16/07/2025 – ICO’s determination – Essex police to release the information, s184 is not engaged
24/07/2025 – to the ICO – Subject: Supporting Information – Concerns Regarding Misapplication of Section 184 DPA 2018
13/08/2025 – to Essex police – Request for Explanation & Information – Section 184 DPA / ICO Findings
03/09/2025 – from Essex Police – appealing the ICO’s decision
03/09/2025 – response to Essex police re conduct & allegation. Clarification and explanation is sought.
04/12/2025 – from the ICO – 16/07/2025 decision reversed
04/12/2025 – to the ICO – a further review request
09/12/2025 – the ICO responded:
- Thank you for your email in which you request a review of the outcome of your data protection complaint about Essex Police. We will consider the points that you have raised and we will update you in due course. However, as we will need to seek internal advice, it is likely that this will now be in the New Year.
05/02/2026 – a Decision Notice relating to the Essex police statements of 02/12/2024, they had written to the ICO, had received approaches from ‘others’ and had liaised with the NPCC. Having made a request of Essex police, the NPCC and the ICO no information was held to support the statements made.
02/12/2024 Essex Police conversation:
Following a conversation with the Essex police disclosure department 02/12/2024 about the use of the TP SAR process, it was stated the issue had been the subject of attention/activity. Essex police were to provide further. However, this information was not forthcoming. Therefore, the Freedom of Information Act (FoIA) was engaged to formally request the information. The responses about engagement revealed ‘no information held’.
Additionally, the assurance schedule 18 would be explained has been met with silence.
No response has been received to the further questions of 13/08/2025 (above).
The statements made were as follows:
The process had been discussed with the ICO, and this would continue
- “You’re more than welcome to write again to the Information Commissioner’s Office. I’ve done it as well on behalf of this”
Yet, when asked for the written approach to the ICO, Essex could locate no information.
As a ‘belt & braces’ approach, the ICO was also asked to provide the information, the Essex police written approach. The ICO could locate no information.
- “I phoned the ICO on Thursday before we actually replied”
Neither Essex police nor the ICO have a note of this call.
- “And I’m more than happy that I’ll be able to send an email tonight to the Information Commissioner’s Office just outlining that point, and if what you’ve said is actually you’ve taken that to them, that’s fine. I’m more than happy to explain why Essex take the approach that we take”
I responded: ‘Okay. Can you copy me in on that?’ the reply was:
- “Absolutely”
A copy was not received and the ICO holds no information, no copy of the email.
IC-383634-D4S1 – The ICO has not any exchanges with Essex police regarding the issue of s184
outside of our complaint handling work. Therefore we do not hold any information within the scope of this part of your request.
There had been engagement with the NPCC about the use of the TP SAR process
“This has been raised within the National Police Chiefs’ Council. We have a data protection unit, and our information rights managers, who referred this to me as the data protection officer who sits outside the information rights team, they’ve referred this to the national team for national clarity for that very reason, that actually…“
“Within the last week or so“
“that came from the information rights manager, but all I know is that she came back to me on Friday and said that this is something they’ve raised through the national group for the NPCC because of the issues related to just basically being clear about what the correct route is for obtaining personal data related to
insurance claims.“
“The NPCC, National Police Chiefs’ Council, are considering it, so we can expect some sort of response from them“
When asked for the NPCC consideration, Essex could locate no information.
As a ‘belt & braces’ approach, the NPCC was also asked to provide this ‘consideration’. They too could locate no information – Internal Review 2232/2025 (of 037/2025).
Others had approached Essex police using the TP SAR process.
With regard to the TP SAR, non-MoU approaches, I was informed I was not the only party engaging the process, the comment being:
“Yeah, not just yourselves, to be fair”
When asked ‘What, other people are doing it?’ they reply was:
‘I don’t know’
An FoIA request was made for details of ‘the others’, those who had made this specific type of request, seemingly to an FoIA manager i.e. this was a very restricted subject/enquiry. However, no information could be found.
Essex police were aware that others were making such approaches, applications they took exception to, had deemed may amount to a criminal offence (and presumably has responded in a manner similar to that I had received), yet could find not one letter to or from ‘others’!
Schedule 18 is more wide than I believed
When explaining to Essex police’ that section 184 was only engaged if the applicant was seeking criminal or health records, this stance was contradicted, with the disclosure employee stating:
- “I think you’d find that there’s actually more than that because within Schedule 18 it lists what relevant records actually are. I’ll send you the link. “
No link was sent.
Schedule 18, as we conveyed, relates to enforced SAR and relevant records are health & criminal records. Both were clearly excluded on the request.
Data Protection Act 2018 SCHEDULE 18
SCHEDULE 18 – Relevant records
- 1(1) In section 184, “relevant record” means –
- (a) a relevant health record (see paragraph 2),
- (b) a relevant record relating to a conviction or caution (see paragraph 3), or
- (c) a relevant record relating to statutory functions (see paragraph 4).