A new Interim NPCC Third Party Material Request Form is being introduced from 4 October 2023, which will change the way organisations receive third party material requests from policing.
Historically, police forces have relied upon consent when requesting access to third party material, however the Information Commissioner explains that relying upon consent of the victim in justifying the processing of their data is unlikely to comply with data protection legislation. This is because there are difficulties in achieving freely given, valid consent from individuals in an investigation, for example due to a perceived power imbalance or trauma experienced by the individual.
The Information Commissioner set out a number of recommendations within his Opinion 2022 ‘Who’s under investigation’, one of which directed the NPCC to collaborate with partners to produce advice and supporting forms for police force when requesting personal information from third party organisations. The forms had to be consistent with the principles established in the 2022 ICO Opinion and give clear advice to third parties who will be in receipt of such requests, make clear whether the requests are voluntary or mandatory, explain the reason for seeking the information, and explain that information sought might end up being disclosed to a defendant.
The National Police Chief’s Council has therefore been working alongside the Home Office to create a new Interim NPCC Third-Party Material Request Form and associated guidance, following the direction of the ICO Opinion and the Attorney General’s Guidelines on Disclosure 2022. Rather than relying on consent, new requests from 4 October 2023 will be made as a reasonable line of enquiry under the Criminal Procedure and Investigations Act (CPIA) 1996.
Investigators are however required to work with and consult individuals so that their views and objections are sought and recorded, and these will be considered by investigators when balancing the public interest in obtaining the material against the consequential impact on the victims’ privacy.
The work undertaken to create this new form and guidance has been significant in order to ensure a product that is both compliant and fit for purpose. Extensive stakeholder consultation has taken place engaging:
- CPS
- Information Commissioner’s Office
- Attorney General’s Office
- Office of the Data Protection Officer
- Victims Groups
- Centre of Expertise on CSA
- Home Office Child Sexual Abuse Team
- Biometrics and Forensics Ethics Group
- Local Government
- Health Professionals
- Education Professionals
- Financial Professionals
This is an interim form as work is ongoing within the Home Office to introduce statutory requirements into the Victims and Prisoners Bill in respect of third-party material requests, for which a Code of Practice is also being drafted. Given the close working between the NPCC and Home Office, it is not anticipated that the final form will require significant amendments.
Third parties are obliged to consider the lawful basis for sharing information with the police. It is for you, the organisation, to determine the lawful basis but, in the context of a criminal investigation, this is likely to be Article 6(f) (“legitimate interests”). You may wish to refer to the ICO’s Legitimate Interests Assessment.
If you are still unsure, the following ICO toolkit provides guidance on whether data should be shared or not: Can I share personal data with a law enforcement authority, such as the police? | ICO
Further information and guidance can be found at:
- ICO data sharing information hub: https://ico.org.uk/for-organisations/data-sharing-information-hub/can-i-share-personal-data-with-a-law-enforcement-authority/
- ICO guidance on sharing personal data with law enforcement authorities: Sharing personal data with law enforcement authorities | ICO
Please find a copy of the new Interim NPCC TPM Request Form here.