Sent: 22 August 2026 14:06
To: ‘NPCC Data Protection Mailbox’ <npcc.data.protection@npfdu.police.uk>
Subject: RE: NPCCSAR [redacted] Response to your SAR / ROA Query
Dear Data Protection Team,
NPCCSAR [redacted] – formal request for rectification and restriction of processing
CRU 603/24 / FOI 2962/2026 / Internal Review 3064/2026
I write further to your email of 5 August 2026, in which the NPCC stated:
“In respect of your request for rectification of information, any request to rectify personal data must identify the specific item of personal data considered inaccurate and explain the basis upon which it is said to be incorrect.”
I now do so formally.
This request is made under Article 16 UK GDPR and the associated accuracy principle, together with Article 18 insofar as applicable. To the extent that the NPCC considers the processing to fall within Part 3 of the Data Protection Act 2018, please instead or additionally treat it as a request under sections 46-48 of that Act.
This is also a formal data-protection complaint concerning the accuracy, fairness, necessity, dissemination and subsequent use of the personal data concerned.
Importantly, this is not simply a repetition of my previous complaint about the adequacy of searches undertaken for NPCC SAR 1383. Material information has emerged since your email of 5 August. In particular, the NPCC issued Internal Review 3064/2026 on 17 August 2026, expressly confirming that it holds no information falling within a deliberately broad request seeking the recorded basis for an adverse requester-specific statement circulated about me.
1. The personal data I challenge
The personal data concerned is the statement circulated within CRU 603/24, in the email dated 25 June 2024 entitled:
“OS – Request for Centurion information – CRU 603/24 – Advice attached”
which stated:
“I suspect that [SUBJECT] is keeping requests private on that site…”
The subject was me and the statement therefore constituted personal data about me.
I challenge both the accuracy of the proposition conveyed and the propriety of continuing to retain, process or rely upon it without qualification.
I was not keeping the relevant WhatDoTheyKnow requests private. The suggestion about my conduct was incorrect, wrong ergo, unfounded, baseless and false.
I appreciate that the words “I suspect” identify the statement as an expression of opinion or suspicion rather than an unequivocal statement of fact. That does not, however, remove the data-protection issue.
An adverse opinion about an identifiable individual does not exist in a vacuum. There must be proper consideration of its provenance, the information upon which it was formed, its accuracy in context, the purposes for which it is retained, and the consequences of its further use and dissemination.
That is particularly important here because the statement was not made in private correspondence having no subsequent consequence. It was circulated through an NPCC process dealing specifically with information requests and identifiable requesters.
2. The subsequent FOIA enquiry
In FOI 2962/2026 I deliberately sought a very broad category of recorded information concerning the evidential or informational basis for that statement.
Question 4 sought:
“Recorded information, guidance, policy, enquiries, briefings or other material held and relied upon in support of the statement contained within CRU 603/24…”
I additionally sought recorded information concerning:
- whether requests made via WhatDoTheyKnow may be private, concealed or non-public;
- any enquiries, checks or guidance relied upon in making the statement; and
- any formal guidance or policy concerning WhatDoTheyKnow relevant to that statement.
The NPCC response of 17 July 2026 was:
“4. No information held.”
The response then referred to open-source research carried out outside the FOIA process concerning the current WhatDoTheyKnow Pro facility. That did not answer the important historical question: what information had actually been held or relied upon when the statement about me was made on 25 June 2024?
I therefore specifically challenged the point at internal review. I asked the reviewer to determine:
whether the NPCC’s position is that no recorded information whatsoever was held, relied upon or consulted before that statement was made.
The answer in Internal Review 3064/2026 dated 17 August 2026 is unequivocal:
“I can confirm the NPCC do not hold any information in relation to part 4 of your request.”
That confirmation post-dates your letter of 5 August closing my previous data-protection complaint. It is therefore material new evidence.
3. The position now established
I do not suggest that an FOIA response can establish that no individual ever had a thought, recollection or unrecorded reason for making a statement. What the NPCC has now formally established is nevertheless significant.
Having been specifically asked for recorded information, guidance, policy, enquiries, briefings or other material held and relied upon in support of the adverse requester-specific suspicion, the NPCC has confirmed following internal review that no such information is held.
