Open consultation

Requests for Victim Information: Draft Code of Practice

Published 8 April 2025

Preamble

1. This code of practice relates to the introduction of a new statutory duty in Chapter 3A of the Police, Crime Sentencing and Courts Act 2022 (as amended by the Victims and Prisoners Act 2024) referred to as “the Act” in this code. It should be read alongside the explanatory notes for Chapter 3A. This code of practice is issued pursuant to section 44D of the Act, which provides that the Secretary of State must prepare a code of practice for authorised persons about victim information requests and compliance with Chapter 3A.

2. The code will ensure a greater understanding of the duties set out in sections 44A-44C of the Act. Compliance with these duties will support the overall aims of maintaining and improving the trust and confidence of the public in policing.

3. This code applies to all authorised persons named in section 44E of the Act. It is a publicly available document and should be readily accessible by any authorised persons who may wish to review it ^{[footnote 1]}.

Part 1: Introduction

4. This code of practice provides practical guidance to authorised persons on complying with the duties set out in Chapter 3A of the Act ^{[footnote 2]}.

5. The code specifies what constitutes a necessary and proportionate ‘Victim Information Request’ (VIR), the circumstances in which the duties set out in sections 44A-44C of the Act apply, and best practice for giving notice to victims and third parties. This will assist in ensuring that authorities exercise their functions in accordance with the law and protect the privacy of those whose information is being requested. The code also sets out when “counselling information requests” will be necessary and proportionate, as required by section 44D(2) of the Act.

6. This code will refer to a ‘Victim Information Request’ as a ‘Third Party Material (TPM) request’, as this term is more commonly known operationally.  In the context of this code of practice, “a TPM request” will refer to requests for material relating to a victim of crime held by a third party. (See paragraph 15 for a definition).

7. The authorised persons listed in paragraph 17 and 18 of this code must have regard to the code when making a TPM request to ensure they are complying with the duties.

8. The code will provide support for authorised persons when engaging with the CPS on a TPM request. It also outlines considerations to make when working with vulnerable victims and specific considerations to be made when making counselling information requests.

9. Whilst the code provides an overview of the existing legal framework, it will not provide specific detail about the application of these laws and should be read in conjunction with the guidance listed in Part 3 of this code. This code does not supersede or replace guidance/codes that accompany other pieces of legislation and only aims to clarify the application of the duties in section 44A-44C of the Act.

10. The duties set out in this code do not include the powers granted by Chapter 3 of the Act relating to the extraction of information from electronic devices. The code of practice ^{[footnote 3]} regarding these powers should be consulted where you are seeking information relating to extraction by law enforcement from an individual’s mobile phone or other digital device.

Victim information requests: Key terms

11. Section (1) of the Victims and Prisoners Act 2024 ^{[footnote 4]} defines a “victim” as a person who has suffered harm as a direct result of:

(a) being subjected to criminal conduct, or

(b) one or more of the circumstances mentioned in subsection (2) of that Act

12. “Criminal conduct” is conduct which constitutes an offence (section 1(4)(a) of that Act). Section 1(2) sets out additional circumstances where a person may be a victim, such as where the person has directly experienced the effects of criminal conduct at the time the conduct occurred.

13. For the purposes of the test of the necessity and proportionality to achieve the purpose of preventing, detecting, investigating or prosecuting crime, “crime” is a reference to―

(a) conduct which constitutes one or more criminal offences in England and Wales, or

(b) conduct which, if it took place in England and Wales, would constitute one or more criminal offences (section 44A(6) of the Act)

14. A Victim Information Request (VIR) is defined as “a request by an authorised person to another person to provide information which relates to a third person who the authorised person has reason to believe is or may be a victim or at risk of being, a victim” (section 44A(2) of the Act)

15. This information is commonly referred to as Third Party Material (TPM) which is defined in the Attorney General’s Disclosure Guidelines as “…material held by a person, organisation, or government department other than the investigator and prosecutor, either within the UK or outside the UK. Third parties are not directly involved in the case in question but may hold information relevant to it” ^{[footnote 5]}.

16. In criminal investigations, TPM often includes records with an expectation of privacy due to their personal nature, such as medical, education, and social service records, that are held by a third party.

Who are the duties applicable to?

17. The duties set out under sections 44A-44C of the Act apply to the following authorised persons in England and Wales (and to the service police in the whole of the UK) when making a TPM request about a victim in the context of the prevention, detection, investigation, or prosecution of crimes, as specified in section 44E of the Act ^{[footnote 6]}:

(a) a constable of a police force in England and Wales

(b) a member of staff appointed by the Chief Officer of Police of a police force in England and Wales

(c) an employee of the Common Council of the City of London who is under the direction and control of a chief officer of police

(d) a constable of the British Transport Police Force

(e) an employee of the British Transport Police Authority appointed under section 27 of the Railways and Transport Safety Act 2003

(f) a constable of the Ministry of Defence Police

(g) a National Crime Agency officer

(h) a person designated by the Director General of the Independent Office for Police Conduct under paragraph 19(2) of Schedule 3 to the Police Reform Act 2002

(i) a person who has been engaged to provide services consisting of or including the obtaining of information for the purposes of the exercise of functions by a person mentioned in any of the paragraphs (a) to (i)

18. Section 44F provides that a member of the Royal Navy Police, the Royal Military Police or the Royal Air Force police (collectively referred to in this code as ‘service police’),  any person designated by the Service Police Complaints Commissioner (SPCC)  under regulation 36(2) of the Service Police (Complaints) Regulations 2023 ^{[footnote 7]} and any person who has been engaged to provide services consisting of or including the obtaining of information for the purposes of the service police or SPCC’s functions  must also comply with the new duties when making a request for information about a victim for the purpose of preventing, detecting, investing, or prosecuting crimes. With regard to these bodies, the duties extend and apply in the whole of the UK.

19. The Secretary of State has the power to amend this list by regulations made by statutory instrument so as to add, remove or modify a reference to a person.

Part 2: Purpose of these duties

20. Section 44A of the Act sets out that TPM requests about a victim may only be made when authorised persons:

(a) 44A(3)(a) have reason to believe that the person to whom the request is made holds the information sought

(b) 44A(3)(b) have reason to believe that the information sought is relevant to a reasonable line of enquiry in the case (as per the Attorney General’s Guidelines on Disclosure 2022) ^{[footnote 8]}

(c) 44A(3)(c) are satisfied that the request is necessary and proportionate to achieve the purpose of preventing, detecting, investigating, or prosecuting crimes. A necessary and proportionate request ensures that the victim’s right to privacy is balanced with the defendant’s right to a fair trial

(d) 44A(4)Where the request relates to a victim’s counselling information,  the authorised person must, additionally, have reason to believe that the information sought is likely to have substantial probative value to a reasonable line of enquiry. This test does not apply to other forms of TPM

21. The authorised person must, to be satisfied that the request is proportionate, be satisfied that:

(a) there are no other means of obtaining the information sought (section 44A(8)(a)), or

(b) there are such other means, but it is not reasonably practicable to use them (section 44A(8)(b).

Please refer to Part 4, “Necessity and Proportionality”, for further guidance on this duty and “Counselling Information Requests” for guidance on the specific process to be followed when making requests for counselling records about a victim.

22. Section 44B of the Act ensures that the victim about whom the TPM request is made is adequately informed that the request is being made, unless inappropriate to do so. For example, it may be inappropriate to notify a victim if to do so would prejudice the investigation (in which case the reason should be recorded for future proofing purposes, such as audits, complaints or FOI requests).

23. Victims should be notified of what information is being sought, why it is being sought, and how the information will be dealt with. Notice must be given in writing. Notice must be given on or before the date on which the victim information request is made. If that is not reasonably practicable, as soon as is reasonably practicable after that date.

24. Section 44C of the Act sets out that requests made to third parties who hold TPM about a victim must be made in writing; and specify the information sought, the reasons for seeking the information and how the information will be dealt with once obtained (unless it would be inappropriate to do so).

25. These duties do not supersede or change existing legislation, as set out in Part 3 of this code, regarding TPM requests in general, but aim to codify and clarify existing expectations, and establish clear and consistent best practice for authorised persons when making a TPM request about a victim.

Legal impact of these duties, and effect of the code

26. In making a TPM request about a victim or deciding whether to make such a request (including in giving notice under section 44B or deciding whether to give such notice) an authorised person must have regard to the code of practice for the time being in force (section 44A(9)).

