Information Commissioner’s Office: 21 February 2024
Published 30 April 2024
© Crown copyright 2024
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/independent-review-of-disclosure-and-fraud-offences-meeting-minutes/information-commissioners-office-21-february-2024
Introduction
The Chair of the Review, Jonathan Fisher KC, summarised the terms of reference, scope of the Review and emerging findings. The discussion focused on the application of the Data Protection Act 2018, the domestic implementation of the General Data Protection Regulation (GDPR), in the English and Welsh criminal justice system and the disclosure process.
Discussion
Criminal Case Material
1. Participants noted that Data Protection legislation was created so that it is flexible enough to apply to scenarios where personal information is stored in a range of formats, file types and locations. As a result, there can be some confusion amongst law enforcement as to how the legislation should be applied in each unique set of circumstances. Participants suggested that there is nothing in the Data Protection Act (DPA) that inhibits the effective discharge of criminal disclosure obligations.
2. It was suggested that data protection challenges are exacerbated when investigations gather material that is clearly not relevant but contains personal material. Once gathered, data protection duties apply.
3. It was agreed that there are certain specific sensitivities regarding data protection in rape and serious sexual offences cases (RASSO), that are not necessarily mirrored in other serious crime types such as complex fraud. It was noted that law enforcement may be overstating consent as a legal requirement.
Keys to Warehouse
4. Given the imperfections in the process, concerns were raised regarding the ‘keys to the warehouse’ approach. It was also noted that police will have ethical decisions to make regarding avoiding disclosing personal data that could facilitate further criminality or put individuals at risk. It was noted that in the English and Welsh criminal justice system, that the defendant has access to all material disclosed to the defence team. The discussion also covered the privacy complications that arise in multi-handed cases.
Redaction
5. There was a discussion regarding the burden of redaction and whether law enforcement agencies are over or under redacting. Participants suggested that misapplication of the DPA is likely resulting in law enforcement sometimes over-reacting material that they pass to the Crown Prosecution Service for charging decision purposes.
6. Participants were supportive of utilising emerging technology to increase the speed and accuracy of data protection. It was noted, however, that redaction tools are still not sufficiently developed to effectively reduce the burden on law enforcement.