Consent, Third Party Subject Access Requests (TP SAR) & s.184 DPA – the criminal offence of ‘Enforced Subject Access’.
The interaction with Essex police following an attempt to obtain a copy of a vehicle theft report on behalf of a victim using their Third Party Subject Access Request (TP SAR) facility.
ICO – Case Reference IC-356699-W0G6
16/07/2025 – the ICO finds ‘ Essex Police has not complied with its obligations under data protection law in this instance’ – read the ICO’s full finding here.
03/09/2025 – Essex Police position
03/09/2025 – to Essex police seeking information about their position
04/12/2025 – the ICO reverses its position – ‘CMA is not the appropriate party to make a subject access request to Essex Police’
04/12/2025 – a review of the ICO’s position is requested
16/02/2026 – from the ICO:
‘Thank you for your email and for your patience while we consider your request for review. I apologise for the delay in responding to you. We want to ensure that we review things thoroughly but we will try and keep you updated as things progress. We are hoping that we can provide an outcome within the next 28 days. However, this is subject to a variety of internal factors. If we think that there will be any further delays, we will let you know.‘
25/02/2026 – to the ICO – contextual material which may assist with an understanding of the procedural issues arising in practice
08/04/2026 – to the ICO – TP SAR Follow-Up
08/04/2026 – to Essex police – again seeking clarification
08/07/2026 – the ICO’s ‘Final Outcome’ – ‘Essex Police should not have refused to respond to the SAR on the grounds they have provided’.
22/07/2026 – Essex police write to the ICO about the ‘unresolved questions’
23/07/2026 – comment to the ICO regarding the Essex police objections of 22/07/2026