Guide to data protection when providing information to the police

If the police ask you for information about a person, it is normal to think that you must disclose all the information you may have to them. However, it is important to ensure that you maintain the privacy of individuals and the protection of data, even when dealing with the police.

If the situation isn’t one of the following, then the police need to provide you with a standard form requesting the data and stating the reasons why it is required. 

Situations where a form is not required:

• When in an emergency situation and people are at significant risk of harm.
• If the information will help police in respect of public interest matters, such as serious crime or risk to individuals.
• When you are obliged to by law, for example identifying someone involved in terrorism or a road traffic accident. If the police claim that you have a statutory duty to provide the information, seek the details of the statute from the officer. 

If the situation is not one of the above the police must provide you with a form called the “Schedule 2 Part 1 Para. 2 Data Protection Act 2018 Exemption” (old s.29 DPA 1998 exemption). This form does not require you to provide the information – it is a request. You should read the form and ensure that the officer requesting the information is doing so to facilitate the prevention of, detection of, or prosecution of criminal offences.

The Schedule 2 form must be in writing, signed off by a senior officer, and provide the following:

• A clear description of the information being requested;
• Confirmation as to whether informing the individual about the disclosure would prejudice the investigation; and
• A clear statement that they are working within and satisfy all the Data Protection Act requirements.

Once you have provided any information you must document what information has been disclosed, when, and on what basis you provided the information. It is very important to also record whether you informed the person you provided information about.

The Information Commissioner’s Office (ICO) gives great guidance on the matter, stating “you must only share personal data that is limited to what is requested and what is reasonable” whilst also adding “data protection law enables you to share personal data with a law enforcement authority, as long as you can justify that it is necessary and proportionate.”