There appears to be a blanket refusal by UK police forces to accept consent-based Subject Access Requests (SARs) in relation to crime reports, typically under the Section 184 DPA 2018 “enforced subject access” provisions. This stance can be challenged both legally and logically, and there are more proportionate responses the police could adopt if their concerns were genuine.
Section 184 of the Data Protection Act 2018 makes it an offence to require an individual to make a subject access request and share the result as a condition of employment or services. However, the police interpretation is often extended too broadly, especially in contexts involving insurance claims or victim support.
Why the Police Position is Problematic:
- It overstates the risk of coercion
- S184 was never intended to prevent consensual access where the individual is acting in their own interest (e.g. to support an insurance claim, prove a crime occurred, or resolve a dispute).
- Asking someone if they want to submit a SAR is not inherently coercive, particularly if no penalty is imposed for refusal.
- It denies autonomy and undermines data rights
- The right of access under Article 15 of the UK GDPR is personal to the data subject.
- If an adult with capacity chooses to exercise this right to assist their own legal or insurance matter, they are acting voluntarily unless there’s clear evidence to the contrary.
- It discourages transparency and frustrates justice
- Victims or innocent parties may be trying to clarify what has been recorded about them. Denying them access frustrates their ability to correct errors, understand decisions, or seek redress.
- Victims or innocent parties may be trying to clarify what has been recorded about them. Denying them access frustrates their ability to correct errors, understand decisions, or seek redress.
- It contradicts other lawful data disclosures
- The same police forces often share data with other agencies under exemptions (like Schedule 2 Part 1 paras 2 or 5 of the DPA 2018).
- Yet when the subject themselves requests access, they face the most resistance.
What Police Could Do Instead:
- Assess each case individually.
If there’s no evidence of pressure or detriment from refusal, there’s no justification for a blanket refusal. - Offer a declaration of consent.
Where consent is alleged, ask the individual to sign a declaration stating they understand their rights and are choosing to make the request freely. - Provide redacted versions.
If the concern is about 3rd party data or sensitive info, redact appropriately — not block completely. - Use a safeguarding flag.
If there is suspicion of coercion (e.g. domestic abuse, trafficking), then it may be appropriate to pause and investigate — but only with justification, not as a rule.
Summary of Arguments Against the Blanket Position:
| Argument | Description |
|---|---|
| Legal Overreach | Blanket refusal goes beyond what S184 intends or requires |
| Undermines Rights | Prevents individuals from exercising lawful access to their own data |
| Assumes Coercion | Presumes bad faith in all requests, which is irrational |
| Blocks Justice | Hampers insurance claims, dispute resolution, and personal redress |
| Alternatives Exist | Options like consent declarations, redaction, or case-by-case reviews are reasonable |