Using the crime and taxation exemptions - Home | ICO

1 Using the crime and taxation exemptions (s29) 20152605 Version: 1 ICO lo Using the crime and taxation exemptions Data Protection Act Contents Introduction .. 2 Overview .. 2 The crime and taxation purposes .. 3 Prejudice and likelihood .. 4 Withholding information from individuals .. 7 The first data protection principle .. 7 Section 7 subject access requests .. 8 Extending the exemption to other statutory functions .. 9 Withholding information about risk assessment .. 9 Disclosing information to prevent or detect crime .. 11 The non-disclosure provisions .. 13 Principles one and two .. 14 Principles three, four and five .. 15 Section 10 and section 14 .. 15 More information.

2 16 Using the crime and taxation exemptions (s29) 20151506 Version: 1 2 Introduction 1. The Data Protection Act 1998 (DPA) is based around eight principles of good information handling. These give people specific rights in relation to their personal information and place certain obligations on those organisations that are responsible for processing it. 2. An overview of the main provisions of the DPA can be found in The Guide to Data Protection. 3. This is part of a series of guidance, which goes into more detail than the Guide, to help data controllers fully understand their obligations and promote good practice. 4. This guidance explains how to apply the exemptions for Using personal data for purposes connected to crime and taxation .

3 There are two main parts to the exemption. The first allows data controllers processing data for the relevant purposes to withhold information that should usually be provided to individuals. The second allows data controllers to disclose personal data in ways that would otherwise breach the data protection principles, if it is necessary for the relevant purposes. Overview The crime and taxation exemptions are based on the purpose for which the personal data is being processed, not on the type of organisation doing the processing. The purposes relevant to this exemption are the prevention and detection of crime , the apprehension or prosecution of offenders, and the assessment or collection of tax.

4 Data controllers do not have to fulfil their obligations to tell individuals how their data is being processed or respond to a subject access request (SAR), if doing so would prejudice the crime prevention and taxation purposes. Data controllers can disclose personal data without applying the usual data protection principles, if the disclosure is necessary for the crime prevention and taxation purposes. It is the data controller making the disclosure who is responsible Using the crime and taxation exemptions (s29) 20151506 Version: 1 3 for deciding whether the exemption applies in each case. The exemptions must be applied on a case by case basis, and should be used only when it is necessary to do so.

5 The crime prevention and taxation purposes 5. Section 29 can be applied to: S29 (1) Personal data processed for any of the following purposes: a) The prevention or detection of crime , b) The apprehension or prosecution of offenders, or c) The assessment or collection of any tax or duty or of any imposition of a similar nature. 6. The scope of the exemption should be clear from the wording of the DPA. The exemption applies to the purpose of processing, not the type of organisation Using the personal data. Police forces and HMRC are an obvious example of data controllers which are likely to need to apply the exemption when necessary, but the exemption is not limited to these bodies.

6 A non-exhaustive list of relevant activity includes: Recording information, interviews and statements about reported crimes and tax investigations. Calculation of tax status or liability. Intelligence gathering and surveillance for crime prevention and detection. Attempts to locate potential suspects or witnesses in relation to crime prevention and detection. Proceedings in the courts and tribunals for criminal or tax matters. Assessments of suitability for parole or prisoner reclassification. 7. Even if a data controller s main activity falls within these purposes, not all of the personal data it processes will be within the scope of the exemption. Using the crime and taxation exemptions (s29) 20151506 Version: 1 4 8.

7 Data originally obtained for crime prevention or taxation activity but no longer processed for that purpose and now processed for a different purpose cannot be exempt under s29. 9. This exemption does not apply to civil legal proceedings. In circumstances where disclosure of information is necessary for civil proceedings or is otherwise required by law, data controllers should consider applying the exemption under s35 of the DPA. Prejudice and likelihood 10. The exemption does not apply to all information being processed for the crime prevention and taxation purposes. The test is whether applying the DPA in the usual way would be likely to prejudice the purposes. A data controller should be able to demonstrate why this is the case each time the exemption is applied.

8 An organisation cannot apply the exemptions as a blanket policy, even if in practice there are types of information that would be made exempt in the majority of decisions. R (on the application of Alan Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin) A prisoner challenged the Home Office s policy of automatically withholding reports into their Category A status in response to a subject access request. The Home Office s approach was to apply s29(1) to all requests for this information by data subjects. The court held that the policy of blanket non-disclosure could not be justified under s29(1), and that the exemption required a more selected and targeted approach to non-disclosure based on the circumstances of the particular case.

9 The judge said that: it is for the data controller, if he wishes to rely upon the exemption in section 29(1), to show that one of the statutory objectives is likely to be prejudiced in the particular case in which the question arises . 11. The first step in deciding whether the exemption applies is to identify the prejudice that might occur if the DPA was followed in the usual way. In each particular case, the data controller needs to be able to demonstrate the nature of the prejudice. The prejudice can be that a specific investigation would be Using the crime and taxation exemptions (s29) 20151506 Version: 1 5 compromised by information being withheld or disclosed. There can also be prejudice against wider activities, for example if disclosing personal data would reveal methods of investigation that need to remain confidential to be effective.

10 Any prejudice must be real, actual and of substance. If the impact on the purposes would only be trivial, the exemption will not apply. Example A victim of a mugging tells the police that their attacker ran off through an industrial estate car park. The owners of the car park have CCTV footage that will help to identify the attacker and show their movements. This is clearly of importance to the apprehension and prosecution of the offender. Withholding the footage from the police would have a significant impact on the investigation. The owners of the car park can rely on s29(3) to allow the disclosure of the CCTV footage. 12. The next step in assessing whether the exemption applies is to establish a causal link between the use of the data and the prejudicial effect.