GDPR and the police

[Bill8]

Quick GDPR question: An incident occurred outside of school which involved some of our students; this is about to reach court and the police have contacted us asking for the students' school reports and behaviour records. Am I right in thinking that they would need to obtain a court order before we can supply this information?

[localzuk]

That is a good question. The thought process as always is whether you as a school have a lawful basis for handing over that information. Without a court order/warrant, I'm not entirely sure you do. If the incident had happened in school, and it was part of the investigation into that incident then I suspect it may be different, but as it was out of school and the only link to you is that they go to your school, then I can't really fit the request in with any of the lawful basis' to hand it over - you probably don't have the consent of the parents or children, it isn't a contractual necessity, it isn't a legal obligation (as no warrant), it isn't a vital interest, at an extreme stretch you could say public interest (as justice is a public interest), and it isn't a legitimate interest of a school.

 

To be honest, this should be pushed to your school's DPO and legal support.

[elsiegee40]

That is a good question. The thought process as always is whether you as a school have a lawful basis for handing over that information. Without a court order/warrant, I'm not entirely sure you do. If the incident had happened in school, and it was part of the investigation into that incident then I suspect it may be different, but as it was out of school and the only link to you is that they go to your school, then I can't really fit the request in with any of the lawful basis' to hand it over - you probably don't have the consent of the parents or children, it isn't a contractual necessity, it isn't a legal obligation (as no warrant), it isn't a vital interest, at an extreme stretch you could say public interest (as justice is a public interest), and it isn't a legitimate interest of a school.

 

To be honest, this should be pushed to your school's DPO and legal support.

 

What he said!

[Pink_Panda]

I was always told that the police do not have an automatic right to information and that there is a form that needs to be filled in giving explanation why this information is being requested. But yes, this is something for your DPO.

[PotNoodleTech]

Yes here there is a form the Officer needs to fill in in full detailing what why where when and for how long etc they need data. The DPO deals with that I have not actualy seen the form. But you shouldn't automatically give out info just "because police" like we used to in the OLD days. GDPR changed that.

[Achandler]

They just need a lawful basis for the information, you should have a form they can fill in to request it. Then someone can judge whether or not they believe you should comply or not.

 

If for example a student has been repeatedly doing something in school, but has now done it on the street then it might show a pattern of behaviour that a court should rightly consider. So they have a lawful reason.

 

I wouldn't think they should need a full school report unless they are considering the character of the student for some reason.

[bald_pig]

If for example a student has been repeatedly doing something in school, but has now done it on the street then it might show a pattern of behaviour that a court should rightly consider. So they have a lawful reason.

 

That's not a lawful reason! They would still need a court order.

[Achandler]

public task – you do this to complete a task in the public interest

 

Said student is going to end up in court, they are being charged with something. Prosecutions are only brought on the basis of it being in the public interest to do so, so the CPS has decided this is within the public interest already.

 

They've asked through the police, as the CPS set them tasks often, to get the school report and behaviour records.

 

They haven't just rocked up and asking about random students. They'll be able to provide court references, crime references etc so the appropiate forms can be filled and the data provided.

 

 

If you want to argue that the CPS can't decide what is in the public interest then who does? Do you decide that it isn't in the public interest in your person opinion?

 

You could probably argue that you also have a legitimate interest to share the information, depending on exactly what has happened, as that student attends you school, who may well not do depending on the outcome of the case, however, this might be a little far-fetched.

[bald_pig]

public task – you do this to complete a task in the public interest

 

Said student is going to end up in court, they are being charged with something. Prosecutions are only brought on the basis of it being in the public interest to do so, so the CPS has decided this is within the public interest already.

 

They've asked through the police, as the CPS set them tasks often, to get the school report and behaviour records.

 

They haven't just rocked up and asking about random students. They'll be able to provide court references, crime references etc so the appropiate forms can be filled and the data provided.

 

 

If you want to argue that the CPS can't decide what is in the public interest then who does? Do you decide that it isn't in the public interest in your person opinion?

 

You could probably argue that you also have a legitimate interest to share the information, depending on exactly what has happened, as that student attends you school, who may well not do depending on the outcome of the case, however, this might be a little far-fetched.

 

For it to fall under Public Task, the data needs to be necessary. It's a fairly easy argument that those records are not necessary in a court case. Also, it's still up to the police to provide reasoning for the information, you don't just hand it over because they've asked for it.

[elsiegee40]

I disagree with public task. The police do not have an automatic right to access school records.

