From: icocasework icocasework@ico.org.uk
Sent: 04 December 2025 16:21
To: P Swift pswift@cmaclaims.co.uk
Subject: ICO Case Reference: IC-356699-W0G6
4 December 2025
Case Reference: IC-356699-W0G6
Dear Philip Swift
I am writing in relation to your data protection complaint, on behalf of Joshua Ratford, about the handling of a subject access request by Essex Police.
As you are aware, Essex Police has raised concerns about the outcome of this complaint. We have treated this as a request for us to review the matter under our case review and service complaints policy.
We have considered your data protection complaint about Essex Police, and they are unhappy with the advice we have provided and the outcome of the case.
As a result, the issues raised by this complaint have been considered at a more senior level within the ICO. The points raised by Essex Police have been considered and the relevant information we hold about this case has been fully reviewed. As a result of this, it is our view that the outcome of this complaint should be reversed.
We agree that, as a party acting for an insurer, CMA is not the appropriate party to make a subject access request to Essex Police. Subject access is a powerful right that allows people to find out what information an organisation holds on them. It is not designed to support a process for handling insurance claims and it is not appropriate in situations where the third party’s interests are not aligned with those of the individual.
It is our view that there is another, more appropriate, route for CMA to access the information it requires and this will provide it with access to only the information the insurer needs to process the claim. Using this route ensures that CMA only receives information that it is lawful and appropriate for Essex Police to disclose.
In making a subject access request, CMA is requesting information which, while disclosable to the data subject, may not be appropriate to disclose to CMA. This could include criminal records or medical information which would not be appropriate to share with a third party. It would not necessarily be a reasonable expectation for the data subject that this type of information might be disclosed when agreeing to CMA making the request to Essex Police. As a result, it may lead to compliance issues and has the potential to lead to a data breach.
It is also noted that some of the information requested cannot be considered to be personal data and would not be provided in response to a subject access request. However, it may be required by CMA for the purposes of the insurance claim and would be disclosable under the appropriate route.
In light of the above, it is our view that, in acting for the insurance company, CMA is not an appropriate third party to make a subject access request. Any consent provided to them to do so cannot be considered to be freely given where the individual is told that this is required in order for the claim to be processed or the individual feels obliged to agree to the request for the claim to be resolved.
We are satisfied that a request such as this should not be handled as a subject access request. Requests of this nature should be handled using the appropriate route for insurers to obtain this information.
As a result, it is our view that Essex Police has complied with its data protection obligations in this case.
In view of this, we do not intend to take any further action in this matter. We have fully reviewed the information held in relation to this case and we are satisfied that there are no outstanding data protection issues for us to pursue with Essex Police at this time.
It may be helpful to explain that under data protection legislation (Section 165 of the Data Protection Act 2018) our obligation is to investigate a complaint about the handling of personal data to the extent that we feel is appropriate. This means that the ICO has discretion as to how to consider the complaints brought to us.
A decision as to whether an organisation has contravened the GDPR/DPA18 is only a view or an opinion rather than a final, legal determination. If you disagree with our view and want a more final decision then you have the right to take your case to court. Please be advised that this is not a process with which the Information Commissioner’s Office is able to assist and we recommend that you seek independent legal advice if you wish to pursue this course of action.
Yours sincerely,
Reviewing Officer
Information Commissioner’s Office
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF