You might from time to time receive requests for information from the police. Such requests can be made for a number of reasons, for example...
... a request for CCTV footage following an attempted break in, an altercation in the school car park or even a request made in relation to historic allegations concerning former staff and pupils.
Most requests are made by the police but we are increasing being asked to advise on requests made by other bodies such as HMRC, local authorities, and NHS trusts. Often they are investigating specific offences relevant to their functions, for example, a local authority wanting information about a parent in connection with alleged council tax fraud. In light of the financial squeeze driven by the coronavirus (COVID-19) pandemic, it is perhaps not surprising if these types of requests are becoming more common.
The Data Protection Act makes provision for organisations such as schools to assist the police in the prevention or detection of crime without breaching their own data protection obligations.
These provisions can also be relied on where the request has come from a government body other than the police. However, before sharing information (in particular where the request has not come from the police), a school should be satisfied that the body making the request has the necessary powers to do so and that those powers are relevant to the request being made. If in doubt, ask, as the organisation should be able to point to specific legislation giving them the powers to make the request.
Once you are happy that the body making the request has the necessary powers, then you can respond to the request as you would a request from the police. We have set out below some tips for dealing with requests from the police and other bodies:
- Verification: If in any doubt, schools are advised to carefully check the validity of any request by following up with the requesting organisation via a separate channel - for example, if they email you; telephone them via the main switchboard (using the number on their website) to find the named requesting person.
- Only disclose what is relevant: You must only disclose what is relevant. Any requests for "all the data" or "the whole file" on a person should be viewed with caution.
- Transparency: You might also want to check that you have covered off this type of sharing in your privacy notices.
- Lawful basis and conditions: Before sharing information, data protection compliance requires a school to have identified at least one lawful basis, and if 'special category' or criminal conviction data will be shared, a lawful condition as well. Often the requesting body will specify what these are but you should still check that the condition and/or basis that they have offered is applicable. For example, we sometimes see requests from the police which state that "vital interests" is the relevant legal basis. Vital interests is generally only relevant to 'life and death' emergencies and will not therefore be applicable in many cases.
There is no legal obligation to provide information unless and until the requesting body produce an appropriate court order. Therefore, a school is within its rights to refuse a request unless and until the court order is produced. However, most schools wish to cooperate.
Often the body making the request will set out the details using a standard form, and this should be requested if it has not been provided.
Occasionally, time will be a critical factor for the police or the investigating agency, particularly if the request pertains to safeguarding and/or if there is an immediate risk to individuals. In these circumstances, data protection rules still apply but plainly a school would not want to delay disclosure of information that is obviously relevant in an emergency situation.
Sometimes the police will produce a form that purports to count as consent to allow a school to share information with the police. Such forms are often used in relation to allegations of serious assault where victims are sometimes asked by the police to sign a consent form authorising disclosure. Schools should be very careful before disclosing information to the police in reliance on such forms. The ICO has an ongoing investigation into the police's practices here and has concerns about the validity of such consent forms. As the ICO has put it, "statements are often signed in the immediate aftermath and shock of the crime, and, we are told, victims can often be unclear as to what they are consenting to and why."
Originally published 08 July, 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.