 

If they’re gathering evidence for court, they know they have procedures to follow

[synaesthesia]

Spin it around a bit. Say the school provides information upon request without doing so formally. Suppose information goes out to the police that isn't necessary in their interest and could actually harm the person/people involved. The school then have to answer for providing information without the necessary due diligence. School is then the one hauled up in front of ICO, not the police. If it's an urgent matter then it won't take long for them to obtain said warrant.

[Achandler]

I think, you have very limited understanding of the process from the other side. The fact that it is due in court, means it won't be the police requesting it will be the CPS. There is a difference.

 

If the CPS has requested the records, they will ask the police to collect them on their behalf. They will also provide the reasons as to why they want them. Noone is advocating handing over records without any checks being put in place, and recorded as to why it was or wasn't complied with. The request for the information should be treated like any other, you should have a form to fill, they should give you the reason why they need it. I would expect for this type of thing, they will even tell you which part of GDPR they believe you should release it under, if it is a request from the CPS. You use that as proof of due diligence if the ICO come after you. If they can't provide the information then send them away to get it all.

 

A formal request for information is not necessarily a court document. Why is everyone obsessed that we have to get a magistrate (who is just a layman) to say yes thats fine to make it formal. If someone makes a SAR, thats a formal document, FOI requests are as well.

 

Get your documentation sorted, often very lacking within schools, or if it does exist theres a mass panic when one is filled, it's like a hot potato. You have the necessary evidence to show due diligence if you release the information.

 

 

You are naturally ofcourse all allowed to disagree with me. Everyone knows that the law can be interepted in multiple ways, even if it is written with the aim for it not to be. I think there is a public task element, but I may have a more indepth experience as to the approach from the other side, I am also well aware that you will get police officers with no knowledge of why they have been asked to do something simply asking for things because they have been told to, if you tell them they need to provide these things before it can be released, then they'll often go and do that and come back with what you need.

 

But if you the approach taken by every organisation is that they want a court order for something that falls under a seperate area of the law then all that is going to happen is the courts will be filled with requests for warrants/ orders. Warrant are for essentially getting things against the person/ organisations wishes, the very fact school staff believe the police have no other means to access information except by being able to force a school to hand it over is a little absurd.

[localzuk]

public task – you do this to complete a task in the public interest

Said student is going to end up in court, they are being charged with something. Prosecutions are only brought on the basis of it being in the public interest to do so, so the CPS has decided this is within the public interest already.

They've asked through the police, as the CPS set them tasks often, to get the school report and behaviour records.

They haven't just rocked up and asking about random students. They'll be able to provide court references, crime references etc so the appropiate forms can be filled and the data provided.

If you want to argue that the CPS can't decide what is in the public interest then who does? Do you decide that it isn't in the public interest in your person opinion?

You could probably argue that you also have a legitimate interest to share the information, depending on exactly what has happened, as that student attends you school, who may well not do depending on the outcome of the case, however, this might be a little far-fetched.

 

Public task has to have something backing it up. A general "oh its a court case" isn't sufficient to support that determination. If something is required for a court case, then they must have a warrant to support it.

The test for public interest is that the data is being processed "in the exercise of official duty". Schools do not have an official duty to enforce the law or aid the justice system.

 

The people who decide if information must be handed to the police are those who issue warrants - that's the point of them.

 

You definitely could not argue that you have a legitimate interest! It is not in the legitimate interest of an educational institution to hand out information whenever there is a court case involving someone who happens to go to your school. Remember, this case does not directly involve the school - the incident happened outside school.

[localzuk]

I think, you have very limited understanding of the process from the other side. The fact that it is due in court, means it won't be the police requesting it will be the CPS. There is a difference.

If the CPS has requested the records, they will ask the police to collect them on their behalf. They will also provide the reasons as to why they want them. Noone is advocating handing over records without any checks being put in place, and recorded as to why it was or wasn't complied with. The request for the information should be treated like any other, you should have a form to fill, they should give you the reason why they need it. I would expect for this type of thing, they will even tell you which part of GDPR they believe you should release it under, if it is a request from the CPS. You use that as proof of due diligence if the ICO come after you. If they can't provide the information then send them away to get it all.

 

You seem quite keen on forms to fill in. Yes, there is one, its called a warrant request - and the police should be filling one in, obtaining a warrant, and then presenting that warrant to the school.

 

A formal request for information is not necessarily a court document. Why is everyone obsessed that we have to get a magistrate (who is just a layman) to say yes thats fine to make it formal. If someone makes a SAR, thats a formal document, FOI requests are as well.