27. This Code expands upon the policy underpinning the legislative provisions. The contents of the Code are not legally binding though, as set out above, the Act requires authorised persons to have regard to the Code. The Code does not of itself impose additional legal obligations, nor is it an authoritative statement of the law.

28. A failure on the part of authorised persons to act in accordance with the code does not of itself render the person liable to any criminal or civil proceedings. However, the code is admissible in evidence in criminal or civil proceedings and a court may consider a failure to act in accordance with the code, including in determining the admissibility of the evidence obtained in the proceedings as specified in section 44D of the Act.

29. Any failure to comply with the duty or follow this code is likely to have serious negative consequences for the victims whether resulting in unnecessary requests of personal information, or by the sharing of information.

30. Authorised persons should act in accordance with any guidance such as codes of conduct or ethics issued by their organisation. Where the authorised person is a police officer or member of police staff the following may apply: 

• In England and Wales – Failure to follow the code and use the powers lawfully could result in a breach of the College of Policing Code of Ethics ^{[footnote 9]}, for example the second standard to use powers and authority lawfully and proportionately and in a way which will respect the rights of all individuals.

31. Chapter 3A of the Act does not create new powers to obtain or share TPM either for the authorised persons who may request the data or the third party who shares data in response to such a request. Rather, it imposes statutory restrictions and procedural safeguards around the use of existing powers to make requests by authorised persons. Those requesting and sharing data will require the legal powers to do so.     

Part 3: Existing legislative framework and guidance

32. TPM can be requested by the police at any stage during an investigation. The police have recognised broad common law powers to carry out their duty of detecting and investigating crime, including seeking access to information and disclosing information in support of their policing purposes ^{[footnote 10]}. As a result, most requests to third parties for material in the first instance rely on these powers.

33. A third party is typically under no obligation to provide access to material, but most will seek to cooperate where possible. If the third party refuses to provide the material requested, the authorised persons specified in Part 1 of this code could seek to take other steps to obtain the information. For example, authorised persons may obtain a court order or seek a witness summons as a last resort.

34. In some instances, the Crown Prosecution Service (“CPS”) or the Defence (in any criminal proceedings) may seek TPM regarding a victim ^{[footnote 11]}. These requests are still made via the authorised person. It is therefore the responsibility of the authorised person to ensure that there is lawful basis for these requests. Authorised persons can refer to their local police force procedures for further information on requests originating from CPS and Defence.

35. Sections 44A-44C of the Act must be complied with alongside other legal obligations and duties, including the following:

(a) Human Rights Act 1998 (HRA) and European Convention on Human Rights (ECHR)

(b) The Criminal Procedure and Investigations Act 1996 and the code of practice

(c) Data Protection Act 2018 (DPA) and UK GDPR

(d) The Equality Act 2010

36. Authorised persons should consider the responsibilities for disclosure of any TPM obtained that may arise and should be familiar with the following guidance:

(a) The Attorney General’s Guidelines on Disclosure

(b) Crown Prosecution Service (CPS) Pre-Trial Therapy Guidance

(c) The Victims’ Code

Human Rights Act 1998 (HRA) and European Convention on Human Rights (ECHR)

37. The HRA ^{[footnote 12]} gives effect in UK law to the rights set out in the ECHR. Section 6 of The HRA makes it unlawful for any public authority to act in a way which is incompatible with a Convention right.

38. Article 8 of the ECHR sets out the right to respect for their private and family life, home, and correspondence. It provides that there shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society. This includes, among other things, where interference is necessary for the prevention of disorder or crime and for the protection of the rights and freedoms of others ^{[footnote 13]}.

39. Authorised persons must carefully consider:

(a) whether the TPM request will amount to an interference with the exercise of a person’s rights under Article 8, and

(b) if so, whether that interference is justifiable (with consideration of the test set out in Article 8 and summarised above).

40. TPM, such as medical records and social service records, are likely to contain sensitive information about the individual. Authorised persons should consider the impact of intrusion into the private life of the victim at all points in the decision-making process – when determining what information is needed to support a reasonable line of enquiry (where applicable), and in determining if the request is necessary, proportionate and that there are no other, less intrusive, means of accessing the required information.

41. When considering Article 8 the authorised person must also consider compliance with other Convention rights, including Article 6 of the ECHR. Article 6 of the ECHR sets out the fundamental right of the accused to a fair trial. It is necessary for authorised persons to consider how the information sought (or a decision not to seek such information) may impact on that right. The Attorney General’s Office has produced guidance on the balance between Article 8 and Article 6 Rights ^{[footnote 14]}.

The Criminal Procedure and Investigations Act 1996 (CPIA)

42. The CPIA and its’ code of practice ^{[footnote 15]} contain provisions designed to ensure that where a criminal investigation is conducted, all reasonable steps are taken for the purposes of the investigation. The CPIA code makes clear that when conducting an investigation, the investigator should pursue all reasonable lines of inquiry, whether these point towards or away from a suspect. This could include obtaining TPM relevant to the investigation. What is reasonable in each case will depend on the particular circumstances.

43. The CPIA code of practice sets out the manner in which police officers are to record, retain and reveal to the prosecutor material obtained in criminal investigation and which may be relevant to the investigation and related matters.

44. The CPIA is designed to ensure that every accused person has the right to a fair trial. It ensures the rights of each party within the investigation and ensures all involved in the investigation have the right to fair disclosure. Part 1 of the CPIA 1996 is concerned with the duties of disclosure on the prosecutor and the accused in criminal proceedings. This is designed to ensure that there is fair disclosure of material to the accused which may be relevant to an investigation, and which does not form part of the prosecution case. In some instances, this may be the basis for the law enforcement request for information. ^{[footnote 16]}

45. The judgment in Alibhai & Ors, v. R [2004] EWCA Crim 681 ^{[footnote 17]} sets out that there is no absolute obligation to obtain information relating to victims that are held by third parties and there must be a “margin of consideration” as to what is required in each specific case. A request for TPM may not always be necessary or appropriate.

46. The Procedure and Investigations Act 1996 (Armed Forces) Order 2009 which applies to service police (the Royal Navy Police, the Royal Military Police or the Royal Air Force Police) permits the Secretary of State by order to make provision which are equivalent to those in Part 1 of the Criminal Procedure and Investigation Act 1996.

Data Protection Act 2018 (DPA)

47. Part 3 of the DPA[[18]] ^{[footnote 18]} governs the processing ^{[footnote 19]} of personal data by competent authorities (including the police) for law enforcement purposes i.e. the prevention, investigation, detection or prosecution of criminal offence or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. As a result, all requests by the police for TPM must be processed in compliance with Part 3 of the DPA.

48. Section 3 of the DPA defines “processing” in relation to information, as meaning “any operation or set of operations which is performed on personal data or on sets of personal data such as collection, recording, organisation structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.

49. Any processing information handled in accordance with the DPA 2018 must ensure that any information which has been received from a third party is minimised and that only the data that is needed for the purpose it is being requested is retained.

50. Authorised persons named in section 44E of the Act should consider if they need to complete or update an existing Data Protection Impact Assessment.

Data processing for law enforcement purposes

General overview of DPA responsibilities

51. Part 3, Chapter 2 of the DPA outlines six data protection principles which must be complied with when processing data for law enforcement purposes, summarised below:

1. The processing of personal data for any of the law enforcement purposes must be lawful and fair.

2. The law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.

3. Personal data processed for any of the law enforcement purposes must be adequate, relevant, and not excessive in relation to the purpose for which it is processed.

4. Personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased, or rectified without delay.

5. Personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.

6. Personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).

52. Once the information requested under section 44A(3) of the Act for the purpose of  preventing, detecting, investigating or prosecuting crime, has been received, the authorised person must comply with Part 3 of the DPA when processing this information.

53. Data protection principles 1 and 3 are of particular relevance to TPM requests:

(a) processing must be lawful and fair

(b) personal data processed for any of the law enforcement purposes must be adequate, relevant, and not excessive in relation to the purpose for which it is processed

54. The Information Commissioner’s Opinion ^{[footnote 20]} explains that relying upon a victim’s ‘consent’ in justifying the processing of their data is unlikely to comply with data protection legislation. Because of the perceived power imbalance between the police and a victim, it is unlikely the high threshold of fully informed and freely given consent can be achieved. Hence, the most appropriate approach is to rely on a non-consent lawful basis.

