In response to a request for information made by use of the Freedom of Information Act (FoIA), the Metropolitan Police Service (MPS) explained the use of the SAR process, also known as a Right of Access (RoA) request – specifically referring to obtaining a copy of a crime report:
MPS ref: 01/FOI/26/053728/G
ADVICE AND ASSISTANCE
If the information is your own personal information, for example, if you are seeking a crime report where you were a victim, witness or suspect, then you are able to request your information via a Right of Access Request (ROA) under the DPA. In order for us to progress your request as an ROA request, please provide us with the following information:
- A proof of your residential address dated within the last three months, this can be a utility bill or bank statement.
- A proof of your identity to confirm your name and date of birth, this can be a passport, a driving licence or a national identity card.
Further guidance and an optional application form are available on our website via the link below:
This process may take up to 30 calendar days from the date we receive the additional information.
If the requested information relates to a third party, for court purposes, or if you already obtained a Court Order for the information, you will need to submit your request to the local Borough Command Unit, as these requests do not fall within the remit of the Information Rights Unit. You can redirect your request via an online submission at the following link or by writing to your local police station. https://www.met.police.uk/contact/af/contact-us-beta/contact-us/
It was explained, with regard to the specific request, why the FoIA was not considered appropriate:
A Freedom of Information Act request is not a private transaction. Both the request itself, and any information disclosed, are considered suitable for open publication. This is because, under Freedom of Information, any information disclosed is released into the wider public domain, effectively to the world and not just to one individual.
In most cases, Personal Data is exempt from disclosure under the Freedom of Information Act, as I will explain below.
To confirm or deny whether personal information exists in response to your request could publicly reveal information about an individual or individuals, thereby breaching the right to privacy afforded to persons under the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR).
Where an individual is requesting his or her own personal data the information is always exempt. Such information can be requested under other legislation (please see the advice and assistance section below).
Where an individual is requesting third party personal data the MPS must ensure that any action taken adheres to the principles of the Data Protection Act 2018 and the UK GDPR. To clarify, the Freedom of Information Act only allows disclosure of personal data if that disclosure would be compliant with the principles for processing personal data. These principles are outlined under section 34 of the DPA 2018 and under Article 5 of the UK GDPR.