged offence you are required to complete section A in all cases. If your details are not correct then fill in section C as well.
IF YOU WERE NOT THE DRIVER at the time of the alleged offence you are required to tick the appropriate boxes in sections A & B and supply, at section C, the name and address of the driver of the vehicle.
If you are unable to identify the driver, use a separate piece of paper to explain why and ensure this is returned with the Section 172 form.
Yours sincerely,
Case Direction Manager, Operations Command Partnership
On behalf of the Chief Constable of Sussex Police