55. In line with the Data Protection Principles ^{[footnote 21]} authorised persons must ensure that the personal data they are processing:

(i) is adequate to properly fulfil their stated purpose

(ii) has a rational link to that purpose; and

(iii) is limited to what is necessary

This will need to be considered when requesting, processing, and retaining data alongside the Management of Police Information (MOPI) code of practice ^{[footnote 22]}.

56. Under section 35 of the DPA, special conditions apply when processing for law enforcement purposes is ‘sensitive processing’ ^{[footnote 23]}. ‘Sensitive processing’ means:

• the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership

• the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual

• the processing of data concerning health

• the processing of data concerning an individual’s sex life or sexual orientation

57. For ‘sensitive processing’ for law enforcement purposes, the authorised person must be able to demonstrate that the processing is ‘strictly necessary’ and that you can satisfy one of the conditions in Schedule 8 ^{[footnote 24]} of the DPA (statutory purposes for reasons of substantial public interest, administration of justice, protecting individual’s vital interests, safeguarding of children and individuals at risk, personal data already in public domain, legal claims, judicial acts, preventing fraud, archiving etc). This type of data needs to be treated with extra care, as collecting it is more likely to interfere with the fundamental rights of an individual or open them up to discrimination ^{[footnote 25]}. Whether the processing of sensitive information is “strictly necessary” will depend upon the facts of each case.

58. The Information Commissioner can investigate and/or take enforcement action if they are alerted of a data breach. The Information Commissioner may use measures such as targeted audits and assessments of individual forces to combat concerns over failure to comply.

59. This code does not provide a full analysis of all aspects of applicable data protection obligations. Authorised persons should refer to the ICO guidelines ^{[footnote 26]} and their own guidance on responsibilities under the DPA.

The Equality Act 2010

60. Authorised persons must ensure they act in accordance with the Equality Act 2010, including the Public Sector Equality Duty ^{[footnote 27]} which requires public authorities to have due regard to the need to eliminate discrimination, advance equality of opportunity and foster good relations between people when carrying out their duties.

The Attorney General’s guidelines on disclosure

61. The Attorney General’s Disclosure Guidelines ^{[footnote 28]} outline the high-level principles which should be followed when the disclosure regime for criminal investigations and trials is applied throughout England and Wales. This guidance details that TPM should only be requested in a case if it has been identified as relevant to an issue in the case. This will depend on the circumstances of the individual case, including any potential defence, and any other information informing the direction of the case. Access to TPM should never occur as a matter of course. It should never be assumed that because of the nature of an offence that is being investigated that particular types of material will need to be accessed. There will be cases where no investigation of TPM is necessary at all, and others where detailed scrutiny is needed. There must be a properly identifiable foundation for the inquiry, not mere conjecture or speculation.

Crown Prosecution Service (CPS) Pre-trial therapy guidance

62. This guidance ^{[footnote 29]} provides information on how Pre-Trial Therapy records should be requested and processed. As with all TPM, pre-trial therapy records should only be requested when necessary and proportionate, in line with a reasonable line of enquiry.

The Victims’ Code

63. The code ^{[footnote 30]} sets out the services that must be provided to victims of crime by organisations, including the police, in England and Wales. This includes providing information to the victim, so they can understand and engage with the criminal justice process. The code also requires that the police explain where victims can get further information about the criminal justice process and the services they are entitled to as a victim under the code. Service Police should refer to the Victims’ Code for the Armed Forces ^{[footnote 31]}.

Part 4: Duties under Section 44A

Requesting victim information that is necessary and proportionate, in pursuit of a reasonable line of enquiry

64. Section 44A of the Act sets out the requirements which must be met when making a TPM request about a victim.

65. Requesting TPM about a victim should be the last resort and only considered when all other less intrusive methods to obtain the sought information have been exhausted or are deemed not reasonably practicable to pursue.

66. A TPM request about a victim must only be made where the authorised person:

(a) has reason to believe that the information sought is held by the person to whom the request is made (section 44A(3)(a))

(b) which is being pursued, or is to be pursued, by the authorised person or another authorised person; (section 44A(3)(b))

(c) is satisfied that the request is necessary and proportionate to achieve the purpose of preventing, detecting, investigating, or prosecuting crime (section 44A(3)(c))

67. In addition, a counselling information request must only be made if the authorised person has reason to believe that the information sought is likely to have substantial probative value to a reasonable line of enquiry which is being pursued, or is to be pursued, by the authorised person or another authorised person (Section 44A(4)) (see paragraphs 76-89).

Reason to believe the information is held by the person to whom the request is made

68. Authorised persons requesting TPM must have reason to believe that the information contained within the request is relevant to an issue in the case (section 44A(3)(b)), and held by the third party they are requesting from (section 44A(3)(a)) as per the Attorney General’s Guidelines on Disclosure 2022 ^{[footnote 32]}. The threshold test for being able to make a request is where the authorised person has “reason to believe” that the person is a victim – this is a reasonable grounds/belief test, not that they must be established to be a victim beyond reasonable doubt. Any decision to request TPM should be made having considered all pertinent information available at the time, considering the accuracy of the information available and based on more than mere suspicion or speculation on the part of the authorised person.

Relevant to a reasonable line of enquiry

69. Authorised persons must have reason to believe that the TPM request is relevant to a reasonable line of enquiry and they are bound by the code of practice made under section 23 of the Criminal Procedure and Investigations Act 1996 (‘the CPIA’). This places a duty on investigators in England and Wales to pursue all reasonable lines of enquiry whether they point towards or away from the suspect.

70. What constitutes a ‘reasonable’ line of enquiry, and a relevant request for TPM, will depend on the context of the case. A fair investigation does not mean an endless investigation. Authorised persons must give thought to defining and articulating the limits of the scope of their investigations. When assessing what is reasonable and relevant, thought should be given to what is likely to be obtained because of the line of enquiry and how it can be obtained. An authorised person may seek the advice of the prosecutor when considering which lines of enquiry should be pursued where appropriate.

71. Authorised persons may need to discuss the case with the CPS, as set out in Part 7 of this code, to determine the reasonable lines of enquiry, and agree the scope of the request. Prosecutors are reminded of the need to provide guidance and support to authorised persons in identifying relevant TPM. Where possible, there should be early engagement with the defence in identifying lines of enquiry to be pursued and any TPM relevant to an issue in the case.

Necessity and proportionality

72. For the TPM request to be necessary the authorised person must be satisfied that:

(a) the information sought is required to achieve the relevant purpose, e.g., preventing crime

(b) the purpose cannot be achieved by other less intrusive means

73. For the request to be proportionate, authorised persons must:

(a) consider if the purpose justifies the intrusion into the person’s privacy

(b) consider the defendant’s absolute right to a fair trial

(c) minimise the amount of information requested

74. For example, it may be proportionate to request specific information for serious crimes, such as murder or kidnapping (abduction), but not for lower-level crime, such as anti-social behaviour or minor damage.

75. Whilst each case must be carefully considered, it is highly unlikely that a request for the lifetime records of a victim will meet the necessity and proportionality test ^{[footnote 33]}. This is due to the volume and range of information that may be stored in such records. It is unlikely that all such information will be necessary or proportionate to the line of enquiry.

76. Regarding counselling information authorised persons must start from the presumption that requests for such information are not necessary and proportionate. However, this presumption may be rebutted under the conditions set out in paragraph 80.

Requests for counselling information

77. Section 44A(5) defines a “counselling information request” or a request for counselling records, as a victim information request (TPM request) to a person who provides counselling services of a description specified in regulations made by the Secretary of State.

78. There is no standardised method for counsellors to take notes or maintain records. Typically, these records serve as aids during therapy sessions and are not intended for medical assessments or for interpretation. Given their sensitive and confidential nature, if alternative means exist for obtaining the information, such avenues should be explored first. It may be challenging to demonstrate the necessity and proportionality of requesting this information.

79. In making such requests, authorised persons will need to be considerate of the sensitivity of this type of material and how it may impact the wellbeing and experience of victims by considering Part 8 of this code on vulnerable victims. As such, counselling information requests are subjected to a distinct approach, as outlined below. This approach ensures that requests for counselling records consider the unique circumstances of the case and recognise the importance of respecting individuals’ privacy and therapeutic relationships.

Presumption and rebuttal

80. Authorised persons should start with the presumption that requests for counselling information are not necessary and proportionate.

