Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?

Question

Is it basically neither prohibited nor required and thus entirely to police discretion as to whether or not to disclose parties' details to either their purported victims, or to other parties like journalists? Isn't that a breach of someone's privacy rights? I've been wrongly accused of assault by fascist protest groups before, who have called the police, who have collected my details to screen for warrants. This seems like a legitimate use of and reason for collecting my information. I explicitly requested them not to let the fascist protestors have my name and details because I feared persecution and harassment. Why is it not a GDPR/DPR violation for them to give the fascists information which I would resolutely and rightfully deny to them if they asked me for it directly? (Indeed, they had demanded my details on previous occasions and I certainly did deny them that.) I can understand if I was already convicted or even charged, (as court proceedings are necessarily public) or just arrested to be charged, as that at least implies some necessary level of merit to the accusations, but how is it not violation of my privacy rights when I should be presumed innocent of any wrongdoing until demonstrated otherwise?

Luckily the police assured me that they wouldn't give my details to my adversaries in that case but what is the legal standing of my request to the police for privacy from adversaries?

Answer 1

As to the GDPR, Article86 provides that:

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.

Recital 154 covers much the same ground. This leaves the matter to law other than the GDPR to govern when a public body, such as the police, may release personal information.

However, one can make GDPR requests for access to information held by the police as explained in "Get access to your personal data held by the criminal justice system"

The UK Metropolitan Police page "When can the police disclose information about me?" details some circumstances in which the police may disclose information held by police about a person, but does not seem to deal with disclosure of police reports including contact details of a named person

The UK Metropolitan Police "Privacy notice" sates, in relevant part:

The Met takes steps to ensure that any disclosures of personal data, however obtained, comply with the provisions of the Data Protection Act 2018 and General Data Protection Regulations. This includes ensuring that any disclosures are necessary and proportionate. Disclosures will be made on a case-by-case basis, using the personal data appropriate to a specific purpose, and with necessary safeguards in place.

This document also describes GDPR-UK-based rights to access, rectification, and erasure of personal data, and how to invoke them.

The page "Information Sharing" from the College of Policing states:

Subject to certain exemptions, statutory obligation means forces must share information. This is where there is a specific legal obligation to disclose police information to another party. Examples of where the police service is obliged to disclose information include:

• disclosure under the Police Act 1997 Part V
• disclosure under the Freedom of Information Act 2000
• disclosure under the Safeguarding Vulnerable Groups Act 2006
• disclosure under the Data Protection Act 2018
• responding to court orders

[In the original site these open related web pages]

Sharing information under statutory obligation does not require an ISA. Where in doubt, refer to the force point of contact for information sharing.

The Freedom of Information Act's Section 40 -- Personal information -- provides that:

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if—

(2)(a)it constitutes personal data which [F1does] not fall within subsection (1), and

(2)(b) the first, second or third] condition below is satisfied.

(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(3A)(a)would contravene any of the data protection principles, or

(3A)(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).]

(4A)The third condition is that—

(4A)(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(4A)(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

This seems to mean that most personal information is exempt from disclosure under the Freedom of Information Act.