23/07/2026 – to the ICO in response to the Essex police submission.
Submission covering email
Please find attached my further observations [below] regarding Essex Police’s letter of 22 July 2026.
Having reviewed Essex Police’s latest submission, I considered it may assist the ICO’s deliberations to draw attention to my response of 3 September 2025, to which I have never received a substantive reply. Many of the issues now relied upon by Essex Police were addressed within that response but remain unanswered.
My observations are intended to assist the ICO by identifying the principal issues which, in my respectful submission, remain unresolved.
For completeness I have copied Essex Police into this correspondence.
I should be grateful if you would confirm receipt and, when convenient, advise whether you are able to indicate an anticipated timescale for concluding your review.
c.c. Essex police
Further observations following Essex Police’s submission of 22 July 2026
I am grateful for the opportunity to provide the following observations regarding Essex Police’s submission dated 22 July 2026.
These comments are intended to assist the Commissioner’s consideration of the issues now raised.
Having reviewed Essex Police’s latest submission, it appears that their position has evolved since the original refusal.
Whilst the original refusal relied in part upon section 184 of the Data Protection Act 2018, Essex Police now state that section 184 “formed part of Essex Police’s rationale, it was never the sole nor primary issue.”
I make the following observations.
1. Section 184 remains an unresolved issue
Although Essex Police now describe section 184 as a secondary issue, it nevertheless formed part of the refusal and resulted in my conduct being associated with a potential criminal offence.
Such an allegation is a significant stance to adopt.
The Commissioner has already concluded that my request was not an enforced subject access request because the request specifically excluded “relevant records”.
Despite this, I remain without:
- any explanation as to why section 184 was raised in circumstances where criminal conviction and health records were expressly excluded from the request;
- any acknowledgement that the constituent elements of a section 184 offence could not arise on the facts presented; or
- confirmation that any internal records associating me with a potential section 184 offence have been corrected.
- An apology
I respectfully suggest this remains an important matter.
It is not simply a question of legal interpretation but one of professional conduct. Alleging conduct capable of amounting to a criminal offence is a serious matter and should be supported by an identifiable legal basis.
2. Essex Police did not test the proposition they now rely upon
Essex Police now submit that their principal concern was whether CMA genuinely represented the interests of the data subject.
I do not disagree that a controller must satisfy itself that a third party has appropriate authority.
Indeed, the ICO’s decision explains precisely that. However, it also explains the means by which such concerns should be addressed.
The Commissioner concluded that if Essex Police had genuine concerns regarding CMA’s authority, they could have:
- raised those concerns with CMA; or
- contacted the data subject directly.
If the data subject confirmed that they wished CMA to receive the information, the guidance makes clear that the controller should provide the information to the authorised representative.
Essex Police did neither.
They therefore did not test the very proposition they now say lay at the heart of their refusal.
3. An established alternative demonstrates these concerns can readily be addressed
For a number of years CMA has utilised an equivalent third-party consent process with another police constabulary.
That process involves:
- submission of the signed authority;
- proof of identity;
- proof of address;
- comparison with the crime report;
- direct telephone confirmation with the data subject;
- supervisory consideration where appropriate;
- appropriate redaction before disclosure.
The resulting crime reports contain annotations confirming those verification steps have been undertaken.
Should it assist the Commissioner, I remain willing to provide an unredacted example in confidence.
This demonstrates that the concerns now raised by Essex Police are capable of being addressed through proportionate verification rather than outright refusal.
4. Concerns regarding informed consent
Essex Police suggest:
- the claimant does not understand the nature of police information held;
- disclosure may adversely affect the claimant’s financial position;
- refusal may be perceived as delaying settlement; and
- the request is managed by the insurer’s representative.
In my respectful submission, these propositions remain largely speculative.
The request is carefully confined to the crime report relating to the reported incident.
If Essex Police’s concern is that the report may contain information inconsistent with that provided to insurers, then any consequence arises from the factual content of the report rather than from disclosure itself.
Conversely, in the overwhelming majority of cases disclosure is likely to benefit the claimant by enabling the insurance claim to progress more efficiently.
5. Representation by an insurer does not invalidate authority
Essex Police repeatedly emphasise that CMA acts on behalf of insurers. That fact is not disputed.
However, it does not follow that a data subject cannot authorise such a representative to exercise their statutory right of access. The relevant question is whether valid authority exists.
The Commissioner has already observed that, where there are genuine concerns regarding that authority, those concerns may be resolved by appropriate enquiries with either the representative or the data subject.
That course was not followed.
6. Chief Constable accountability
Essex Police state:
“The Chief Constable remains accountable for any disclosure of sensitive law-enforcement personal data. In the absence of being satisfied that CMA possesses valid authority to exercise the right of access on behalf of the data subject, Essex Police does not consider that disclosure to CMA would be lawful.”
I entirely agree that the Chief Constable remains accountable for disclosures made by Essex Police. However, it is difficult to understand what further assurance Essex Police considers necessary in the circumstances of this case.
The Commissioner has already undertaken a detailed review of the legal issues raised, considered submissions from both parties, consulted internally within the ICO to ensure consistency with current guidance, and concluded that Essex Police should not have refused this request on the grounds advanced.
The Commissioner further explained the steps available to Essex Police where concerns existed regarding third-party authority, including contacting either CMA or the data subject directly.
In those circumstances, I respectfully question what additional safeguard Essex Police considers necessary before it would regard disclosure as lawful.
If the Commissioner, as the statutory regulator responsible for overseeing compliance with the Data Protection Act 2018, has explained both why the refusal was not justified and how any residual concerns could properly be addressed, it is unclear what further level of assurance Essex Police believes could realistically be obtained.
Essex Police’s latest submission appears to suggest that even after receiving the Commissioner’s reasoning, it nevertheless intends to maintain its position unless the ICO identifies further statutory provisions or exercises formal regulatory powers.
I respectfully invite the Commissioner to consider whether this reflects a genuine uncertainty regarding the law, or whether the concern has now moved beyond the issues originally raised in relation to this individual request.
7. My response of 3 September 2025 remains unanswered
Following Essex Police’s original challenge to the Commissioner’s decision, I provided a detailed response dated 3 September 2025 addressing each of the principal issues raised by Essex Police, including:
- impartiality;
- authority;
- consent;
- section 184;
- redaction;
- non-personal data; and
- the practical operation of equivalent procedures adopted elsewhere.
I have never received a substantive response.
Many of the arguments now advanced in Essex Police’s letter of 22 July 2026 are substantially similar to those previously raised.
I therefore respectfully suggest that consideration of Essex Police’s latest submission would be assisted by reading my response of 3 September 2025 alongside it.
Closing observations
The Commissioner’s letter of 8 July 2026 concludes that:
- this request was not an enforced subject access request;
- third-party SARs are capable of being valid where appropriate authority exists; and
- if Essex Police had concerns regarding CMA’s authority, those concerns could have been addressed through enquiries with either CMA or the data subject.
My respectful submission is that Essex Police’s latest correspondence does not demonstrate that those opportunities were taken.
Rather, it advances concerns that remained untested despite mechanisms existing to resolve them.
I trust these observations assist the Commissioner in bringing this matter to a conclusion.
Continunity page – Essex Police – Misapplication of Section 184 DPA 2018 and Disclosure Avoidance