81. To rebut this presumption (and so determine that requesting counselling information is necessary and proportionate) authorised persons must consider the following factors (as well as any other relevant information):

(a) whether there is compelling evidence or reasonable grounds to suggest that the information contained within the counselling notes is likely to have substantial probative value to the investigation and cannot be reasonably obtained through other means

(b) whether all less intrusive alternatives for obtaining the required information have been exhausted or deemed impractical

(c) whether there are any specific circumstances or factors unique to the case that justify accessing the counselling notes

(d) whether they have carefully considered the potential consequences for the victim’s privacy and wellbeing, as well as victim’s views, and have concluded that the benefits of accessing the counselling notes outweigh these concerns

(e) whether there is information to suggest the failure to obtain the records could adversely affect the accused’s right to a fair trial

82. By making the above considerations, authorised persons should be able to determine whether a request for counselling notes is necessary and proportionate as part of a reasonable line of enquiry. It is recommended a record of these considerations is kept.

Substantial probative value

83. In addition to meeting the necessity and proportionality test, authorised persons must satisfy a further test of likelihood of “substantial probative value” to a reasonable line of enquiry when requesting counselling records (section 44A(4)).

84. “Substantial probative value” refers to the meaningful evidential significance of the information contained within the counselling records.

85. The “substantial probative value” test focuses on the likelihood that the evidence will add significant value or substance to the point being investigated. It goes beyond just relevance to assess the weight and worth of that evidence in the context of the investigation, imposing a higher threshold than for other types of material and going beyond the relevance test set out by the CPIA Code of Practice ^{[footnote 34]}.

86. Assessing the “substantial probative value” of counselling records is inherently fact-sensitive and requires a careful consideration of the specific circumstances and objectives of the investigation. It is strongly recommended authorised persons seek early advice from the CPS as set out in Part 7 of this code.

87. In assessing “substantial probative value” authorised persons should consider whether the information being sought within the counselling records:

(a) relate to key aspects of the investigation essential for advancing the reasonable line of enquiry being pursued

(b)is likely to provide meaningful support to the investigative narrative such as corroborate or refute the existing narrative

(c) has the potential or is likely to substantially contribute to establishing or refuting critical facts of the investigation

(d) might reasonably be considered capable of undermining the case for the prosecution against the accused, or of assisting the case for the accused

(e) there is likelihood it may significantly influence the outcome or direction of the case under investigation, considering its potential to corroborate or contradict other evidence gathered

88. The following factors are not sufficient on their own to establish whether the information within the counselling records is likely to have “substantial probative value”:

(a) that the record exists

(b) that the records relate to therapy or counselling that the victim has received or is receiving

(c) that the records merely relate to the incident under investigation

(d) that the relevance of the counselling records to the investigation is purely speculative or conjectural

(e) that there is speculation that the records may relate to the credibility or reliability of the victim, solely based on their receipt of counselling

(f) that the records may relate to the reputation of the victim

(g) that the records relate to the sexual activity of the victim with any person, including the accused

(h) that there is a possibility that the records may reveal allegations, unrelated to the offence under investigation, of abuse to the victim by a person other than the accused

(i) that the records were made close in time to a complaint or the activity forming the subject matter of the investigation

89. These considerations may be used as guidance but are not exhaustive. Authorised persons will be required to make thorough considerations on a case-by-case basis before making a request for counselling records about a victim.

90. In making a request for counselling records, it is also best practice to upgrade the level of seniority required to review and approve the request once drafted. This may include a Chief Inspector, and (in the case of the service police) an Authorising Service Police Officer who should be of or above the rank of Lieutenant Commander (Royal Navy), Major (Army or Royal Marines), or Squadron Leader (Royal Air Force), or Chief Inspector equivalent.

Risk of obtaining other information

91. When making a TPM request, authorised persons must consider whether there is a risk of obtaining information other than information necessary to achieve the purpose for which the request is being made (section 44A(7)).

92. Other information might include:

(a) personal information in the TPM that is about the victim but not necessary for the purpose

(b) information in the TPM that is about a third party and not necessary for the purpose – for example, when a parent(s) details are contained in their child’s medical records

93. If there is a risk that excess information to what is necessary will be obtained for the request to be proportionate, an authorised person must be satisfied that all other avenues for accessing the information have been exhausted or are deemed not reasonably practicable to pursue.

94. Information which has been obtained from a third party and is deemed not relevant to the investigation must be deleted or discarded appropriately unless there is a lawful basis to retain it. Any decisions regarding the retention or deletion of information should be considered in line with relevant disclosure guidelines ^{[footnote 35]}.

95. The test of what is reasonably practicable during an investigation is an objective fact-sensitive test, taking account of all the relevant circumstances. This is intended to ensure that in certain cases, for example where there is a time critical need for the information to protect life or prevent harm, that authorised persons can seek TPM.

96. Where alternative methods are used to obtain the information, any existing legislation and relevant local guidance should be followed. Delays to an investigation due to the request or return of alternative forms of information alone would not provide sufficient justification not to pursue an alternative method, unless there was a real and immediate risk of harm.

97. If, after considering necessity and proportionality (including the risk of obtaining other information), the authorised person is satisfied that the request is proportionate, they can proceed, but should minimise the risk of obtaining other information as far as is practically possible. This should include use of date ranges or other specifics in the request to identify necessary information.

Part 5: Duties under Section 44B

Provision of information to the victim about whom the information is being requested

98. Section 44B of the Act requires notice of the request to be given to the victim about whom the information is sought and sets out the requirements of such notice.

Written notice

99. The authorised person must provide the victim with a written notice (in hard copy or electronic form), specifying:

(a) the information that is sought (section 44B(2)(a))

(b) the reason why the information is sought, (e.g., how it constitutes a reasonable line of enquiry, and how it meets the necessity and proportionately requirements) (section 44B(2)(b))

(c) how the information will be dealt with once it has been requested. (e.g., who it will be shared with and how long it may be retained for) (section 44B(2)(c))

100. In addition, as best practice it is recommended that authorised persons include the following additional information in the written notice that will aid the person in understanding the process and their rights:

(a) what a TPM request is

(b) why the consent of the victim, to make the request, has not been sought

(c) the other, less intrusive methods, the authorised person has considered to obtain this information, and if any were identified, why they have not been followed

(d) how any collateral information obtained will be managed

101. Authorised persons are encouraged to make TPM requests using the sample request form in the Annex when giving written notice to victims and use the FAQ in the Annex to assist in giving the additional information laid out in paragraph 99 of this code.

Documents in the Annex will be available alongside the final publication of the Code of Practice.

102. Further details about cases where the victim is a child, or an adult without capacity, are explained in Part 8 of this code. Where there is any doubt as to their understanding, additional support should be provided to the victim to assist them in giving their views.

103. Authorised persons must give the written notice, either in hard copy or electronic format, on or before the date on which the TPM request is made. If it is not reasonably practicable to provide the notice to the victim in advance or on the day, it must be given to them as soon as is reasonably practicable after that date (section 44B(3)).

104. Authorised persons are encouraged to use the sample request form and FAQs annexed to this code to make TPM requests and give written notice to victims and third parties, and to demonstrate compliance with the Act. Authorised persons may decide to use a form of their own devising so long as it meets the requirements of the Act. In all cases there must be a clear and obvious written demonstration of why the request is necessary and proportionate.

Documents in the Annex will be available alongside the final publication of the Code of Practice.

Seeking the views of a victim

105. Once the victim has been informed of the TPM request, they should, where reasonably practicable, be able to make representations and have their views sought and recorded.

106. For the purposes of data protection victim consent is not required for a TPM request, as set out in paragraph 53 of this code. It is best practice for authorised persons to encourage and support victims to share and record their views regarding the request. If the victim raises any objections to some or all the material being requested, the police should discuss this with the victim and consider the objections and the impact on the investigation of not proceeding to request the material. In some cases, the authorised person may still need to proceed with the request after considering the objections from the victim. This may include cases where the request is necessary to safeguard the victim, or in order to ensure the accused’s right to a fair trial. In these cases, where appropriate, the reason for continuing to pursue the request should be explained to the victim. Authorised persons should give due regard to the method of communication, and language used.

107. If the victim is a child or an adult without capacity, different considerations should be made. Further details are provided in Part 8 of this code.

