… a request for CCTV footage following an attempted break in, an altercation in the school car park or even a request made in relation to historic allegations concerning former staff and pupils.
Most requests are made by the police but we are increasingly being asked to advise on requests made by other bodies such as HMRC, local authorities, and NHS trusts. Often they are investigating specific offences relevant to their functions, for example, a local authority wanting information about a parent in connection with alleged council tax fraud. In light of the financial squeeze driven by the coronavirus (COVID-19) pandemic, it is perhaps not surprising if these types of requests are becoming more common.
The Data Protection Act makes provision for organisations such as schools to assist the police in the prevention or detection of crime without breaching their own data protection obligations.
These provisions can also be relied on where the request has come from a government body other than the police. However, before sharing information (in particular where the request has not come from the police), a school should be satisfied that the body making the request has the necessary powers to do so, and that those powers are relevant to the request being made. If in doubt, ask, as the organisation should be able to point to specific legislation giving them the powers to make the request.
Once you are happy that the body making the request has the necessary powers in relation to the request, then you can respond to the request as you would a request from the police. We have set out below some tips for dealing with requests from the police and other bodies:
There is no legal obligation to provide information unless and until the requesting body produces an appropriate court order. Therefore, a school is within its rights to refuse a request unless and until the court order is produced. However, most schools wish to cooperate.
Often the body making the request will set out the details using a standard form, and this should be requested if it has not been provided.
Occasionally, time will be a critical factor for the police or the investigating agency, particularly if the request pertains to safeguarding and/or if there is an immediate risk to individuals. In these circumstances, data protection rules still apply, but plainly a school would not want to delay disclosure of information that is obviously relevant in an emergency situation.
Sometimes the police will produce a form that purports to count as consent to allow a school to share information with the police. Such forms are often used in relation to allegations of serious assault where victims are sometimes asked by the police to sign a consent form authorising disclosure. Schools should be very careful before disclosing information to the police in reliance on such forms. The ICO has an ongoing investigation into the police's practices here and has concerns about the validity of such consent forms. As the ICO has put it, "statements are often signed in the immediate aftermath and shock of the crime, and, we are told, victims can often be unclear as to what they are consenting to and why."