The NPCC can therefore presently identify no recorded evidential or informational basis for the suspicion it circulated about me. That is important because the proposition itself was false.
- If the NPCC nevertheless maintains that the suspicion was properly founded, I ask it now to explain the factual basis upon which it reaches that conclusion and how that position can be reconciled with the outcome of FOI 2962/2026 and IR 3064/2026.
If it cannot do so, I do not consider that it is appropriate for the NPCC merely to leave the adverse statement sitting upon its systems, available for future consideration or dissemination, without correction or prominent qualification.
4. The significance of the NPCC’s own disclosed CRU processes
The seriousness of this issue is reinforced by other material disclosed by the NPCC under FOI 2962/2026.
The CRU governance material explains that requester names were collected and processed for purposes extending materially beyond simple correspondence administration. It states that providing the applicant’s name allows the CRU to undertake checks for:
“duplication, repeat requests and vexatious considerations.”
It further states that email or postal addresses may be used when considering:
“applicants working in concert with each other”.
The same document records that names included on circulation logs allowed stakeholders to identify requesters:
“making requests across government”.
At the same time, the governance document states:
“The name of the applicant is only used as a reference, advice is provided on an ‘applicant blind’ basis. The name is only used in correspondence where proportionate and necessary.”
This makes the accuracy and provenance of requester-specific commentary particularly important.
An unsupported adverse statement concerning a named requester’s supposed behaviour is plainly capable of assuming greater significance when placed within a system in which requester identity may be used in connection with repeat requests, vexatiousness considerations and cross-organisational identification.
I am not asserting that the particular comment was in fact subsequently relied upon to refuse one of my information requests under section 14 FOIA. I presently have no evidence enabling me to make that assertion. It is however, possible.
My point is more fundamental: the NPCC created and circulated adverse personal data about me within a system capable of using requester-specific information for consequential purposes. It must therefore be able to demonstrate appropriate care as to the accuracy, provenance and continued use of that information.
5. NPCC’s subsequent data-minimisation measures
The material disclosed under FOI 2962/2026 also includes the NPCC email of 14 February 2025 entitled “New processes – Data minimisation”.
That document is relevant because it demonstrates the NPCC’s own subsequent recognition of the risks associated with processing and circulating requester identity. Among other things, it directed that:
- additional CRU-generated emails should not contain the applicant’s name;
- applicant names should be removed from correspondence supplied by forces;
- names should be removed from attachments; and
- forces should not repeat applicant names in subsequent correspondence.
The NPCC recorded the reasons for these changes as including:
“To ensure data minimisation in our correspondence and prevent personal data from being processed unnecessarily.”
and:
“Prevents our advice emails from being circulated to others in force or externally with applicants names on – potential for a data breach.”
It also expressly referred to compliance with:
“the applicant blind principle of the FOIA”.
The same document nevertheless records that the applicant’s name was to continue to be retained on the NPCC case-management system because:
“the benefit to intelligence led policing outweighs removal at this time.”
I consider that combination particularly relevant. It demonstrates both that requester identity was regarded as potentially useful for wider policing purposes and that the NPCC itself recognised a need to prevent unnecessary dissemination of that identity.
Against that background, the circulation of unevidenced adverse commentary about a requester requires proper scrutiny.
I appreciate that the February 2025 process post-dates the June 2024 circulation and I do not therefore assume that every provision was operative at the earlier date. I ask the NPCC, however, to consider the June 2024 processing against the applicable data-protection principles and whatever CRU governance arrangements applied at that time.
6. This is not answered merely by describing the statement as an “opinion”
I anticipate the possible response that the record accurately records the fact that somebody held or expressed a suspicion. That would not, in my view, adequately resolve this complaint.
I am not asking the NPCC to rewrite history or pretend that the communication did not occur.
If retention of the original communication is necessary for audit, evidential or accountability purposes, I positively accept that deleting the historical record may be inappropriate.
What I require is that the NPCC deals properly with the substance and future use of the adverse personal data.
An accurate historical record can record both:
- that an officer expressed a particular suspicion in June 2024; and
- that the person concerned disputes that suspicion, states that it was false, and that subsequent NPCC searches and internal review identified no recorded information supporting it.
There is an obvious distinction between preserving an accurate record of what was once said and continuing to treat the substance of what was said as reliable personal information capable of future use.