108. In all cases, the authorised person must consider the victims’ needs and vulnerabilities as outlined in Part 8 of this code and take the action necessary to provide them the support needed to understand the request and share their views. Authorised persons may wish to engage several different professionals during this process, for example, a language interpreter, an intermediary, an Independent Domestic Violence Advisor (IDVA), a social worker or an Independent Sexual Violence Advisor (ISVA) to support the victim and ensure their needs are taken into consideration.

109. The victim may require additional time to consider the request. Authorised persons should consider this and grant additional time where it is reasonable to do so. If more time is granted, it is the responsibility of the authorised person to record this and manage the request.

110. A record should be kept of the written notice, as it may be requested at a later stage to confirm that the victim was informed of the request, that their views were sought and accounted for.

111. Victims should be made aware that the TPM may be shared with the CPS, and that they will be informed if this is shared with anyone outside of the CPS. This may include the defendant defence counsel, suspect, and the court. Authorised persons are responsible for redacting personal and sensitive personal data from material received from third parties and information sent to the CPS, unless the disclosure of that data is required for a law enforcement purpose.

Exceptions where a notice is not required

112. The authorised person need not give notice under this section or specify a particular matter when giving notice, if the authorised person considers that doing so (section 44B(5)):

(a) is not reasonably practicable in the circumstances (section 44B(5)(a));

(b) might interfere with the investigation or enquiry for which the information is sought, or any other investigation or enquiry which is being pursued, or will be pursued in the future by the authorised person or another authorised person (section 44B(5)(b));

(c) might risk causing serious harm to the victim or another person (section 44B(5)(c)).

113. It is expected that section 44B(5)(a) would apply in exceptional circumstances. Examples of these may include where there is a time critical need for the information to protect life or prevent harm.

114. If it has been decided that the victim will not be informed and therefore their views will not be obtained, this should be recorded in writing. It is best practice for this to be signed off by an appropriate authority, as set out in paragraph 117-118 of this code.

115. If the victim cannot be located or contacted, and it is not reasonably practicable to wait for them to be located before requesting TPM, this should be recorded in writing, and signed off by the appropriate authority as set out in paragraph 117-118 of this code.

116. If a victim is missing, a next of kin, parent or guardian should be notified of the request but no views would be obtained.

117. If a victim is deceased, there is no obligation to notify anybody or obtain views.

Sign-off for a TPM request

118. As best practice, TPM requests should be reviewed and signed off by an appropriate authority. This can include; an Inspector (or above), an Authorising Service Police Officer is to be of or above the rank of Lieutenant (Royal Navy), Captain (Army or Royal Marines) or Flight Lieutenant (Royal Air Force), or Inspector equivalent. The Inspector rank reflects the level of consideration that is required when considering a request for personal data that may feel intrusive to the victim, particularly where concerns or objections are raised.

119. Authorised persons should upgrade the level of seniority required to review and approve requests for counselling records. This may include a Chief Inspector, and an Authorising Service Police Officer who should be of or above the rank of Lieutenant Commander (Royal Navy), Major (Army or Royal Marines), or Squadron Leader (Royal Air Force), or Chief Inspector equivalent.

120. It is recommended that the sign off should confirm:

(a) that information contained within the request has been completed accurately

(b) that the request contains the required information and considerations, and the rationale has been recorded

(c) that the request is in pursuit of a reasonable line of enquiry, and relevant to an issue in the case

(d) that the amount of information being requested has been minimised, and that clear parameters have been applied so this is not a generic request for material

(e) that this is the most proportionate way to obtain the information and it is not reasonably practicable to use any less intrusive means

(f) that the right support was provided to the victim, and that the appropriate authority is confident the victim fully understood the request

(g) that where any objection has been raised by the victim, the request remains necessary and proportionate, and the objection has been noted in writing

(h) that, for counselling information requests, the authorised person has made thorough considerations as set out in paragraphs 76-89 and has justified their assessment that the presumption that the request is not necessary or proportionate has been rebutted and that the information is likely to have “substantial probative value”

121. If the form is rejected by the authorising officer, this decision should be recorded in the case file. If it is considered appropriate to continue with the request, another request form should be completed, and consideration should be given to why the initial request was not approved. The new request should be discussed again with the victim, and authorised persons should consider the impact of discussing the details of the offence again with the victim. Approval should be sought from an appropriate person for the new request.

The complaints process for the handling of a TPM request

122. Victims must be made aware of the complaints process should they have any concerns with the handling of their request. Complaints can be made through the following routes:

(a) directly to the police force using the force’s local complaints procedure

(b) The Independent Office for Police Conduct (IOPC) if the complaint is regarding the police ^{[footnote 36]} or in the case of the Service Police, the Service Police Complaints Commissioner (SPCC) ^{[footnote 37]}

(c) The Information Commissioners Office (ICO) if the complaint is regarding how an individual’s data has been processed or used ^{[footnote 38]}.

123. Further Information on the complaint’s procedures mentioned above are provided in the FAQ for Victims (see the Annex).

Documents in the Annex will be available alongside the final publication of the Code of Practice.

Part 6: Duties under Section 44C

Provision of information to the third party from whom the information is being requested

124. Section 44C of the Act sets out what must be included in the content of a TPM request about a victim.

125. Authorised persons should determine and specify how the third party will provide TPM. This may include:

(a) collecting a copy of the data in person

(b) sending a copy of the data by secure email

(c) sending a copy of the data by Royal Mail signed for delivery

Provision of information to the third party

126. The information provided to the third party must:

(a) Section 44C(1)(a) Specify or describe the information sought (e.g., medical records from a specific date range, or a medical note)

(b) Section 44C(1)(b) Specify the reason why the information is sought; and

(c)- Section 44C(1)(c) Specify how the information will be dealt with once it has been obtained

127. In addition, it is recommended as best practice that authorised persons include the following additional information in the written notice that will aid the third party in actioning the request which may include:

(a) any deadline by which the material should be provided, and a reason why the material is needed by then

(b) if and how the victim would like to be contacted by the third party

(c) confirmation that the views and concerns of the victim have been sought and recorded accurately; and

(d) confirmation that the request has been signed-off by an appropriate authority, as set out in paragraphs 118-119

128. Authorised persons may not need to specify the reason why the information is sought or how it will be dealt with once it has been obtained, if they consider that doing so:

(a) is not reasonably practicable in the circumstances (section 44C(2)(a)), or

(b) might interfere with the investigation or enquiry for which the information is sought or any other investigation or enquiry which is being pursued, or is to be pursued, by the authorised person or; another authorised person (section 44C(2)(b)), or

(c) might risk causing serious harm to the person to whom the information sought relates or another person (section 44C(2)(c))

129. Where it is not reasonably practicable to provide information relating to the investigation to the third party, a general statement detailing that there is an active criminal investigation may suffice.

130. A separate request should be made to each third party from whom material is being requested.

Third party response to the request

131. Authorised persons may ask the third party to provide any additional information they believe may be of relevance. The third party is the legal owner of the information and therefore has no obligation under CPIA or the DPA to release the requested material or additional material to an authorised person.

132. If the third party refuses the TPM request, authorised persons should seek to understand why the request was rejected and assess whether alternative means to obtain the information will be necessary. This may include a court order, or a witness summons ^{[footnote 39]} as a last resort. This should be communicated to the CPS via an Investigation Management Document ^{[footnote 40]} allowing the authorised person to be transparent with the defence and court and ensure compliance with disclosure obligations.

133. Where requested information is no longer held by a third party (e.g., due to retention periods), authorised persons should consider whether this is still a reasonable line of enquiry and if so, consider whether there is an alternative means of accessing the information.

134. It may be necessary to invite third parties to preserve material ahead of a formal, written request from the authorised person. Authorised persons should explain to the third party; why this is necessary, what material should be preserved, and for what purpose. This should be detailed in writing and recorded.

135. Third parties are obligated to consider the lawful basis for sharing information with the police and must determine this themselves ^{[footnote 41]}). They must also consider whether the sharing of the information is compliant with the data protection principles.

136. Where material is obtained from third parties, authorised persons should have regard to, and make note of, any handling instructions assigned to the material. An example of this can be found on the sample TPM Request Form (in the Annex of this code). This may include concerns about onward sharing of the data, and the storage or return of the material. Should the third-party response direct that that none of the material is suitable for onward sharing with the defence, irrespective of redaction, both the material itself and the form used to make the request should also be classified as Sensitive under CPIA. The third party’s view must also be passed to the prosecutor.

