‘Enforced’ Subject Access Request – an abuse?
Yet a constabulary provides disclosure options that include:
- Subject access request” under section 7 of the Data Protection Act 1998
- If you can provide the written consent of a person who has provided information to the police, we would normally agree to provide that information to you
Source
01/2025 – The NPCC Request:
I understand in 2024 you had exchanges with Essex police regarding access to police records, the disclosure of police crime reports (separate from the S170 RTA disclosure issues of 2023). Seemingly parties had been seeking access to Essex police records other than by use of the MoU, possibly due to it excluding many insurers. I understand Essex, having received disclosure approaches from various parties, referred this issue to the NPCC.
This is likely to have been raised in late 2024, Essex wished for clarity about the correct route for obtaining personal data related to insurance claims.
I am seeking the exchanges between the NPCC and constabularies about this issue and the related information you possess about:
- The consideration of ‘consent’ as a lawful means to obtain a police report,
- s.184 of the DPA, and
- The Mou guidance overriding or being more appropriate than a legislated Third-Party Subject Access Request.
The full response can be read here. In the main, the disclosure related to RTC reports. However:
- The issues of consent & SAR were touched upon:
- The matters are dated 2022 & 2023 – no information from 2024/2025 was disclosed.
This lack of recent information, in light of Essex Police statements in concerning. Additionally, neither the ICO nor Essex police themselves can find any information supporting the stated activity.
An extract from the disclosure appears below.
06/09/2022 @ 09:17
Road Traffic Collisions – information sharing with 3rd parties
For info, as discussed.
22/05/2023 @ 09:07
Road Traffic Collisions – data sharing issue for RoA
Can you help us please with some steer/advice.
Surrey raised an issue that since the new ABI-NPCC agreement (attached) they are getting an increase in RoA requests due to their compliance with the agreement in refusing requests from those who do not meet its expectations.
RoA – believed to be Right of Access – potentially Subject Access Requests (SAR) or ‘consent’.
It has prompted more discussion as this is work that has just been passed into my team and we have been working through the processes available, asking questions from other forces and many realising that their processes need reviewing.
We are all now concerned by doing such it will push requests to RoA.
So based upon this new ABI-NPCC we have worked out that requests fall as on the attached word doc (ABI-NPCC workflows), it is the requests in red/box 4 that are the ones we are all becoming a bit stuck on.
I have found a NPCC Disclosure policy (attached), which is not dated and no longer available on the College website & it alludes that the disclosures should be done but does not give a defined lawful basis.
Whilst we can charge the charges do not now cover the costs* to forces and certainly in Staffs we are looking at only do those disclosures that we have an obligation to do.
Any thoughts would be gratefully received as what none of us want to do is to refuse to do work that is not covered by the ABI-NPCC or by civil proceedings and then it results in being pushed to RoA.
I have copied below what is on the meeting notes as the query I originally received.
Hope all this makes sense but the general consensus is we could do with some NPCC help.
Note:
- Concerning the charges, a FoIA request (by way of comparison) allows for a maximum of 18hrs/£450 i.e. £25/hour. A police theft report, at £150+ therefore equates to 6 hours – yet the reports commonly contain little by way of investigation or third-party data to be redacted. £150+ for a vehicle theft report appears to be money for old rope!
14/06/2023 @ 10:18
Police Disclosure of Information – RTCs – exchange of personal details
In response/to let you all know the issues around the new insurance ABI pushing requests to Right of Access was raised at the last NSRG.
I sent the attached email to S40(2)in the meantime the attached letter was sent to all forces, not sure if it has reached you.
We are waiting for further assistance from NPCC. Here at Staffs we are not actually dealing with any insurance requests at the moment simply due to capacity and we are considering asking for a sign off from our DCC that we no longer do them at all, however we have to consider the risks around this.
13/07/2023 @ 08:09
Road Traffic Collisions – data sharing issue for RoA
Further to my below/attached we are experiencing significant issues at Staffs with the number of requests to the point that we have now put a stop all RTC requests due to capacity.
We are being quoted the attached (Road-collision-guidance-2016) which is on the College site but pre DPA 2018 and as you can imagine solicitors/insurers are being exceptionally demanding and Right of Access requests are now starting to trickle in.
Can NPCC give any clear steer to forces on this as I am still getting queries from others coming my way.
Many thanks in advance
13/07/2023 @ 11:29
Road Taffic Collisions – data sharing issues for RoA
The guidance referred to was originally written by the CPS and pretty much copied and pasted by the CoP, who I was told by coincidence today don’t know who authored it.
NPCC Roads Policing have stated that their intention is that the updated s170 RTA guidance (due in next few weeks) will rescind any previous guidance in this area including the CPS/CoP document which as you rightly point out is out of , and not really a CoP product anyway.
