28/02/2022
From ICO Casework
To DP0@sussex.police.uk
Subject ICO Case reference: IC-108170-P1J8
Display Name ICO to DC – Fl needed
Dear Sir/Madam,
I am writing to you as the Information Commissioner’s Office (ICO) has received a data protection concern about Sussex Police. The complaint was received by the ICO on 20 May 2021.
The ICU’s role
Our role is to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
One way that we do that is to consider complaints from individuals who believe there has been an infringement of the data protection law. Section 165 of the Data Protection Act 2018 requires us to take steps to respond to the complaint including investigating it to the extent that we feel is appropriate and informing the complainant of the outcome.
The concern
The concern is about the disclosure of personal data to a third-party. I attach relevant document for your reference.
Next steps
Before we are in a position to make an assessment we need some further information from you. Please provide responses to the following:
- Describe the procedure for handling incidents of this kind, and state whether the procedure was followed in this instance.
- Please state if personal data is being processed under UK GDPR or part 3 DPA 2018.
- If under UK GDPR, what Article 6 lawful basis did you use to disclose personal data?
- What was the purpose for the disclosure?
- Why was the disclosure necessary for this purpose?
- Please provide any further information you feel may be relevant to our assessment.
We ask that you provide responses to the above questions as soon as possible, and no later than 14 days from the date of this email.
I look forward to receiving your response. Please contact me on the number below if you have any queries concerning this process.
Yours sincerely,
David Hunt
Case Officer
Information Commissioner’s Gffice, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF T. 0330 414 6822 F. 01625 524510 ico.org.uk
03/03/2022
From DPO@sussex.police.uk
To ICO Casework
Subject CIM.T1.22 ICO Case reference: IC-108170-P1J8
Dear David
Thank for your letter in response to the complaint raised by [redacted] I have extracted the relevant
information to answer the questions below. Most of the responses have been directly lifted from the email exchanges (as attached), this is to validate the communications from the Collisions Unit to the data subject to re-enforce the current operational processes in place for such incidents.
- Describe the procedure for handling incidents of this kind, and state whether the procedure was followed in this instance.
- What was the purpose for the disclosure?
- Why was the disclosure necessary for this purpose?
Where an incident that falls under Section 170 of the Road Traffic Act 1988 occurs and one of the parties has refused to give their contact details for insurance purposes, the aggrieved party will contact the police to provide the necessary data from the DVLA records. The information shared is the minimum required as required by the legislation to allow civil proceedings to be established.
In this scenario, the aggrieved party used the information to confront the data subject, this is a crime and will be investigated as such. The information shared with the data subject by the Collisions Unit made the purpose for the processing dear to the data subject:
With regards to your enquiry about your personal details being given. Under section 170 of the Road Traffic Act 1988 it is a requirement that the names and addresses of the drivers involved in a damage only collision are exchanged.
Therefore you would have been required to do this at the scene although 1 understand from your explanation why this may not have been possible for you. As details were not exchanged and the collision was reported to ourselves by the other party, part of our role is to try to establish the details of the other driver.
Once these details have been established we are required under section 170 to pass these details onto both parties.
Should you be involved in a similar situation in the future and you are not able to exchange details at the scene then you should report the incident to the Police within 24 hours. Although you had stated that there was not a Road traffic accident or damage the other driver has reported the incident and advised that there is damage to their vehicle therefore section 170 applies and details are required to be exchanged
- Please state if personal data is being processed under UK GDPR or part 3 DPA 2018.
- If under UK GDPR, what Article 6 lawful basis did you use to disclose personal data?
Personal data was originally processed under the GDPR as processed by the DVLA. This was then further processed by the police for a law enforcement purpose. The initial processing by the DVLA would be Public Task as there is a requirement to process this data within their official functions. Due to the lawful requirement to make the disclosure under the Road Traffic Act, the information was further processed as it was compatible and necessary for the performance of a task carried out for that purpose by a competent authority. Under the data minimisation requirements, only the relevant and pertinent information was shared with the aggrieved party, this being sufficient to report the claim to their insurance company.
• Please provide any further information you feel may be relevant to our assessment.
Whilst appreciative that this was a traumatic incident for the data subject, this process was established to ensure incidents involving damage to vehicles where a driver refuses to give their details can be resolved through insurance companies. This is also an established and required process for all Police Forces in agreement with the DVLA.
Fortunately, this type of incident is an exception rather then the normal and any crimes committed against either party following the exchange of personal data will be fully investigated. Support will also be offered to the victims, as it was for [redacted].
If you require any further information then please do not hesitate to contact me.
Many thanks
Regards
Information Governance Supervisor
Force Deputy Data Protection Officer
Sussex Police Headquarters, Church Lane, Lewes, East Sussex, BN7 2DZ www.sussex.police.ukResponse