 

The issue is that the data is NOTHING to do with the court, the police or anyone else. They do not have automatic right to just demand random private data from random organisations. That's why we have warrants, subpoenas and court orders. SAR is specifically written into primary legislation, so answering that is a legal obligation. Same with FOI. Random requests from the CPS or police are not.

 

But if you the approach taken by every organisation is that they want a court order for something that falls under a seperate area of the law then all that is going to happen is the courts will be filled with requests for warrants/ orders. Warrant are for essentially getting things against the person/ organisations wishes, the very fact school staff believe the police have no other means to access information except by being able to force a school to hand it over is a little absurd.

Data Protection law protects individuals and organisations from random requests for data. If something is legally required, then the legal system has mechanisms for getting that. Police rocking up and asking for information because someone goes to your school is not legally required. There's no legislation for it. So the school MUST look at why they would legally be able to handle it over. You have not provided adequate justification in my view.

[localzuk]

Put it this way - random police officer turns up and says "I want to see the school records of XYZ pupil please, its for a court case". What do you have to prove that the data is being requested for legitimate police purposes? You have nothing except them being a police officer.

 

That's why the police have procedures, the CPS do too, for getting information pertinent to a court case. The word of a police officer is just not enough to hand over personal data these days. It ensures that every stage of the process is legal and correct.

 

Another consideration - random police officer asks for this info, outside proper channels, it brings up the possibility that it can't actually be used as evidence because it didn't follow those rules.

[localzuk]

@GrumbleDook - any thoughts?

[localzuk]

Just to clarify also, when I say warrant - I am actually referring to a "PACE Production Order", which is issued by a judge.

[GrumbleDook]

GDPR changed that.

Nope, it worked teh same under DPA98

[Achandler]

I give up, clearly this is a pointless internet argument.

 

I have said multiple times they'd have all the information that you keep highlighting. There is an obsession with a random police officer turning up demanding things. I have repeatedly said that shouldn't happen. They should be coming prepared with all the documentation they should require to prove they need what they need, enough to satisfy your DPO they have a lawful reason for the information. If your DPO isn't happen then send them away to get a magistrate to authorise it. You have repeatedly ignored this.

 

You have mentioned subpeonas which are a US thing, they don't exist in the UK. Production Orders are Crown Court judges, not even magistrates. The seriousness of these requests is going up and up. We'll be needing a Law Lord soon.

 

 

Enjoy the world where you want Crown Court Judges to request information from everywhere because people are scared of GDPR. I provided the justification, I clarified multiple times that they should have all the information with them to satisfy your DPO. The only response from anyone is that you will refuse no matter what they bring, unless it is a warrant to seize the information or an order to force you to provide the information.

[PotNoodleTech]

I give up, clearly this is a pointless internet argument.

 

I have said multiple times they'd have all the information that you keep highlighting. There is an obsession with a random police officer turning up demanding things. I have repeatedly said that shouldn't happen. They should be coming prepared with all the documentation they should require to prove they need what they need, enough to satisfy your DPO they have a lawful reason for the information. If your DPO isn't happen then send them away to get a magistrate to authorise it. You have repeatedly ignored this.

 

You have mentioned subpeonas which are a US thing, they don't exist in the UK. Production Orders are Crown Court judges, not even magistrates. The seriousness of these requests is going up and up. We'll be needing a Law Lord soon.

 

 

Enjoy the world where you want Crown Court Judges to request information from everywhere because people are scared of GDPR. I provided the justification, I clarified multiple times that they should have all the information with them to satisfy your DPO. The only response from anyone is that you will refuse no matter what they bring, unless it is a warrant to seize the information or an order to force you to provide the information.

 

Why get all agro? These things do happen, we've had an officer ask for the names and addresses of an entire year group. You say it shouldn't happen, and we all agree, it shouldn't, but it did and does.

Edited June 28, 2019 by PotNoodleTech

[localzuk]

I would hate to live in your world @Achandler, where police officers can act on a whim to demand private information from only tangentially related organisations without any court orders. Use of terms like warrant, subpoena, court order are all laymans terms that most people understand. Naming them by their specific names is often unnecessary when getting across the general point - a court has to be involved to demand information from organisations.

