03/09/2025
From Essex Police
Thank you for your letter dated 13 August 2025.
I acknowledge your request for an update from Essex Police regarding the ICO’s findings in relation to your original complaint, submitted as a representative of [loss adjuster]. I have submitted an appeal to the ICO requesting a review of their decision. In my professional capacity as the Force Data Protection Officer, I believe the original request did not constitute a valid third-party Subject Access Request (SAR), and that several key factors raised in our initial submission were not fully considered. Accordingly, I have escalated the matter with the ICO.
To assist you, I would like to clearly reiterate Essex Police’s position on why we are refusing to process the SAR submitted by [loss adjuster]. Our key points are as follows:
- [loss adjuster’s] Role as Third-Party Requestor:
[loss adjuster]cannot act independently on behalf of the data subject while simultaneously representing or functioning as an insurer. Their primary objective is to validate a financial claim, which compromises their impartiality. - Validity of Consent:
Under Article 4 of the UK-GDPR, consent must be freely given, specific, and informed. In this case:
• The data subject is unaware of the specific data held by Essex Police that would be disclosed directly to [loss adjuster].
• Consent is a prerequisite for claim settlement, not a voluntary action.
• The SAR was initiated by {loss adjuster], not the data subject, solely to facilitate an insurance claim, not so the data subject could understand what data Essex Police held.
• The data subject signed a form indicating the data would be used in connection with the claim, not for personal access.
• The scope of data requested is excessive and would be denied under civil disclosure without a court order. - Right of Access Limitations:
The Right of Access entitles data subjects access to their personal data unless restricted under the Data Protection Act 2018, Part 3, Chapter 3, Section 45(4)(a)-(e). Investigation reports often contain sensitive category and criminal offence data. Disclosure to the data subject is appropriate as it is their personal data and no restriction would apply; disclosure to a private company for claim settlement is not appropriate and may be unlawful. - Redaction Misinterpretation:
The ICO suggested redacting non-requested data before sending reports to [loss adjuster]. This contradicts the essence of a Right of Access request, which mandates full disclosure to the data subject unless restricted under Section 45. - Section 184 Implications:
Allowing [loss adjuster] access to law enforcement data processed under Part 3 of the Act may violate Section 184. Investigation Reports may contain ‘relevant records’ such as criminal offence or health data that should not be disclosed via SAR to a third party. - Non-Personal Data Requests:
[loss adjuster] requested data such as VRM and ANPR records that do not constitute personal data. Their request also included timeframes beyond the vehicle’s possession by the data subject, such data would not be considered personal data.
We await the outcome of the ICO’s review. While this is ongoing, Essex Police will not process the SAR submitted by [loss adjuster]. As has been the case throughout this process, [loss adjuster] retains the option to pursue disclosure through the civil disclosure route. Please note that we will not comment further on the SAR or related matters until the ICO’s decision is known.
I would like to reassure you that, in my role as the Force Data Protection Officer, it is my legal duty to uphold the data protection and privacy rights of data subjects. I appreciate your patience while I seek guidance from the appropriate regulator to ensure these rights are upheld.