Documents in the Annex will be available alongside the final publication of the Code of Practice.

137. The third party may also attach conditions to the treatment of the data, and these should be described alongside the return of the information.

138. Authorised person should ensure that the information obtained is processed appropriately, in accordance with data protection legislation, including DPA 2018, and (where relevant) UK GDPR. ^{[footnote 42]}

139. If the third party will only allow the material to be viewed on site, this should be recorded in the case file by the authorised person. There may be occasions where the third party permits inspection of such material but will not allow the authorised person to retain copies. In those circumstances the authorised person should record and describe all the relevant material which has been inspected, in a document stored in the case file including the Investigation Management Document). Where upon inspection material is not considered to be relevant because it is incapable of having any bearing on the issues in the case, a brief explanation should be noted.

140. If new lines of enquiry arise during an investigation, the authorised person should contact the third party through a new request, setting out the parameters. As laid out in section 44B of the Act the victim must be notified, and (as outlined above) this should be discussed with the victim and their views should be obtained.

Overseas requests for TPM

141. The guidance contained within this code provides best practice and applies to Mutual Legal Assistance (MLA) where an authorised person requests TPM to assist an overseas criminal investigation, or proceedings pursuant to a mutual legal assistance request, or on a law enforcement basis. This code should be considered alongside guidance specific to MLA.

142. Service police functioning overseas should follow this code as best practice when requesting TPM.

Part 7: Engaging with the Crown Prosecution Service (CPS)

143. Authorised persons are encouraged to work collaboratively with the CPS when considering TPM.

144. Authorised persons are advised to seek Early Advice from the CPS where appropriate. Early Investigative Advice or ‘Early Advice’ is the process of prosecutors providing guidance and advice to help police “to determine the evidence that will be required to support a prosecution or to decide if a case can proceed to court”. ^{[footnote 43]} The College of Policing ‘Early Advice Protocol’ should be followed to ensure a proportionate approach is taken in relation to gathering TPM. For example, it is strongly recommended to seek early advice in rape and serious sexual offence cases ^{[footnote 44]}.

145. Authorised persons should work with the CPS to agree whether information held by a third party would assist with pursuing a reasonable line of enquiry, and if so, any parameters which should be applied to the TPM request to ensure that the request is necessary and proportionate. Service police should refer to guidance from the Service Prosecuting Authority ^{[footnote 45]}.

146. Where appropriate, it is recommended that Early Advice is sought in advance of making a request for TPM about a victim ensuring early engagement between CPS and authorised persons. Early Advice is also strongly recommended to aid with the assessment of necessity and proportionality and “Substantial Probative Value” of counselling information requests about victims as set out in Part 4 of this code.

147. Authorised persons may be asked to make a request for TPM by the CPS and/or defence. It is the responsibility of the authorised person to ensure their compliance with the duties set out in this code when making TPM requests. When it is not clear whether the TPM request is in line with the duties, authorised persons are advised to consider the following options:

(a) escalating the concern to an appropriate authority, as set out in paragraph 89 and seeking their guidance on whether the request is necessary and proportionate

(b) discussing the concern with the CPS and/or defence and work collaboratively to redefine the request

Part 8: Use of the Code of Practice with vulnerable victims

148. The purpose of this part of the code is to offer guidance on what authorised persons should consider when complying with the duties in section 44A-44C of the Act where the victim is vulnerable.

149. This part focuses on vulnerable victims of crime, who may have experienced trauma and who may need more support to understand the TPM request and share their views. In all cases where authorised persons are considering a request for TPM, they should consider if a person is vulnerable and whether more support is needed to understand the request.

150. Where the victim is a child or adult without capacity, an authorised person should follow the guidance set out in part 8 of this code.

151. Authorised persons should be aware of their existing responsibilities to protect the rights of victims. Guidance can be found in the Victims Code ^{[footnote 46]}.

What does vulnerable mean?  

152. There is no single legal definition of ‘vulnerable’. For the purposes of these duties, a victim can be considered vulnerable if they require some level of additional support in understanding a TPM request and sharing their views.

153. Authorised persons should be aware that someone may have an invisible and hidden vulnerability, or that they may try to hide their vulnerability. There are many reasons for this such as fear, shame, past experiences of engaging with authorised persons or because they do not view themselves as vulnerable. Authorised persons should consider if a person may be vulnerable in every case when determining how to comply with the duties set out in this code.

154. The College of Policing have said that “a person is vulnerable if as a result of their situation or circumstances, they are unable to take care of or protect themselves, or others, from harm or exploitation” ^{[footnote 47]}.

155. In addition, authorised persons should consider if a person is vulnerable due to a protected characteristic, such as race and/or disability, where minority status may result in someone feeling less able to engage with them. When this is the case, they should be offered to be referred to a specialist organisation where the service or support is available.

156. Many victims experience stress and fear during the investigation of a crime. Stress can affect the quantity and the quality of the communication with, and by, the individual concerned. Authorised persons should be mindful of hidden vulnerabilities caused through disability, shock, or trauma.

157. Where a victim is deemed vulnerable, authorised persons should make them aware that they can have additional support to help understand the TPM request. Authorised persons should take all reasonable steps to ensure that this support is accessible. The support may come from a range of persons or specialist support services – for example, from a family member, a friend or, in a case of a sexual offence, an Independent Sexual Violence Adviser ^{[footnote 48]} or other specialised advisors, where the service is available.

158. Where the person does not speak English, the services of an interpreter should be provided. Where a person is deaf, it may be necessary to obtain the services of a British sign languages (BSL) interpreter if there is no other support available at the time. If there is any doubt as to whether the support available can facilitate communication to the required standard, a BSL interpreter should be provided.

159. The following list can be used as guidance for determining if a person may be vulnerable and whether they require additional, independent support when being informed about a TPM request about them. This is not an exhaustive list. The needs of the individual must be carefully considered on a case-by-case basis, considering both the nature of the investigation and their involvement in it. If the authorised person is unsure whether a person is vulnerable, it may be appropriate to assume that a level of vulnerability exists, particularly for victims where someone has been physically or mentally harmed.

160. Examples of people who may be vulnerable:

(a) someone who has been the victim of a crime which may be particularly traumatic, such as rape or sexual assault

(b) someone who has been the victim of violent crime

(c) someone who has been the victim of domestic abuse

(d) someone who has been the victim of stalking

(e) someone who has been the victim of people trafficking

(f) someone who is an asylum seeker or undocumented person

(g) someone who fears repercussions from working with authorised persons to further an investigation – for example, a whistle-blower

(h) someone who is suffering from fear or distress

(i) someone who is suffering from a mental disorder

(j) someone who has difficulty with social functioning

(k) someone with a physical disability

(l) someone on the autistic spectrum

(m) someone with learning difficulties

(n) someone who has difficulty in understanding what is being communicated to them (including language barriers)

(o) someone who has difficulty reading or writing

161. Authorised persons should recognise that a victim may have several different vulnerabilities and that an offender may have taken advantage of these vulnerabilities as part of the crime. In their approach to engagement, authorised persons should consider how the vulnerabilities overlap and interact to provide the correct support. For example, the approach to someone who is vulnerable due to trauma and fear of repercussions of reporting a crime, will be different to someone who is vulnerable due to trauma and has learning difficulties, and is reporting a crime.

162. Authorised persons must follow any existing legislation and local guidance regarding vulnerable people as appropriate to the specific case, in addition to this code.

Working with vulnerable people

163. The possibility that authorised persons will request personal and sensitive information has been found to be a principal reason why victims of rape may withdraw from the criminal investigation process or may choose not to report the crime at all. Authorised persons should therefore be mindful that victims of such crimes may be particularly concerned about requests for their information.

164. Authorised persons may need to go further to support and appropriately account for the needs of a vulnerable victim when informing them about a TPM request. For example, where an individual is in shock, such that they are unable to comprehend what they are being informed about, authorised persons may need to wait until such a time that the shock or effects of it have receded sufficiently for the person to understand. It must be assessed whether the individual is, at the time the notification is to be made, the person lacks capacity within the meaning of the Mental Capacity Act 2005 ^{[footnote 49]}. Under the Mental Capacity Act (MCA) 2005 ^{[footnote 50]}, temporary inability to make a decision because of an impairment of, or a disturbance in the functioning of, the mind or brain would still count as lack of capacity. For the purpose of this code it is recommended that where an adult temporarily lacks capacity, notification and engagement with that victim in relation to the TPM request is not done until such a time that the person has capacity; the processes for an adult without capacity are intended primarily for use where an adult has a long-term lack of capacity and not for cases of fluctuating capacity where someone who would ordinarily be able to make decision for themselves is temporarily unable to do so. If it is not possible to wait until such time, then in cases of fluctuating capacity where notification relating to the TPM request is made at a point in time where the individual lacks capacity, the section below in relation to Children and Adults without Capacity must be followed.

