The ICO Says “Yes”, the Police Say “No”
The Information Commissioner’s Office has concluded that Essex Police should not have refused a Third-Party Subject Access Request submitted on behalf of a victim of vehicle theft.
Essex Police disagrees.
At first glance, this may appear to be an obscure dispute about data protection law. It is not.
It raises much wider questions, such as:
- Can a victim authorise a trusted representative to obtain information about their own crime?
- Should police refuse a statutory request because they disagree with the regulator’s interpretation of the legislation?
- And, where a statutory route exists, should a victim instead be expected to pay £150 for disclosure?
The request in question was deliberately narrow. It related only to the victim’s own reported theft and expressly excluded criminal conviction and health records.
The ICO concluded that Essex Police should not have refused the request.
Essex Police has challenged that conclusion.
I have now submitted a detailed response to both the ICO and Essex Police. The dispute now centres upon two principal issues:
- whether Essex Police were correct to mention Section 184 of the Data Protection Act 2018 (enforced subject access) i.e.. raise the spectre of criminal conduct and
- whether a properly authorised representative may exercise a victim’s statutory right of access.
Although this case concerns vehicle theft, the implications extend much further. They raise important questions about victims’ rights, police disclosure, statutory access to information and whether public authorities should follow the guidance of the regulator responsible for overseeing the legislation.
