When the Regulator Says “Yes”… But the Police Still Say “No”

Essex Police, Third-Party Subject Access Requests (TP SAR) and Helping Victims of Vehicle Theft

The Information Commissioner’s Office has concluded that Essex Police should not have refused a Third-Party Subject Access Request (TP SAR) submitted on behalf of a victim of vehicle theft.

Essex Police respectfully disagrees.

Ordinarily, a disagreement between a police force and the Information Commissioner might be of interest only to lawyers and data protection practitioners. This one is different.

It raises practical questions affecting victims of vehicle crime, insurers, police disclosure teams and anyone seeking to exercise their statutory right of access.

More fundamentally, it asks whether the practical exercise of a statutory right is being lost amongst procedural objections.

Contents

The Request

This case concerns an unusual category of stolen property – a vehicle. A stolen vehicle is unusual because it generates a detailed official record. Unlike most stolen property, it is registered, insured, highly identifiable and subject to statutory recording requirements. The resulting police crime report often becomes the principal contemporaneous record of the theft and, months later, can be central to the victim’s insurance claim.

This information is commonly required to progress a victim’s insurance claim – a claim that progresses because the police were unable to prevent the theft or locate and return the vehicle to its owner in an ‘as was’ condition. Understandable, to resolve the distressing, inconvenient and often costly situation in which they find themselves, the victim turns to the vehicle insurer.

In a specific matter, the request submitted was deliberately narrow:

  • It sought information relating solely to the reported theft.
  • It expressly excluded criminal conviction records and health records.

The vehicle owner provided written authority for a representative to act on their behalf.

  • No intelligence files were requested.
  • No unrelated police information was sought.
  • No previous incidents.
  • No criminal histories.
  • No health information

The request simply sought information relating to the victim’s own reported crime.

The First Issue — Section 184

One of the most surprising aspects of this matter was Essex Police’s reference to Section 184 of the Data Protection Act 2018 — enforced subject access. Section 184 creates a criminal offence.

However, it applies only where an individual is required to obtain specified “relevant records“, principally health records or criminal conviction information.

Neither category was requested. Indeed, the request specifically excluded health and criminal information.

Obviously, the ICO concluded that:

  • the request did not seek relevant records;
  • Section 184 was therefore not engaged – could not be engaged, a necessary component was missing – the absence of a requirement to provide criminal and/or health records!

Additionally, the ICO stated:

  • it was not for Essex Police to determine whether a Section 184 offence had been committed.

The full finding (16/07/2026) can be read here.

Those findings appear straightforward. Yet Essex Police has subsequently explained that Section 184 was never its principal concern. That leaves an obvious question.

  • Why was a criminal offence raised at all?
  • Why was Section 184 raised when the request expressly excluded the very categories of information to which the offence relates?

To date, no satisfactory explanation has been provided. Nor has there been confirmation that records associating the request with a potential criminal offence have been corrected.

More concerning still, Essex Police is not the only force to have relied upon Section 184 in comparable circumstances. Essex Police is not alone. Three other constabularies have also cited Section 184 in comparable circumstances. Thames Valley Police and West Midlands Police subsequently apologised.

If specialist disclosure departments are misunderstanding one of the more narrowly drafted provisions within the Data Protection Act, that raises a wider issue deserving of consideration.

The Second Issue – Authority

Essex Police now places greater emphasis upon a different question.

  • Did the representative genuinely possess valid authority to act for the data subject?

That is an entirely legitimate question. Controllers should satisfy themselves that a third party is authorised. The ICO agrees. But the ICO also explains how that should be done. If concerns exist, contact the representative.

  • Contact the data subject.
  • Confirm the authority.

Essex Police did neither. This is particularly surprising because another police force has operated such a process for years:

  • Signed authority.
  • Proof of identity.
  • Telephone confirmation.
  • Appropriate redaction.

Disclosure. The practical solution already exists and has done for years.

Helping Victims

It is worth remembering why this matters.

Vehicle theft investigations rarely produce immediate suspects. Opportunities for forensic examination are often limited. Sadly, many vehicles are never recovered and of those that are, they may be little more than a collection of components, salvage – ‘recovery’ effectively not changing the victim’s circumstances.

The crime report therefore becomes the principal record of what happened. Victims often require that information to progress an insurance claim. By that stage, the opportunity for further police investigation has often passed. The victim is simply trying to understand what information exists, obtain this and progress their claim.

A properly managed TP SAR offers practical benefits. It enables:

  • clear identification of the information sought;
  • submission of identity documents from the outset;
  • narrow, focused requests;
  • appropriate redaction where necessary;
  • fewer repeated enquiries; and
  • compliance with the statutory one-month response period.

Given the considerable pressures already faced by police disclosure departments, one might reasonably expect such an approach to assist rather than hinder the process.

Are the Interests Really Adverse?

Essex Police suggests that a representative instructed by an insurer may have interests adverse to those of the claimant. That deserves careful thought. A loss adjuster investigates facts, they do not rewrite them.

If the police record differs from information supplied during an insurance claim, disclosure is not the problem. The underlying inconsistency is.

In most cases, disclosure assists honest policyholders by enabling their claims to progress promptly.

  • If an inconsistency exists, it should be explained – not concealed.

It is difficult to see how withholding factual information benefits the genuine victim of crime.

The Regulator Says ‘Yes’

Perhaps the most significant aspect of this dispute is this.

The Chief Constable quite properly remains accountable for disclosures made by the force. No one disputes that.

But the ICO has now considered the legal arguments, reviewed submissions from both parties and explained why the request should have been processed. But for Essex police, this doe snot appear to provide sufficient comfort to disclose following receipt of a TP SAR. If that level of regulatory assurance is insufficient, an obvious question follows.

  • What level of assurance would be sufficient?
  • If the statutory regulator, having considered submissions from both parties, is unable to provide sufficient assurance that disclosure would be lawful, who can?

At what point does legitimate legal caution become refusal to accept the regulator’s interpretation of the legislation?

Why This Matters

This case is no longer simply about one Subject Access Request. It is about:

  • victims exercising statutory rights;
  • consistency across policing;
  • confidence in regulatory guidance;
  • timely access to information.

The irony is difficult to ignore.

  • The police record the crime.
  • They investigate as resources permit.
  • Where the vehicle cannot be recovered, the victim turns to the insurance process.
  • To progress that claim, they seek information about their own crime, authorising a representative to obtain it on their behalf.
  • The ICO says that route should be available.
  • Essex Police remains unconvinced.

As Parliament has created a statutory right of access, the Information Commissioner says that right should be available, and the victim has authorised another person to exercise it on their behalf,

  • why should they instead be directed towards a constabulary’s separate disclosure process?

The question is no longer whether a third-party Subject Access Request should be accepted. It is whether victims should be able to exercise a statutory right through an authorised representative, or whether procedural objections should continue to stand in the way.

The purpose of policing is to protect the public and support victims of crime. The purpose of data protection law is not to create unnecessary barriers to the lawful exercise of statutory rights. If a victim cannot obtain information about their own reported crime through an authorised representative, despite the Information Commissioner’s Office concluding they should be able to, it is reasonable to ask:

  • Who is this approach really helping?

It is difficult to conclude that the answer is the victim.