165. Trauma can impact comprehension and communication, so it is important that authorised persons familiarise themselves with their organisational guidance on how to recognise and support and engage with victims who are suffering from trauma.

166. Authorised persons should consider whether to seek the support of an independent advisor for the vulnerable person, for example, an Independent Guardian, an Independent Sexual Violence Advisor (ISVA), an Independent Domestic Violence Advisor (IDVA), a learning disability advocate or an Independent Mental Health Advisor (IMHA) where available to support to the individual. In all cases authorised persons should ensure that the victim feels comfortable with the choice of person as their independent advisor and their specific role. Authorised persons should also consider that professional advisors may be able to offer a different type of support than a family member or friend, and hence, they should decide on a case-by-case basis what support to seek.

167. Although an individual may seek support with understanding the TPM request and sharing their views, the views recorded must be theirs. Authorised persons should ensure the individual has sufficient time to understand the TPM request and share their views and concerns.

168. If, because of their vulnerability, the individual cannot understand the TPM request and written notice, the authorised person should offer the victim the option of having a person providing independent support read the TPM request and notice out loud to the individual if they are unable to read or comprehend the material on their own and explain it to them in simple terms. If the person providing support is unavailable to do so, then authorised persons may need to explain the contents of the form and read it out loud to the victim.

169. If language is an additional barrier to understanding what is being asked of the individual, an interpreter should be made available. The victim may already have someone providing independent support and so they may be able to assist with this.

170. In all cases when dealing with a vulnerable victim, the utmost sensitivity and support should be exercised to ensure that the vulnerable victim understands what they are being informed about and to ensure that their trauma is not further exacerbated because of engaging in an investigative process.

171. If you are unsure about the level of support a person requires you should consult a supervisor or review appropriate guidance in your organisation.

Privacy impact and vulnerable victims

172. It is highly likely that TPM regarding a victim will contain sensitive personal information about them or other persons, and authorised persons must consider the individual’s Article 8 right ^{[footnote 51]} to respect for their private life before any sensitive information is requested. Authorised persons should act in the knowledge that requesting access to this kind of information about a victim from a third party will be an incredibly difficult experience and particularly where the person is vulnerable. Victims of rape and sexual offences may be less willing to proceed with the criminal investigation process if they are concerned about their sensitive, personal information being disclosed during the investigation process and generally, victims may feel as if they are the ones being investigated.

173. In all cases, before making a TPM request, authorised persons must consider other, less intrusive methods for obtaining the required information. This is particularly important when there might be an acute privacy impact on a vulnerable victim.

Safeguarding and vulnerable victims

174. When making a TPM request in relation to a vulnerable victim, there are certain measures that should be taken to ensure they are adequately safeguarded.

175. Engaging in an investigation can be an especially traumatic experience for vulnerable victims. To account for this, authorised persons should make appropriate adjustments and consider the needs of the victim and where they will be most comfortable and able to communicate. Being in a police station may be intimidating, but equally it may be the case that they don’t want the police to attend their home address for many different reasons. In every case the individuals’ needs must be carefully considered.

176. A vulnerable victim and, if appropriate, their support representative (independent advisor, independent guardian family friend etc) should be referred to the relevant services (social services, counselling, independent guardian service etc) if ongoing professional support is necessary.

Children, and adults without capacity

177. This part of the code gives guidance on cases where the victim is a child, or an adult without capacity. Children, and adults without capacity, may not be able to understand the request, and share their views and concerns themselves. This section sets out who should be informed of the request on their behalf (‘the alternative individual’) and what should be considered by the authorised person and the alternative individual.

Children

178. For the purposes of these duties, a child is a person under the age of 18.

179. The following people should be given the notice about a TPM request concerning victim information about a child:

(a) a parent or guardian of the child, (section 44B(4)(a))

(b) if the child is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation, (section 44B(4)(a))

(c) if no person described above is available, an alternative adult who the authorised person considers appropriate (section 44B(4)(b))

180. “Parent” includes a biological parent, an adoptive parent, a step-parent who has been granted legal parental responsibility and a parent by virtue of the Human Fertilisation and Embryology Act 2008 (for example, a second female parent).

181. ”Guardian” means another person who has been granted legal parental responsibility, a person who has been appointed as a guardian by court order or by a will (where the parents are deceased), or a person who, in practice, carries out the day-to-day care of a child, such as a local authority approved kinship or foster carer. Authorised persons should be clear about and record the status of the parent or guardian who is making the decisions.

A person representing a relevant authority or voluntary organisation

182. If the child is in care and it is not appropriate for the notice to be given to a parent or guardian, then a person representing the relevant authority or voluntary organisation providing care to that child can receive the notice instead. This should, unless not possible in the circumstances, be a person known to the child.

183. In all cases, the authorised person must satisfy themselves that there is no conflict of interest for the person who is required to represent the best interests of, or act for the benefit of, the child. In the case of where the suspect is someone within the same organisation that supports the child, for example their social worker, it is recommended that the support is obtained from a person unconnected to that organisation. Careful consideration must always be given as to the status of the person receiving the notice on behalf of the child and their role in the investigation.

184. A responsible person, who must be 18 or over, should only be used as a last resort if a parent or guardian, or a person representing a relevant authority or voluntary organisation is unavailable to be notified of the request. Unless inappropriate to do so, authorised persons should contact a parent, guardian or person representing the relevant authority or voluntary organisation responsible for the child before turning to another responsible person. Best practice is to wait for such a person to be available to be notified.

185. The responsible person should not be a suspect in relation to the enquiry for which the TPM request is being made and should ideally have an existing caregiving relationship with the child.

Obtaining the views of the child

186. Authorised persons should, so far as it is reasonably practicable to do so, ascertain the views of the child and have regard to any views so ascertained, taking account of the child’s age and maturity, particularly in the context of children between 16 and 17 years old.

187. A child’s competency to give their views depends on their understanding, not their age ^{[footnote 52]}. It may not always be clear whether the child can express their views or understand what is being asked of them, and therefore the authorised person should consider:

(a) their understanding of the issue

(b) their understanding of the information which has been given

(c) their understanding of any alternative options, such as disagreeing with the request

(d) their ability to explain their reasoning around the views they have given

188. This means where appropriate, and where the child is reasonably locatable, their views should be sought and recorded. Authorised persons should have due regard to any views obtained before proceeding with the request as set out in paragraph 105.

189. Very young children and those with significant learning or mental health needs may be incapable of expressing an informed view on the TPM request.

Adults without capacity

190. In relation to England and Wales, a person is an adult without capacity if, within the meaning of the Mental Capacity Act 2005 ^{[footnote 53]}, they lack capacity in relation to a TPM notice (i.e. to understand the TPM request and share their views). The assessment of whether they lack capacity to understand the notice should be made at the point in time when the authorised person intends to give the notice.

191. As outlined in paragraph 163, the processes for an adult without capacity are primarily intended for use where an adult has a long-term lack of capacity and not for cases of fluctuating capacity where someone who would ordinarily be able to make decision for themselves is temporarily unable to do so. In cases of fluctuating capacity, and the adult lacks capacity at the point in time when the notification is given (and it is not possible to wait until a point of time when the adult has capacity), then the processes for an adult without capacity must be applied.

192. In this regard, authorised persons must have in mind the principles set out in section 1 of the Mental Capacity Act 2005.

193. The following people must be given notice about a TPM request concerning information about an adult without capacity:

(a) a parent or guardian of the victim

(b) if the victim is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation

(c) or if no person described above is available, any adult who the authorised person considers appropriate (ideally, a trusted other such as a friend or carer)

194. “Parent” includes a biological parent, an adoptive parent, a stepparent who has been granted legal parental responsibility and a parent by virtue of the Human Fertilisation and Embryology Act 2008. (for example, a second female parent)

195. “Guardian” means another person who has been granted legal parental responsibility, a person who has been appointed as a guardian by court order or by a will (where the parents are deceased), or a person who, in practice, carries out the day-to-day care of the adult without capacity. Authorised persons should be clear about and record the status of the parent or guardian who is making the decisions.