7. Formal request for rectification
I therefore formally request that the NPCC reconsider the accuracy of this personal data and take appropriate rectification action. Specifically, I ask the NPCC to:
a. Confirm whether it continues to maintain that the suspicion that I was “keeping requests private” was factually or evidentially justified.
If so, please explain the basis upon which it reaches that conclusion, particularly in light of FOI 2962/2026 and IR 3064/2026.
b. If the NPCC cannot substantiate the statement, correct the record.
I do not insist that the historical email itself be destroyed. A clear supplementary statement or annotation may be the more appropriate means of preserving the historical record while ensuring that the adverse proposition is not subsequently treated as established or reliable information.
At minimum, any system upon which the comment remains should record clearly that:
- I dispute the allegation;
- I state that the relevant WhatDoTheyKnow requests were not being kept private by me;
- I requested the recorded evidential basis for the assertion;
- the NPCC’s FOIA response stated “No information held”; and
- following a specific challenge, IR 3064/2026 confirmed that the NPCC holds no information in relation to that request.
c. Confirm that the unsupported suspicion will not be relied upon in any future consideration of my FOIA requests, SARs, requester behaviour, alleged vexatiousness, repeat-request activity, intelligence assessment or other decision affecting me unless and until the NPCC is able to establish a proper factual basis for doing so.
8. Restriction of processing
Pending determination of this accuracy challenge, I formally request restriction of processing of the disputed personal data.
If the NPCC considers the UK GDPR regime applicable, this request is made under Article 18 in conjunction with my Article 16 challenge.
If the NPCC considers Part 3 DPA 2018 applicable, I ask it to apply the corresponding provisions governing rectification and restriction, including sections 46 and 47.
In practical terms, I ask that the information be marked so that it cannot be relied upon or further disseminated as substantive information concerning my conduct while its accuracy is under review.
I am not asking the NPCC to destroy material which may now be relevant evidence concerning the way in which my personal data was processed.
9. Previous dissemination, identification of recipients and propagation of any correction
The disputed personal information was not confined to an internal note or private record. It was circulated by the NPCC.
I am particularly concerned that the circulation does not appear to have been confined simply to individual police constabularies. The material disclosed to me refers more broadly to stakeholders and to processes capable of identifying requesters making requests across organisations. I have still not been provided with a complete account of the recipients of the requester-specific information circulated about me.
That matters considerably.
An inaccurate or unsupported characterisation is not adequately remedied merely by correcting the record retained by the originating organisation if copies of the same personal data remain on the systems, correspondence or records of organisations to which it was disseminated. Indeed, the wider the circulation, the greater the potential for the statement to become detached from its original context and subsequently to be treated by a recipient as established or reliable information about me.
I therefore ask the NPCC to identify every recipient to whom the disputed personal data was disclosed, including, as applicable, every constabulary, public authority, agency, organisation, policing body, unit or other recipient.
If the NPCC maintains that it cannot provide the identity of any recipient, please identify the legal basis relied upon and, where possible, provide sufficient information to establish the nature and extent of the dissemination.
If the NPCC rectifies, supplements, qualifies or restricts the disputed personal data, I require it to communicate that action to each recipient to whom the information was disclosed, subject only to any applicable statutory exception.
That communication should make clear that:
- I dispute the original characterisation and state that it was false;
- the NPCC was subsequently asked specifically for the recorded information, enquiries, checks, guidance or other material supporting the suspicion;
- FOI 2962/2026 recorded the answer as “No information held”;
- following my express challenge, IR 3064/2026 confirmed that the NPCC holds no information in relation to that part of the request; and
- accordingly the original requester-specific suspicion should not be treated or relied upon as substantiated information about me.
I further ask that each recipient be expressly requested to:
- correct, supplement or appropriately annotate its own copy of the information;
- ensure that the unsupported characterisation is not relied upon in any future decision or assessment concerning me;
- identify whether it has further disseminated the information to another body; and
- where it has done so, take the corresponding steps required of it to communicate the correction or qualification onwards.
This final point is important. If a recipient subsequently circulated the information further, correcting only the NPCC’s record and the first generation of recipients may leave copies of the disputed information continuing to circulate elsewhere.
