The greatest delay associated with addressing a vehicle theft claim is associated with acquiring a copy of the police report to corroborate events. Requests can take various forms:
- MoU – Memorandum of Understanding. An agreement between insurers and the police for disclose, launched in 2002 but which has seen changes that have led to further delays in some instances. Furthermore, the MoU only applies to Association of British Insurers (ABI) members i.e. it excludes some insurance companies – which appears inappropriate and has bene raised with the likes of West Midlands and Staffordshire police (to date without reply).
The MoU disclosure timeframe is ‘relaxed’ and on occasions, a constabulary will simply refuse to deal with request – due to staffing shortages. For example, Staffordshire police.
- Consent – possibly the simplest means to acquire a police report; the victim should ask for it or consent to another doing so
- SAR – Subject Access Request. The formal means by which a victim can seek a copy of their crime report and expect to be provided it within a calendar month i.e. my the request promptly!
- RoA – Right of Access. Another term for the SAR process – above
A victim can ask another to assist them to obtain the report by providing their consent. This is usually referred to as:
- TP SAR – Third Part SAR. A legitimate means by which to obtain a report BUT beware! Whilst a process that is lawful, appears to assist all by making request and disclosure straightforward and is workable (as evidenced by the procedure being adopted by a constabulary), some constabularies have aggressively resisted such approaches. The arguments being:
- ‘Not in the spirit of the Act‘ – an argument dismissed by the ICO
- Contrary to section 177 of the DPA – no it is not! Seemingly, the constabulary meant section 184:
Section 184 DPA – ‘enforced SAR’.
It appears incredible a specialist constabulary disclosure unit, presumably trained in DPA, addressing requests on a daily basis. could be ignorant of the law. Furthermore, that such law enforcement departments would leap to accusing a requestor of a criminal activity – section 184. That multiple constabularies have taken such a stance suggest they are acting, inappropriately, in concert.
- Is ignorance of the law (s.184) an excuse for the law or is the conduct the result of some wider, agreed-upon position to be adopted?
Section 184 has a two-part test. If one part is missing, NO offence is committed. The Law Is Not Complex – it is Binary – there appears to be disregard for simple legislation
Has the staggering simplicity of this eluded some constabularies – or have they ignored the requirements for their own ends?
Requesting a subject’s police report, with their consent, does NOT fall to section 184 DPA 2018.
- Previous ICO Decisions – ‘not requiring a relevant record‘
- SAR & Consent are appropriate gateways
- July 2025 ICO finding – NOT and offence and ‘disclose the information’
- Apology for a s.184 accusation
Recent developments (2025):
In late 2024, Essex police resisted disclosure of a police report citing s184. During a conversation with their Data protection Officer, they advised:
- the matter had already been raised raised with the ICO, Essex police had written to the ICO (though they subsequently said they had spoken with the ICO) because the matter had been raised nationally
- the subject had been raised within the National Police Chiefs’ Council. Essex referred this to the national team for national clarity. The NPCC were apparently considering the issue and Essex expected a response form them.
- others had attempted to use the TP SAR process
- they would send the schedule 18 link advising there was more to it (than we had conveyed)
However:
- an FoIA request of Essex police and the ICO revealed no information was held
- an FoIA request of Essex police and the NPCC revealed no information was held – though the NPCC held some related information – see below
- an FoIA request of Essex police for details of ‘the others’ revealed no information was held – they had not received approaches from others?
- the schedule 18 link was not sent. As per the ICO’s finding (07/2025) there was no more to schedule 18 that we had conveyed – s184’s ‘relevant records’ are restricted to criminal &/or health records. Neither had been requested indeed, both were excluded in the request!
The NPCC disclosure of 2025, eventually produced with the email domain names of those privy to exchanges, has resulted in further information being sought and, in some cases, supplied:
- Derbyshire police information disclosed – extract here.
- Lincolnshire police – request exceeds cost threshold (s.12 FoIA – cited) – clarification/reduction provided.
- Nottinghamshire police – information not held in a readily retrievable format (s.12 FoIA – costs – cited) – IR sought.
05/12/2023 – WMP noticed a significant (60%) increase in requests since the 06/2022 MoU. WMP:
- consider this may be due to changing the legal basis, removing the need for consent
- could not find anything to challenge why requests were made – reduced restrictions
- did not want to be a barrier for data sharing
- did not understand why insurers now needed 60% more:
- are insurers saving money as they can challenge claims based on police info’?
- are the ‘additional’ costs passed to consumers – increased premiums?
06/12/2023 – the issue was to be with ‘national’