196. The term ‘Guardian’ includes adults who have been appointed to the role of guardian by a court.

A person representing a relevant authority or voluntary organisation

197. If the adult without capacity is in the care of a relevant authority or voluntary organisation and it is not appropriate for the notice to be given to a parent or guardian, then a person representing the relevant authority or voluntary organisation providing that care can receive the notice instead.

198. In all cases, the authorised person must satisfy themselves that there is no conflict of interest for the person who is required to represent the best interests or act for the benefit of the victim where they are an adult without capacity. In the case of where the suspect is someone within the organisation that supports the adult without capacity, for example a care worker, it is recommended that the support is obtained from a person unconnected to that organisation. In all cases, careful consideration must also be given to the status of the person receiving the notice and their involvement in the investigation.

Obtaining the views of the adult without capacity

199. Authorised persons should, so far as it is reasonably practicable to do so, ascertain the views of the adult without capacity and have regard to any views so ascertained, taking into account the conditions that affect their capacity.

200. Authorised persons should consider if any additional support is required for the adult without capacity, such as from a family member, social worker, Independent Guardian, Independent Sexual Violence Advisor (ISVA), Independent Domestic Violence Advisor (IDVA), a learning disability advocate or an Independent Mental Health Advisor (IMHA).

201. Some people’s ability to understand information fluctuates because of a condition that they have. In such cases, if possible, the victim should be notified of the TPM request, and the views of the victim should be shared when the person has the capacity to understand the request for themselves. It may also be helpful to discuss and record what the person would want if they lost capacity to understand the information (or similar information) in future, for example where it is anticipated that they will reach a stage due to a condition or illness that will prevent them from expressing a view or objection. This means that, if further information needs to be notified and a decision need to be taken in their best interests and for their benefit, the authorised persons can take the person’s wishes into consideration.

202. In cases where the victim is an adult without capacity, authorised persons should record all relevant information, including:

(a) the basis of the assessment that the adult is without capacity

(b) if the adult without capacity was asked for their views, what those views were

(c) if the adult without capacity was not asked their views, why not

Definitions

Adult: a person aged 18 or over.

Adult without capacity: an adult who, within the meaning of the Mental Capacity Act 2005, lacks capacity to understand a notice under section 44B.

Authorised persons: as set out in part 2 of this code.

Child: a person aged under 18.

Counselling services: as set out in part 4 of this code.

Crime: refers to (a) conduct which constitutes one or more criminal offences in England and Wales, or (b) conduct which, if it took place in England and Wales, would constitute one or more criminal offences.

Harm: includes physical, mental or emotional harm and economic loss.

Reasonable line of enquiry: that which points either towards or away from the suspect. What is reasonable will depend on the circumstances of the case and consideration should be had to the prospect of obtaining relevant material, and the perceived relevance of that material.

Registered social worker: a person registered as a social worker in a register maintained by (a) Social Care Wales (previously known as Care Council Wales), or (b) Social Work England

Substantial probative value: meaningful evidential significance of information adding value or substance to the point being investigated and likely to contribute significantly to proving or disproving a crucial aspect of the investigation.

Third party material (TPM): material held by a person, organisation, or government department other than the investigator and prosecutor, either within the UK or outside the UK. Third parties are not directly involved in the case in question but may hold information relevant to it.

To give notice: to notify and inform a victim about a request for material about them in written form specifying the information sought, the reasons for seeking the information and how the information will be dealt with once obtained.

Victim; Section 1 of the Victims and Prisoners Bill 2023.

Victim information request: a request by an authorised person to another person to provide information which relates to a third person who the authorised person has reason to believe is or may be:

• a victim, or
• at risk of being a victim

Voluntary organisation: a body (other than a public authority) whose activities are not carried on for profit.

Vulnerable Individual: someone who would require some level of additional support when being informed about a third party material request about them.

Annex

These documents will be available alongside final publication of Code of Practice.

1. Request form

2. FAQ for authorised person

3. FAQ for victims

Footnotes

1. See part one for the list of authorised persons in section 44E of the Act and a definition of an “authorised person”. ↩

2. Police, Crime, Sentencing and Courts Act 2022 (legislation.gov.uk) ↩

3. Extraction of information from electronic devices: code of practice (accessible) - GOV.UK (www.gov.uk) ↩

4. Victims and Prisoners Bill - GOV.UK (www.gov.uk) ↩

5. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

6. Section 44E(1) of the Act can be found at [X] ↩

7. S.I. 2023/624: The Service Police (Complaints etc.) Regulations 2023 (legislation.gov.uk) ↩

8. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

9. Code of Ethics, College of Policing ↩

10. The Code of Practice on the Management of Police Information (MoPI) defines policing purposes as: Protecting life and property, preserving order, preventing the commission of ‘terrorist’ offences, bringing offenders to justice, any duty or responsibility arising from common or statute law. ↩

11. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

12. Human Rights Act 1998 (legislation.gov.uk) ↩

13. European Convention on Human Rights (coe.int), Article 8 ↩

14. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

15. Criminal Procedure and Investigations Act 1996 (Section 23(1)) Code of Practice (publishing.service.gov.uk)  ↩

16. Disclosure Manual: Annex B - An Explanatory Note on the Principles and Procedures relating to Third Parties under the Criminal Procedure and Investigations Act 1996 and the Disclosure of Material in their Possession, The Crown Prosecution Service (cps.gov.uk) ↩

17. Alibhai & Ors v REGINA, 2004, EWCA Crim 681, England and Wales Court of Appeal, Criminal Division, Judgment, Law, CaseMine ↩

18. Data Protection Act 2018 (legislation.gov.uk) ↩

19. Investigators request third party material under the CPIA, and then latterly process the material under the DPA ↩

20. Commissioners Opinion: Who’s under investigation? The processing of victims’ personal data in rape and serious sexual offence investigations (May 2022) ↩

21. A guide to the data protection principles, ICO ↩

22. Police information and records management: code of practice - GOV.UK (www.gov.uk) ↩

23. Data Protection Act 2018 (legislation.gov.uk) ↩

24. Conditions for sensitive processing, ICO ↩

25. Data protection – definitions and elaboration, College of Policing ↩

26. Law Enforcement, ICO ↩

27. Public sector equality duty - GOV.UK (www.gov.uk) ↩

28. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

29. Pre-Trial Therapy, The Crown Prosecution Service (cps.gov.uk) ↩

30. Code of Practice for Victims of Crime in England and Wales (Victims’ Code) - GOV.UK (www.gov.uk) ↩

31. The Criminal Justice (Armed Forces Code of Practice for Victims of Crime) Regulations 2015 (legislation.gov.uk) ↩

32. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

33. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

34. Criminal Procedure and Investigations Act Code of Practice - GOV.UK (www.gov.uk) ↩

35. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

36. Complaints, Independent Office for Police Conduct (IOPC) ↩

37. The Service Police complaints system - GOV.UK (www.gov.uk) ↩

38. Make a complaint, ICO ↩

39. Witness summons: Form N20 - GOV.UK (www.gov.uk) ↩

40. National Disclosure Improvement Plan (NDIP) Report on Phase Two, March 2021, The Crown Prosecution Service (cps.gov.uk) ↩

41. Lawful basis for sharing personal data, ICO ↩

42. Data protection: The Data Protection Act - GOV.UK (www.gov.uk) ↩

43. Early investigative advice - His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services ↩

44. Early advice protocol, College of Policing ↩

45. Service Prosecuting Authority - GOV.UK (www.gov.uk) ↩

46. The Code of Practice for Victims of Crime in England and Wales and supporting public information materials - GOV.UK (www.gov.uk) ↩

47. Introduction to vulnerability-related risk, College of Policing ↩

48. The role of the Independent Sexual Violence Adviser (ISVA) - GOV.UK (www.gov.uk) ↩

49. Mental Capacity Act 2005 (legislation.gov.uk) ↩

50. Mental Capacity Act 2005 (legislation.gov.uk) ↩

51. Human Rights Act 1998 (legislation.gov.uk) ↩

52. Competence and Compellability, The Crown Prosecution Service ↩

53. Mental Capacity Act 2005 (legislation.gov.uk) ↩