I therefore ask the NPCC to take reasonable and documented steps to ensure that its correction is propagated through the dissemination chain insofar as the applicable data-protection regime requires, and to explain what action has been taken.
Please also provide me with:
- the complete list of recipients notified;
- the date upon which each corrective notification was issued;
- the substance of the correction or qualification communicated;
- confirmation that recipients were asked to rectify or supplement their corresponding records; and
- details of any recipient whom the NPCC decided not to notify, together with the reason for that decision.
If the NPCC considers notification to any recipient impossible or involving disproportionate effort, please identify that recipient or category of recipient and explain the basis upon which that conclusion has been reached.
I do not consider that a generic assurance that “relevant recipients have been notified” would adequately address this issue. The concern is specifically to ensure that adverse personal information which the NPCC can now identify no recorded basis for is not left sitting, unqualified, elsewhere within policing or other organisations after the NPCC’s own record has been corrected.
10. Retraction and apology
I also ask the NPCC to consider the appropriate non-statutory remedy.
The statement was derogatory. It suggested questionable behaviour on my part in the way I used a public information-rights platform. It was not casual conversation between private individuals: it was a requester-specific suspicion created and circulated in an official policing context by a national policing body, through a unit whose professional function is concerned with information rights, disclosure and the proper handling of recorded information.
That distinction matters.
The police routinely require others to distinguish between suspicion, information, intelligence and evidence. Accuracy, provenance and the evidential basis for assertions are fundamental to law-enforcement decision-making. It is therefore particularly concerning to discover that an adverse suspicion about an identifiable individual appears to have been circulated through an official national policing process when, following specific enquiry and internal review, the NPCC can identify no recorded information, enquiry, check, guidance or other material supporting it.
I state unequivocally that the suggestion was untrue.
The NPCC has now been given every opportunity to identify the basis upon which it was made and has formally confirmed that it holds no information falling within my request for that basis. The provenance of the allegation therefore remains unexplained.
That is not an inconsequential matter. The statement was circulated by professionals whose communications would reasonably carry institutional weight with recipients. A recipient receiving requester-specific information from the NPCC or the National Police Freedom of Information and Data Protection Unit could reasonably be expected to attach considerably more significance to it than to an unsupported comment made by an ordinary individual.
The concern is therefore not merely that somebody expressed an unfounded suspicion. It is that the authority and credibility of a national policing body may have been lent to that suspicion when it was circulated to other organisations.
This is especially troubling in light of the NPCC’s own disclosed processes, under which requester identity may be retained and considered in connection with repeat requests, cross-organisational activity and “vexatious considerations”. In such an environment, unsupported adverse commentary about an identifiable requester is capable of acquiring consequences well beyond the original email.
I do not suggest, without evidence, that every recipient relied upon the statement or that it caused any particular subsequent decision. The point is that the NPCC created the risk by circulating it. Once such information enters official systems and correspondence, it may be retained, repeated, relied upon, quoted out of context or influence later assessments without the individual ever knowing that it exists.
There should therefore be a correspondingly high expectation that requester-specific adverse information circulated by a national policing body is accurate, properly sourced and capable of justification.
Here, the position presently appears to be the opposite: an adverse suspicion was circulated about me; I say it was false; the NPCC has been specifically asked for its recorded basis; and, after internal review, it has confirmed that it holds none.
In those circumstances, simply annotating the NPCC’s own record would not, in my view, amount to a complete remedy.
If the NPCC cannot substantiate the statement, I consider that the appropriate response is to:
- acknowledge that the requester-specific suspicion should not have been circulated without an adequate basis;
- withdraw or expressly correct it;
- communicate that correction to every identifiable recipient of the original information;
- require or request those recipients to correct or appropriately qualify their corresponding records;
- take reasonable steps to address any onward dissemination; and
- apologise for the creation and circulation of unsupported derogatory information about me.
This is not a request that the historical record be erased. On the contrary, I consider that the record should be preserved accurately. What it should now show is the complete history: that the suspicion was expressed and circulated, that I challenged its truth, that the NPCC was subsequently unable to identify any recorded basis for it, and that corrective action was then taken.
Given the authority of the organisation from which the statement originated, the nature of the unit involved and the potentially wide circulation of the information, I consider a clear acknowledgement, correction and apology to be a proportionate response.
