22/07/2026 from Essex police to the ICO
Data Protection Officer
Essex Police Headquarters
PO Box 2
Springfield, Chelmsford,
Essex, CM2 6DA
Email: dpo@essex.police.uk
22nd July 2026
ICO Reference: IC-356699-WOG6
Thank you for your letter of 8th July 2026.
Having carefully reviewed your response, Essex Police remains concerned that the central issue raised throughout our submissions has not been addressed.
The ICO’s letter focuses largely on whether Essex Police could refuse the request on the basis that it constituted an enforced subject access request under section 184 Data Protection Act 2018. Whilst section 184 formed part of Essex Police’s rationale, it was never the sole nor primary issue. The substantive issue raised repeatedly within our reports was whether Essex Police could properly be satisfied that the request submitted by Claims Management and Adjusting Ltd (CMA) represented a valid exercise of the data subject’s statutory right of access. Our concern has never been that CMA lacks a signed authority document. Our concern is whether such authority is capable of constituting valid authority in circumstances where:
- CMA is appointed, instructed and remunerated by an insurer;
- CMA’s professional obligations are owed to the insurer rather than the insured;
- CMA’s role includes investigating and potentially challenging the legitimacy of the insured’s claim;
- the information sought consists of sensitive law-enforcement personal data; and
- the practical beneficiary of the request is the insurer rather than the data subject.
The ICO’s letter appears to proceed on the assumption that the production of authority is sufficient. Essex Police respectfully disagrees. A controller must be satisfied that a third party is genuinely acting on behalf of the data subject before disclosing personal data to that third party. The question placed before the ICO was whether, in these circumstances, a loss adjustor acting for an insurer can properly be regarded as representing the interests of the data subject when those interests may be directly adverse. The ICO’s response does not appear to engage with that question.
Similarly, Essex Police’s submissions raised extensive concerns regarding whether the purported consent relied upon by CMA could properly be regarded as informed, freely given and valid in circumstances where:
- the claimant does not understand the nature and extent of police information held;
- disclosure may adversely affect the claimant’s financial position;
- refusal may reasonably be perceived as jeopardising or delaying an insurance claim; and
- the request is initiated, managed and pursued entirely by the insurer’s representative.
Again, the ICO’s response does not appear to address those concerns.
The ICO concludes that Essex Police should reconsider the request and states that it does not intend to pursue the matter further. Essex Police is not persuaded that it should reconsider its position on the basis of the reasoning provided to date.
The Chief Constable remains accountable for any disclosure of sensitive law-enforcement personal data. In the absence of being satisfied that CMA possesses valid authority to exercise the right of access on behalf of the data subject, Essex Police does not consider that disclosure to CMA would be lawful.
Accordingly, based on the reasoning provided to date, Essex Police remains of the view that its current position is consistent with its obligations under Part 3 of the Data Protection Act 2018 and therefore intends to maintain its existing decision.
However, we remain open to reconsidering that position should the ICO identify a specific legal basis, statutory provision or regulatory interpretation which demonstrates that our understanding of those obligations is incorrect.
If the ICO considers that Essex Police’s approach is not compliant with Part 3 of the Data Protection Act 2018, we would be grateful if the Commissioner could set out in further detail the specific statutory obligations which are considered not to have been met, together with the legal basis upon which that conclusion has been reached. Should the Commissioner ultimately conclude that Essex Police is acting in breach of its obligations under Part 3 of the Data Protection Act 2018, we would respectfully suggest that the matter may be more appropriately progressed through
the Commissioner’s formal regulatory powers, thereby enabling the legal issues raised to be considered and determined through the statutory framework available to both parties.
This issue raises significant questions regarding third-party authority, informed consent and the use of subject access rights by commercial organisations seeking access to law-enforcement information. In Essex Police’s view these questions remain unresolved and have yet to be substantively addressed in the ICO’s correspondence to date.
Yours sincerely,
Force Data Protection Officer
Essex Police
23/07/2026 – the response to the above, submitted to the ICO, can be read here.