03/03/2022
From DPO@sussex.police.uk
To ICO Casework
Subject CIM.T1.22 ICO Case reference: IC-108170-P1J8
Dear David
Thank for your letter in response to the complaint raised by [redacted] I have extracted the relevant information to answer the questions below. Most of the responses have been directly lifted from the email exchanges (as attached), this is to validate the communications from the Collisions Unit to the data subject to re-enforce the current operational processes in place for such incidents.
- Describe the procedure for handling incidents of this kind, and state whether the procedure was followed in this instance.
- What was the purpose for the disclosure?
- Why was the disclosure necessary for this purpose?
Where an incident that falls under Section 170 of the Road Traffic Act 1988 occurs and one of the parties has refused to give their contact details for insurance purposes, the aggrieved party will contact the police to provide the necessary data from the DVLA records. The information shared is the minimum required as required by the legislation to allow civil proceedings to be established.
In this scenario, the aggrieved party used the information to confront the data subject, this is a crime and will be investigated as such. The information shared with the data subject by the Collisions Unit made the purpose for the processing clear to the data subject:
With regards to your enquiry about your personal details being given. Under section 170 of the Road Traffic Act 1988 it is a requirement that the names and addresses of the drivers involved in a damage only collision are exchanged.
Therefore you would have been required to do this at the scene although 1 understand from your explanation why this may not have been possible for you. As details were not exchanged and the collision was reported to ourselves by the other party, part of our role is to try to establish the details of the other driver.
Once these details have been established we are required under section 170 to pass these details onto both parties.
Should you be involved in a similar situation in the future and you are not able to exchange details at the scene then you should report the incident to the Police within 24 hours
Although you had stated that there was not a Road traffic accident or damage the other driver has reported the incident and advised that there is damage to their vehicle therefore section 170 applies and details are required to be exchanged
- Please state if personal data is being processed under UK GDPR or part 3 DPA 2018.
- If under UK GDPR, what Article 6 lawful basis did you use to disclose personal data?
Personal data was originally processed under the GDPR as processed by the DVLA. This was then further processed by the police for a law enforcement purpose. The initial processing by the DVLA would be Public Task as there is a requirement to process this data within their official functions. Due to the lawful requirement to make the disclosure under the Road Traffic Act, the information was further processed as it was compatible and necessary for the performance of a task carried out for that purpose by a competent authority. Under the data minimisation requirements, only the relevant and pertinent information was shared with the aggrieved party, this being sufficient to report the claim to their insurance company.
- Please provide any further information you feel may be relevant to our assessment.
Whilst appreciative that this was a traumatic incident for the data subject, this process was established to ensure incidents involving damage to vehicles where a driver refuses to give their details can be resolved through insurance companies. This is also an established and required process for all Police Forces in agreement with the DVLA. Fortunately, this type of incident is an exception rather then the normal and any crimes committed against either party following the exchange of personal data will be fully investigated. Support will also be offered to the victims, as it was for
If you require any further information then please do not hesitate to contact me. Many thanks
Regards
Information Governance Supervisor
Force Deputy Data Protection Officer
Sussex Police Headquarters, Church Lane, Lewes, East Sussex, BN7 2DZ www.sussex.police.uk