 

I'll give you an example policy put in place by JISC (as an ISP they get a bunch of requests) - https://www.jisc.ac.uk/guides/networking-computers-and-the-law/disclosure-of-information-to-law-enforcement. One is mandatory - ie. PACE Production Order, and one is a determination by the organisation (via Schedule 2 Part 1 Section 2(1), but it is not compulsory. In this specific case, an incident involving someone who happens to go to the school having data requested about them from educational behaviour records and school reports just screams "what?!".

 

This is why my original point was - pass this to your DPO and legal team. Let them make that determination, as it wasn't described as a mandatory demand in the OP.

Edited June 28, 2019 by localzuk

[bald_pig]

I give up, clearly this is a pointless internet argument.

 

I have said multiple times they'd have all the information that you keep highlighting. There is an obsession with a random police officer turning up demanding things. I have repeatedly said that shouldn't happen. They should be coming prepared with all the documentation they should require to prove they need what they need, enough to satisfy your DPO they have a lawful reason for the information. If your DPO isn't happen then send them away to get a magistrate to authorise it. You have repeatedly ignored this.

 

You have mentioned subpeonas which are a US thing, they don't exist in the UK. Production Orders are Crown Court judges, not even magistrates. The seriousness of these requests is going up and up. We'll be needing a Law Lord soon.

 

 

Enjoy the world where you want Crown Court Judges to request information from everywhere because people are scared of GDPR. I provided the justification, I clarified multiple times that they should have all the information with them to satisfy your DPO. The only response from anyone is that you will refuse no matter what they bring, unless it is a warrant to seize the information or an order to force you to provide the information.

 

No arguing from me, and certainly not pointless. When we're talking about people's rights and european law, we need to be as clear and precise as possible.

 

When you muddle your information, not read other people's posts properly, and make a joke out of procedure, you're not helping anyone.

 

Nobody has said they will refuse no matter what.

[PotNoodleTech]

Nope, it worked teh same under DPA98

 

True, technically and legally.

 

But I think the difference is not all [very few?] schools were trained up and aware of our exact responsibilities under DPA98, wheras GDPR has brought data protection right into a tight focus. We all now know not to give someone cart Blanche access to data, 10 to 20 years ago the Officer of the Law probably never got told no when asking for data and never had to fill any forms or requests in either.

 

I mean GDPR has spawned an entire new data protection industry, companies that for example employ full time staff to sell training and advice to schools. These companies and that training and advice simply did not exist 10 years ago.

[GrumbleDook]

There were companies doing this 10 years ago ... and they worked with LAs or Govt groups to deal with this ... that’s why Becta gave out advice 10 years ago.

Compliance has been a growing sector for some time.

 

And police officers have always been told to justify their requests where I have worked ... but I am aware that this has not been the standard position for many schools even now!

 

I think the message in all this has become a bit warped in the conversation.

 

The police requesting the information (i.e. ad-hoc data sharing) will have a purpose. They will have legislation to support this (as already mentioned) giving it a lawful basis.

 

When the request for information comes in they should explain this.

When the request comes in the school should consider whether they should agree to it.

 

They also have to consider how long they will take to complete it.

There may be safeguarding issues (get it done immediately) or it may be part of a longer request.

 

Police are used to filling in forms. They won’t object. If in doubt speak to your DPO. If there is an issue speak to *their* DPO.

[rom1984]

Not my area of expertise but I believe the old DPA 98 had a Section 29 excemption and DPA 2018 does too in Schedule 2 (Exemptions etc from the GDPR) that I think would be applicable here.

 

The exemptions allow a data controller, amongst other things, to;

 

Withhold information or tell individuals how their data is being processed, or,

 

Disclose personal data without applying the usual data protection principles, if,

 

The purpose of applying the exemption was for the prevention or detection of crime, or the apprehension or prosecution of offenders.

 

It is for the data controller making the disclose who is responsible for deciding whether the exemption applies in each case and not the person making the request.

 

The ICO usually champions police forces to use standard forms detailing the reason why disclose is necessary, this then creates a clear audit trail that the data controller can use to demonstrate why they applied the exemption. If a police officer verbally requests information, you can make a pro-active disclose there and then, but it would normally be more appropriate that the police office puts it in writing usiong their own forces template (unless of course there is an immediate threat)

 

The form should usually explain why the specific information is required and you can request a more senior police officer to sign it off.

 

The school can then risk asses the information and decide if they want to apply the exemption. There is no requirement that you must disclose, it is up to the data controller. You may decide to disclose all, part or none. If you are still concerned the disclosure would breach the DPA then you can ask them to obtain a court order.

Edited July 1, 2019 by rom1984