11. Relationship with NPCC SAR 1383
Your email of 5 August stated that the NPCC considered my previous complaint concerning NPCCSAR 1383 concluded. I am not asking you simply to conduct the same SAR searches again.
However, the present issue plainly arose from the SAR disclosure, and the new FOIA evidence is relevant to concerns I have previously expressed about the way in which my personal data has been created, circulated and subsequently handled by the NPCC.
Your 5 August response specifically invited me to identify particular inaccurate personal data and explain why it was incorrect.
I have now done precisely that, supported by a subsequent formal NPCC internal-review finding which did not exist when you closed the earlier complaint.
It would therefore not be appropriate to dismiss this request merely on the basis that NPCCSAR 1383 or my earlier complaint has already been considered.
Please record this correspondence as a new and specific request for rectification and restriction of processing, and a complaint concerning the accuracy and dissemination of the identified personal data.
12. Response requested
I ask the NPCC to provide a substantive response addressing:
- whether it accepts that the disputed statement concerns my personal data;
- whether it considers that statement accurate and, if so, the evidential basis for that conclusion;
- how it reconciles any assertion that the statement was substantiated with FOI 2962/2026 and IR 3064/2026;
- what rectification, supplementary annotation or other correction will now be made;
- what restriction has been placed upon further processing while accuracy is considered;
- whether the disputed information has ever subsequently been used or relied upon in connection with consideration of my information requests, requester behaviour or any other matter;
- the identity of every recipient to whom the disputed personal data was disclosed, the action taken to communicate any rectification, supplementation or restriction to each recipient, and what steps have been taken to ensure that corresponding records held by those recipients — and, where applicable, subsequent recipients — are appropriately corrected or qualified;
- whether the NPCC will issue a corrective notification or retraction to those recipients;
- whether the NPCC considers an apology appropriate; and
- if any part of this request is refused, the legal basis and reasons for that refusal.
I would also ask that the records relevant to this complaint, including the original circulation and associated CRU records, are preserved while this matter remains disputed and while related complaint, regulatory and legal processes remain capable of consideration.
This issue now goes beyond whether my SAR searches were sufficiently extensive.
The NPCC has itself disclosed that requester identity has been retained within CRU for purposes including “vexatious considerations” and cross-organisational identification; it has disclosed an internal recognition of the importance of data minimisation and the “applicant blind principle”; and it has now formally confirmed that it holds no information falling within my request for the recorded basis of an adverse requester-specific suspicion which it circulated about me.
That combination requires a substantive data-protection response. I look forward to receiving it.
Reservation of rights and further consideration
Given the seriousness of the matters identified above, I reserve the right to place this correspondence, the underlying disclosures and the NPCC’s response before any body having a legitimate interest in the NPCC’s handling of my personal data, information requests or related complaints. This may include the Information Commissioner’s Office, the First-tier Tribunal in proceedings in which the NPCC’s handling of information requests, requester behaviour, section 14 considerations or related evidence becomes relevant; and those presently undertaking or reviewing complaints concerning the NPCC, its personnel, functions or associated policing bodies.
The present issue cannot properly be viewed in isolation. The NPCC circulated adverse requester-specific information about me through an official national policing process; its own subsequently disclosed material demonstrates that requester identity may have significance for matters including cross-organisational activity and “vexatious considerations”; and, when specifically required to identify the recorded basis for the adverse statement, the NPCC has confirmed after internal review that it holds none.
The manner in which the NPCC now responds to that position – including whether it investigates the provenance of the statement, corrects the record, addresses its dissemination and provides an appropriate apology – may therefore itself be relevant evidence when the conduct and governance of these matters are considered elsewhere.
For the avoidance of doubt, I will preserve and, where relevant, may rely upon the NPCC’s substantive response to this complaint, together with FOI 2962/2026, IR 3064/2026 and the associated disclosed governance material, in any subsequent regulatory, complaint or Tribunal proceedings.
I would therefore invite the NPCC to treat this as an opportunity to resolve the issue properly at source.
Kind regards,
Associated information:
FoIA request – NPCC Central Referral Unit (CRU) FOIA Circulation/Advice Processes
06/07/2026 – ‘Professionalism and performance – police leadership for the future‘ report