Challenging the ICO’s Reversal on Police Data Access – and Why Victims of Vehicle Theft Deserve Better
The ICO has unexpectedly reversed a decision it made in July 2025 (IC-356699-W0G6) about how victims of vehicle theft can obtain information from the police. This reversed position now supports Essex Police, despite:
- A previously clear ICO finding,
- An unresolved and baseless allegation a criminal offence was committed when making the request,
- Inconsistencies with the ICO’s own guidance, and
- A complete failure to consider the practical reality facing victims of car theft.
For years, I have helped victims obtain the crime information their insurer needs to progress a vehicle theft claim. Police investigations are often closed quickly, crime reports are basic, victims are left without a vehicle, without answers, and without the documentation they need.
In many forces, getting a simple (lacklustre) crime report is slow, obstructive, costly or not possible for an insurer or their representative – see ‘Police Report Disclosure – Inequality‘.
SARs (Subject Access Requests) give victims:
- a free route to their own data,
- a clear one-month legal deadline,
- a right to escalate delays, and
- a chance to move on with their lives.
The ICO previously agreed this was lawful. Essex Police disagreed.
Now the ICO has reversed its own decision – without addressing key facts. They have not explained why:
- A victim can make a SAR, but cannot choose a representative to help them;
- Third-party SARs are allowed in every other sector, but suddenly not in vehicle theft cases;
- Discretionary, fee-based police systems should override a victim’s legal rights;
- Or why Essex Police’s allegation that I committed a criminal offence has been ignored rather than addressed.
Assisting vulnerable victims, those who have had their cars stolen, their lives disrupted, and their finances damaged, face further delays because of administrative preferences or revenue-generating police disclosure schemes.
If the ICO ultimately decides SARs must be made directly by victims, then so be it – I will have done as much as is possible, more than any other to assist and will direct the victims of constabularies to the SAR process.
But I will not accept vague reasoning, inconsistent principles, or a lack of transparency. Victims deserve better and so do front-line officers who are tainted by back-office administration procedures that are archaic and due for an overhaul – the MoU refers to this, the deadline for the consdieration long past.
Police constabularies should not profit from what is arguably the hardship their own failures have caused.
The ICO must provide a clear, legally sound explanation – one that stands up to scrutiny.
Until then, I will continue to challenge decisions that harm victims and undermine public trust.
The ICO failed to comment on the misapplication of Section 184 DPA 2018:
- Essex Police referred to the criminal offence under s.184. DPS ‘enforced subject access’
- ICO previously ruled this was incorrect; the SAR excluded relevant records.
- The new decision fails to address or resolve this criminal allegation.
- This is procedurally unfair and irrational.
Associated information:
- 07/2025 ICO’s original finding
- 04/12/2025 ICO U-Turn
- 04/12/2025 response to ICO