Data Protection Policy - Police Disclosures
These guidelines are intended to cover situations where the University receives requests from agencies connected with law enforcement for personal data about students, staff or other individuals whose information is held by the University. Usually, such requests will come from the police. However, other government agencies may also request data for law enforcement purposes, such as the Department for Work and Pensions, local authorities, HM Customs and Revenue and the Border and Immigration Agency.
Personal data held by the University have to be managed in accordance with the GDPR. In general, care should be taken to ensure that any disclosure meets the conditions for "fair and lawful" processing.
However, Data Protection legislation includes exemptions which allow personal data to be disclosed to law enforcement agencies without the consent of the individual who is the subject of the data, and regardless of the purpose for which the data were originally gathered. In particular, personal data may be released if:
- The information is required for safeguarding national security; or
- Failure to provide the data would prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of any tax or duty.
Before we release data to a law enforcement agency, we need to ensure that the information is being provided to a genuine and properly authorised investigation. If we are not satisfied that there are valid grounds for releasing the information, the GDPR does not oblige us to do so. However, if we refuse to release the information, law enforcement agencies may obtain a court order requiring us to provide it.
It is the University's policy to give reasonable assistance to the enquiries of Police Officers in connection with their duties. Police enquiries should normally be referred to the Data Protection Officer. It is normal practise for Police Officers to provide an official request (preferably on an official Data Protection Request Form) for specific information. The form should certify that the information is required for an investigation concerning national security, the prevention or detection of crime, or the apprehension or prosecution of offenders, and that the investigation would be prejudiced by a failure to disclose the information. This provides us with a legal basis for supplying the information. The request must be authorised by an Inspector or above. The information provided to the Police must be relevant to the investigation and not excessive. Personal data which are necessary for a legitimate investigation will normally be released.
Other law enforcement agencies may not use standard forms. However, any request should:
- Be in writing, on headed paper, and signed by an officer of the agency.
- Describe the nature of the information which is required.
- Describe the nature of the investigation (e.g. citing any relevant statutory authority to obtain the information).
- Certify that the information is necessary for the investigation.
If a properly completed form or letter is received, the data should normally be disclosed. However, remember that we can (and should) refuse to provide the information if we have reason to doubt that the request is genuine.
Copies of the form or letter used to request personal data, other correspondence with the law enforcement agency and a copy of any data released should be retained by the University for 6 years.
Questions or issues relating to written requests from law enforcement agencies should be directed to the Information Compliance Officer.
In the urgent and exceptional cases (i.e. cases where there are reasonable grounds for believing that an individual has become a danger to him/herself or others, or has committed/ is about to commit a crime) this may not be possible. In these cases, having established the identity of the Police officer, the person handling the enquiry may release the data directly, adhering to the following:
(a) If the enquirer is a Police Officer whose identity you have confirmed, and there are urgent reasons for releasing the data (‘life or death’ situations) then you may release the information
(b) Take a note of all the details (the student in question, the Police Officer's identity and contact details; the information requested; the reason given; and exactly what information was provided) and copy this (marked 'confidential’) to the Information Compliance Officer (FOI/DP). Chase up the relevant request form after the ‘emergency’, to keep a record on file.