Advice for schools on how to handle information requests from the police

We’ve recently received an increase in the number of requests for support from schools and academy trusts in relation to information that has been requested by the police.

In this article, we explain the legal position, how to disclose information lawfully and how schools can avoid common pitfalls. 

It’s not uncommon for schools to be approached by the police for information (such as CCTV footage, pupil records or copies of correspondence) to assist them as part of an investigation or prosecution. 

Schools and trusts are able to lawfully share information with the police for law enforcement purposes under Data Protection law, however they should ensure the decision-making process is properly documented in the event that the decisions made are questioned at a later date.

Handling police requests

The correct approach to handling requests from the police is set out within the ICO Data Sharing Code of Practice. The starting point is to ensure that there is a lawful basis for the disclosure under the UK GDPR. 

Where the information requested only includes personal data which is not special category data or criminal offence data, schools and trusts will need to identify a lawful basis under Article 6 UK GDPR to make the disclosure. 

In most cases, information can be shared with the police on the basis that is in the school’s legitimate interests for the purposes of the prevention, detection or prosecution of crime (Article 6(1)(f) UK GDPR).

Special category data

Where the information requested includes special category data (such as information relating to health, sexuality or sexual orientation, race or religion), schools and trusts will need to identify an additional lawful basis for processing under Article 9(2) UK GDPR. 

In most cases, disclosures of special category data to the police will fall under Article 9(2)(g) UK GDPR – the disclosure is necessary for reasons of substantial public interest. If you’re going to rely on this, you’ll need to meet an additional condition under Schedule 1 of the Data Protection Act 2018.

The most relevant condition being Schedule 1, Para 10, DPA 2018 - disclosures of special category data which are necessary for the purposes of the prevention or detection of unlawful acts; and where asking for the individual’s consent would prejudice those purposes.

Where the information requested includes criminal offence data (such as allegations that an individual has committed an offence) schools and trusts must comply with Article 10 of the UK GDPR. This means meeting a relevant condition in Schedule 1 of the DPA 2018. The most relevant condition will be Schedule 1, Para 10, DPA 2018 (as set out above).

Record keeping

Requests for information made by the police must be reasonable and they should clearly explain the necessity for the request to you. Requests should be made in writing and confirm that the information is required for a law enforcement purpose. 

Some police forces will make requests for information using a standard form. This may be referred to as an ‘Interim Third-Party Material Request Form’ which is the recommended form for the police to use to request information in accordance with the Disclosure of Information Between Family and Criminal Agencies and Jurisdictions:2024 Protocol (2024 Protocol). 

This form documents the information being shared and the lawful basis for doing so. It also asks for confirmation as to whether the information being provided can be disclosed to the defence and, if not, the reasons the school believes the information should not be disclosed. 

Completing this form at the time the information is requested will save time in the future. If the form is not completed, the police may come back to a school at a much later date and ask if the information can be disclosed to the defence. 

There may be a long period of time between the initial police investigation and commencement of a criminal trial, during which time key staff members may have left or records may not have been retained. Therefore, completing an audit trail will document the information shared and the decisions made in relation to the request avoiding you having to revisit decisions at a later date. 

Our top tips for schools

We want to help schools and Trusts avoid common pitfalls when sharing information with the police which can be costly in terms of time and resources. So, what can be done to help avoid these common pitfalls?

1. Keep an audit trail

Requesting the police to complete an audit trail (such as the Interim Third-Party Material Request Form from the 2024 protocol) will evidence your decision-making process and ensure all relevant information is obtained from the police at the time the request is made.

2. Keep a record of the information shared

There can be a long wait between an initial police investigation and a case coming to trial.

If questions about the data are raised at a later date (such as whether the information can be disclosed to the defence team), it will be difficult to answer this question if you have no record of what was shared. Therefore, you should keep a record of the information shared so that it can be reviewed in the event further questions arise.

3. Confirm with the police whether you’re able to share that a disclosure has been made

Prior to disclosing information to the police, you should ask them to confirm whether or not you are able to notify the individual(s) concerned about the disclosure, for example as part of your transparency obligations or in response to a subject access request. Dealing with this issue at the outset will save time and prevent any confusion arising at a later date.

4. Handling a request in an emergency

The ICO’s data sharing code of practice confirms that in an emergency you should go ahead and share data as is necessary and proportionate. The code of practice makes it clear that urgent data sharing can make a real difference to public health and safety. In emergency situations, do not wait for a form to completed – the information should be shared and you should document the action taken after the event.

Summary

We understand that handling requests from the police can be difficult as schools and trusts want to balance the willingness to help law enforcement authorities against their data protection obligations.  However, ensuring the steps outlined above are completed will help save time and resources and will help to avoid confusion when dealing with police requests.

Support and resources

Our data protection support pack for schools and trusts contains detailed guidance on handling requests for information from law enforcement agencies and template audit trail documents to assist in dealing with these requests. 

With our data protection CPD programmes, we’ll help you develop the skills and confidence needed to handle data protection effectively and with our other support packs equip you with the resources to do it efficiently.