ICO Case Reference Number IC-356699-W0G6
16/07/2025 from the ICO:
I am writing further to my previous email of 10 June 2025 with regard to the data protection complaint you have raised with the Information Commissioner’s Office (ICO) about Essex Police and how it has handled an information rights request that Claims Management & Adjusting Limited (CMA) has made on behalf of [the data subject].
As you are aware, I have written to this organisation in relation to the concerns you have expressed, and I can confirm that I have since received its reply.
The organisation’s response
Essex Police maintains that the consideration of Section 184 of the Data Protection Act 2018 formed only part of the rationale for why CMA’s right of access request of 10 October 2024 was refused.
It states that the scope of the consent form completed by [the data subject] that was included with the request was subtly different to the scope of the data actually requested, and further asserts that [the data subject] could not have freely given consent to a third party to make such a request due to his lack of a full understanding of the level of data held by the police.
Furthermore, the organisation argues that CMA cannot act on behalf of the data subject in any event. Any data that would be disclosed in response would be used to investigate and settle the insurance claim, with no indication that [the data subject] himself would ever have sight of it. There is an established process for insurance providers to apply for police forces for information – the A98b form.
Finally, it makes the point that information relating to the VRM will not necessarily constitute [the data subject’s] personal data. While he may be the owner or register keeper of the stolen vehicle, this does not mean any mention of the VRM in the police report will relate to him directly.
Our view
I have considered the information available to me in relation to this complaint and I am of the view that Essex Police has not complied with its obligations under data protection law in this instance.
This is because I am not satisfied that CMA’s right of access request of 10 October 2024 was an “enforced SAR” for the purposes of Section 184 of the Data Protection Act 2018. The reason for this is that the scope of this request specifically excludes “relevant records.”
Consequently, it is the ICO’s view that there is now further action required.
Action required
To clarify, this is not to say that the ICO would require Essex Police to release all of the information that CMA has asked for as I would be minded to agree that it is unlikely that much of what has been requested would constitute [the data subject’s] personal data.
Instead, the ICO has written to Essex Police again to inform it of the assessment made for this complaint. We have required it to review its handling of this right of access request, and provide CMA with a comprehensive disclosure of any personal data to which it would be entitled. I am not necessarily sure I agree that the consent form provided by [the data subject] does not match the scope of what was asked for. However, if Essex Police does have concerns about its content, it should revert to CMA to ask for whatever it would need in order to proceed.
We keep a record of all the complaints raised with us about the way organisations process personal information. The information we gather from complaints may form the basis for action in the future where appropriate.
Please be advised that individuals have the right to take their own action on any data protection matters through the courts regardless of any decisions that the ICO may make. This is not a process with which we are able to assist, and we would strongly recommend that they seek independent legal advice if this is something they would like to pursue.
Feedback about our service
Thank you once again for bringing this matter to our attention. Should you wish to discuss this case any further, or require any clarification, please do not hesitate to contact me. Additionally, if you are dissatisfied with the service you have received, or would like to provide us with feedback of any kind, please let me know.
To correspond with me via email, you can forward any messages to our icocasework@ico.org.uk email address, making sure to include the above case reference in the subject line.
Yours sincerely,
Lead Case Officer
Information Commissioner’s Office
Ignorance of the law, ignorantia juris non excusat, is not excuse.