Regarding the initial query, my take is that the SAR route is inappropriate
a) because it does not necessarily result in the disclosure of all the data sought for all the reasons we know, and
b) it is effectively involves coercion.
S40(2)
the legal basis for disclosing surely is the same for members and non-members of the ABI?
I would advocate that forces accept non-ABI requests and fully recover their costs (even if they are above the ABI MOU ones), but that is a matter for forces.
Ideally, we would have a united NPCC position, but the continued lack of appetite for an NPCC lead in the civil disclosure/family court area leaves us in a messy predicament.
Ultimately apart from the RoA abuse this feels no longer a DP issue, but a co-ordination one.
It could be something that we could raise to the Data Board for a steer on whether ABI should continue their monopoly and the wider issue of no NPCC lead in this area.
I’d welcome others’ views on this
Note :
- An abuse?
- A sensible suggestion the MoU extends to all (though the current procedure requires a rethink).
- ‘Disclosure of all data sought’ is unlikely to be an issue for vehicle theft allegations
- ‘The reasons we all know’ refers to why exactly?
- ‘Coercion’ appears excessive, unsupported and questionable.
13/07/2023 @ 11:44
Road Traffic Collisions – Data Sharing issue for RoA
Not sure if this helps at all as I’m no expert in this area, but FYI just in case.
The NPCC Economic & Cyber Crime Portfolio lead on these types of disclosures at the moment. S40(2) is the DP lead for this as it sits with CoLP [City of London Police]. They drafted and led on the attached ABI guidance. I’ve also attached the guidance that Roads Policing developed as it may be relevant.
S40(2) has previously provided the below view re ABI vs non-ABI members as a non-ABI member had challenged this approach:
The basis for the ABI agreement is that they have a standards-based approach to membership. Therefore, we can be assured that members of the ABI maintain appropriate privacy and protection standards and have confidence in their management of the information we share.
Non-ABI members have to be considered on a case-by-case basis by each force as there is no consistency with third parties. There is a suggestion that we should mirror the ABI agreement for Lloyds members, this operates in a very similar way, and is perhaps the next logical extension of the agreement.
With so many brokers and independent insurance companies we are unlikely to find common ground surrounding the privacy and protection assurances that we require, we are therefore bound to continue considering these requests independently. Even with the ABI agreement in place Forces are still making voluntary disclosures under the act – the ABI agreement provides no explicit gateway, just a formal process with assurance
He has also provided steer a few times around ABI queries so I’ve attached my summary email for info. I also believe they’re looking at reviewing/updating the attached old Lloyds guidance as (like ABI) they have a more consistent standards-based approach to membership.
If it’s no relevant, obviously delete and ignore… J
Note:
- ‘Privacy & Protection’ – the above appears to be a negative stance. UK insurers, whether they are ABI members, Lloyd’s syndicates, or independent firms, are subject to a wide range of privacy, data protection, and confidentiality regulations. These rules ensure that personal data is handled lawfully, fairly, and securely, especially in sensitive contexts like claims handling, fraud investigation, and underwriting.
- In turn, they expect the same standards of those they instruct, often undertaking substantial due diligence enquiries
- Adjusters, for example, may work for ABI members and non-ABI members. Is it believed that they would apply a different procedure concerning data handling, subject to whether a client was not an ABI member?
- Read more about Insurers’ Privacy & Protection here.
05/05/2023 @ 15:49
Sharing collision data with members of the public
This afternoon I discussed the case with the NPCC Data Responsibility Lead S40(2) Our conclusion was we agreed with Weightman’s analysis.
By coincidence early today we both met a representative from the ICO and during a wide ranging catch-up we talked about the difficulties (in some circumstances) of using personal data obtained for law enforcement purposes for other purposes which fall under the UK GDPR. This scenario is a case in point.
S40(2) and I have therefore agreed that this would be a useful matter to discuss further with our ICO contact with a view to producing data protection advice on the disclosure issues covered in your case.
That advice may then be useful for any guidance your portfolio subsequently issues.
Can you advise whether you are content for us to share the Weightman’s analysis with the ICO as part of our planned work?
09/06/2023 @ 08:29
Police Disclosure of Information in relation to Section 170 Road Traffic Act 1988 (exchange of
personal details)
Attached, which has been offered to us by Beds, may be useful for our discussions later.
Regards
13/07/2023 @ 10:02
CoP Policy when dealing with disclosure of information held by the police to third parties in
Someone forwarded attached to me – assuming it is still current, do we need to reference it in the revised RP guidance?
Regards
Clarification has been sought about the above information disclosure – redaction of the email domains of those making the comments appears to be excessive.
Approaches have been made to:
- Surrey police
- The ICO