Who's Under Investigation?
“Victims are being treated as suspects. Change is required.”
The Information Commissioner's Office recently published an Opinion, 'Who’s Under Investigation? The processing of victims’ personal data in rape and serious sexual offence investigations', which calls on the police, CPS and other prosecution agencies to overhaul their approach to the obtaining and retention of victim personal data.
The 5 key recommendations detailed in the Opinion are:
The National Police Chiefs’ Council should mandate that forces cease utilising forms purporting to obtain general consent from victims to the obtaining of 3rd party materials (Stafford statements).
The Crown Prosecution Service and other national prosecution agencies to make prosecutors aware of the Opinion.
The National Police Chiefs’ Council, the Crown Prosecution Service and other national prosecution agencies should produce advice, guidance and forms for police forces when requesting personal data from third party organisations.
Chief Constables & Commissioners must be able to demonstrate their compliance with Part 3 Data Protection Act 2018 (which governs law enforcement processing) when processing information relating to victims of rape and serious sexual offences.
Chief Constables & Commissioners must have in place appropriate policies and procedures to govern the management and retention of personal information relating to victims.
The Opinion has been published in the days following the publication of the Attorney General’s revised Guidelines on Disclosure, effective from 25 July 2022. These dictate that: there shouldn’t be an assumption in favour of the wholesale download of data from, or retention of, devices; where material contains personal data, pursuit of a reasonable line of enquiry must be justified by reference to questions of necessity and proportionality; requests for and access to third party material needs to be justified in context; and, records should be maintained detailing the approach and reasons for it. While these will go some way to meeting the requirement for the provision of guidance to police officers and prosecutors, the implementation of these recommendations will require not only that the National Police Chiefs’ Council works with forces to produce advice, guidance and template documentation, but that each Chief Constable and Commissioner as a data controller in their own right ensures that every officer and staff member engaged in this type of investigation has sufficient practical understanding of the requirements of the Data Protection Act 2018 and that they are able to apply its principles to their day to day decision making, which will require significant investment and time to deliver.
Responding to the Opinion, and perhaps indicating that the implementation of some of the Opinion’s recommendations may be delayed, it was reported that the Home Office announced that it will launch a public consultation on police requests for personal data, such as medical or education records.