Information Commissioner's Office
Blog: Supporting people accessing their data from the police
Blog posted by: Suzanne Gordon, Director of Data Protection Complaints and Compliance, 25 June 2019.
Anyone in the UK has the legal right to find out what information is held about them by organisations and ask for a copy free of charge within one calendar month. This is known as a subject access request (SAR).
Accessing personal data in this way has always been a cornerstone of data protection, strengthened last year by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA2018).
As people become more aware of their information rights, we recognise there has been a significant rise in SARs across all sectors, including to police forces and other law enforcement agencies. And we are also aware of the administrative impact of the increased workload on police forces in responding to these requests. But this should not come at a cost to people’s data rights.
Most recently, the ICO has been working with the Metropolitan Police Service (MPS) to address its large SARs backlog. However, in a recent report to us the MPS indicated it had more than 1,100 open requests – with nearly 680 over three months old, this is a cause for concern.
In short, the MPS has failed in its data protection obligations by not responding to SARs within a calendar month and we have issued two enforcement notices ordering the MPS to respond to all requests by September 2019.
We have also asked the MPS to make changes to its internal systems, procedures or policies, so that people are kept up to date on any delays that may affect their data protection rights and how the situation is being addressed.
The MPS has reported to us that they have a recovery plan in place, with senior officers committed to addressing the backlog over the next four months.
Ultimately, the public must be able to trust that police forces are upholding their information rights, and this case is a reminder to other police forces that we will take action against those organisations that do not comply with their SAR obligations.
Practical steps for responding to subject access requests
There are a number of practical steps that police forces can take to ensure they deal with SARs in line with the law. It is worth remembering that it is in Part 3 of the DPA2018 where police forces will find the rules surrounding the processing of data for law enforcement purposes.
- There is no requirement for a request to be in writing, so it is good practice for police forces to have a policy for recording details of all the requests received, including verbal requests.
- Requests can be responded to electronically (as long as it is secure) and paper copies can be provided only if you are asked to do so and it is reasonable.
- Requests need to be replied to within one calendar month. For practical purposes, we recommend that police forces adopt a 28-day period to ensure they respond to requests within the time limit.
- Police forces can ask for further information to establish the identity of a requester, particularly where sensitive data is involved. Such requests should be reasonable and proportionate. The calendar month time limit will start once you have received the necessary information.
- Although police forces must consider every request, you may limit the amount of information provided if, for example, it would prejudice an investigation or legal inquiry.
- Police forces should make the public aware of any delays which may affect their requests. They also need to explain how the situation is being addressed.
For more advice the right of access and how to respond, there is a full range of resources on the ICO website.
Suzanne Gordon is the Director of Data Protection Complaints and Compliance at the Information Commissioner’s Office.
Notes to Editors
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the General Data Protection Regulation (GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR) and Privacy and Electronic Communications Regulations 2003 (PECR).
- The General Data Protection Regulation (GDPR) is a data protection law which came into effect in the UK on 25 May 2018. Its provisions are included in the Data Protection Act 2018. The Act also includes measures related to wider data protection reforms in areas not covered by the GDPR, such as law enforcement and security.
- Since 25 May 2018, the ICO has the power to impose a civil monetary penalty (CMP) on a data controller of up to £17million (20m Euro) or 4% of global turnover.
- To report a concern to the ICO go to ico.org.uk/concerns.
Latest News from
Information Commissioner's Office
Data minimisation and privacy-preserving techniques in AI systems22/08/2019 12:20:00
Reuben Binns, our Research Fellow in Artificial Intelligence (AI), and Valeria Gallo, Technology Policy Adviser, discuss some of the techniques organisations can use to comply with data minimisation requirements when adopting AI systems.
Statement: Live facial recognition technology in King's Cross19/08/2019 15:25:00
Statement from Elizabeth Denham, Information Commissioner, on the use of live facial recognition technology in King's Cross, London.
Statement: Live facial recognition technology in Kings Cross16/08/2019 10:10:00
Statement from Elizabeth Denham, Information Commissioner, on the use of live facial recognition technology in Kings Cross, London.
Blog: Three top issues for town and parish councils15/08/2019 10:15:00
The advent of the GDPR in May 2018 brought new data protection obligations for many organisations. Some of this presented a challenge, particularly for smaller organisations like parish and town councils, who we saw were keen to demonstrate their compliance but needed support to achieve this.
ICO launches consultation on the draft framework code of practice for the use of personal data in political campaigning09/08/2019 14:20:00
The Information Commissioner's Office (ICO) is consulting on a new framework code of practice for the use of personal data in political campaigning.
Blog: Protecting children online: update on progress of ICO code07/08/2019 15:10:00
Blog posted by: Elizabeth Denham, Information Commissioner, 07 August 2019.
Fully automated decision making AI systems: the right to human intervention and other safeguards06/08/2019 10:25:00
Reuben Binns, our Research Fellow in Artificial Intelligence (AI), and Valeria Gallo, Technology Policy Adviser, discuss some of the key safeguards organisations should implement when using solely automated AI systems to make decisions with significant impacts on data subjects.
ICO joins international signatories in raising Libra data protection concerns05/08/2019 16:25:00
The Information Commissioner’s Office (ICO) has joined data protection authorities from around the world in calling for more openness about the proposed Libra digital currency and infrastructure.