What should we do if the police ask for information?

It is important to note that sharing personal data with law enforcement authorities is not prevented by the GDPR. We will run through what to do when a request comes in, but we really need to focus on 2 words: Necessary and proportionate. The police request should be both.

For example, I aided with a request, the police had asked for all records regarding two year 11 students about an incident that had happened that week. The school questioned this with the police why they would need their full school record if the incident in question took place that week, it was then agreed that the police actually only needed all documentation the school had about the incident.

Luckily the ICO has provided a useful checklist below that can be used when asked to share data with the police:

• We consider what the purpose is for sharing personal data with law enforcement authorities, and whether it is necessary and proportionate to do so.
• We identify a lawful basis under Article 6 of the UK GDPR before sharing personal data. If the sharing of personal data was not the original intention of the processing, we consider whether this new purpose is compatible with that original purpose.
• We also identify a condition for processing under Article 9 of the UK GDPR and any relevant condition in Schedule 1 of the DPA 2018 before sharing special category data.
• We identify a condition for processing under Article 10 of the UK GDPR and a relevant condition in Schedule 1 of the DPA 2018 before sharing criminal offence data.
• We record our lawful basis and, if relevant, our conditions for processing special category or criminal offence data.
• We only share the minimum necessary amount of relevant and adequate personal data.
• We ensure that the personal data is shared in compliance with our other data protection duties and obligations, including fairness, accuracy, and security.