Information and data management

Information management is the procedure of collecting, storing, and organising data in a way that allows for efficient retrieval and use. Its purpose is to ensure that the right information is available to the right people at the right time, in order to facilitate decision-making and support the efficient operation of an organisation.

The Code of Practice on Police Information and Records Management (PIRM) 2023 replaced the Code of Practice on the Management of Police Information 2005 (MoPI). It broadens the applicability of the original MoPI Code beyond records that contain police operational information to include police corporate information.

For the purposes of PNC and LEDS, the operational data that is recorded is also covered by the PIRM Code. Good records management supports good data governance and data protection.

Maintaining integrity and quality assurance of both the systems and the data and the information within are themes which run through both the Code and this guidance.

The ten principles of the Code have been assigned responsibilities or obligations that describe the required good practice for managing and using data contained, accessed or processed in other ways through either PNC or LEDS. Other supporting functions, such as training and securing the data, have been similarly described. Further guidance is contained in College of Policing APP on Management of police information.

For individuals whose personal data may be processed either with or without their consent, there are some legislative protections and rights.

Part 3, Chapter 3 of the DPA 2018 and the UK GDPR provide the following individual rights that must be communicated to data subjects in clear and plain language.

• The right to be informed.
• The right to access.
• The right to rectification.
• The right to erasure or to restrict processing.
• The right to portability (UK GDPR only).
• The right to object (UK GDPR only).
• The right not to be subject to automated decision-making.

The terms of Part 3 of the DPA 2018 and the UK GDPR are not identical. Both provide exemptions and restrictions that can, in some circumstances, be legitimately applied to restrict an individual’s rights, but may have different implications. Most of the rights outlined above apply to data collected under Part 3 of the DPA 2018.

Some of the rights only apply under the UK GDPR, specifically, the right to object and the right to data portability. These rights will apply to, for example, data collected and processed for safeguarding or immigration purposes.

Further, there are exemptions and restrictions that can, in some circumstances, be legitimately applied to prevent individuals from being granted the rights listed above when considered under law enforcement purpose. In Schedule 2 of the DPA 2018, for example, subject access rights and the rights to rectification, erasure and restriction do not apply to the processing of ‘relevant personal data’ during a criminal investigation or criminal proceedings. ‘Relevant personal data’ here means personal data contained in a judicial decision, or in other documents relating to the investigation or proceedings, that are created by – or on behalf of – a court or other judicial authority.

Sensitive data

There are additional provisions in data protection legislation that apply to the management of ‘sensitive’ personal data (section 35.8 DPA 2018) or ‘special category data’ (UK GDPR).

In Section 35.8 sensitive processing is defined as:

(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership

(b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual

(c) the processing of data concerning health

(d) the processing of data concerning an individual’s sex life or sexual orientation

The UK GDPR definition covers the same data but worded slightly differently.

The legislation requires the controller to have an appropriate policy document in force at the time the processing takes place. Organisations that access PNC and LEDS must be able to demonstrate that such processing is strictly necessary – for example, for the administration of justice or for safeguarding children or individuals at risk.

Criminal offence data is also treated in the same way if the processing organisation is not a ‘competent authority’ (see Data protection – definitions and elaboration for further definition of competent authority) that is, is not an organisation which generally processes data for law enforcement purposes.

Likewise if the organisation is a competent authority processing that data, but for purposes not related to law enforcement. For example, a police force is a ‘competent authority’ but when processing data about its employees’ criminal records for human resources purposes, the force needs to comply with the UK GDPR.

Biometric data

The processing of biometric data constitutes sensitive processing under Part 3 of the DPA 2018, and law enforcement organisations must ensure that they demonstrate that the processing is strictly necessary and satisfies one of the conditions in Schedule 8 of the Act or is based on consent. For example, arrest and detention provides a lawful basis for taking prints and DNA samples.

The Protection of Freedoms Act 2012 (PoFA) curtailed the power to retain biometric data from suspects who are not charged or convicted of any offence. The PoFA also reduced the length of time for which data can be retained, with only the data of those convicted of the most serious offences being subject to ‘indefinite’ retention.

Although that information may be retained on the central policing records, cautions, reprimands and warnings and some convictions are deemed to have become ‘spent’ after a certain period under the Rehabilitation of Offenders Act 1974. Once a record becomes spent, it does not usually need to be declared to employers or voluntary organisations.

When a person applies for a so-called ‘excepted position’, they may be required to provide details of their criminal record, both spent and unspent, by way of a standard or enhanced criminal records check from the Disclosure and Barring Service (DBS), Disclosure Scotland or AccessNI. There are certain exceptions set out in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (as amended). This is in recognition that there are certain activities for which fuller disclosure of a person’s criminal record history is relevant, for example, work with children or vulnerable adults, or roles in certain licensed occupations or positions of trust.

The government amended the filtering guidance that explain what is automatically disclosed in November 2020. Further revised guidance has recently been issued on what locally held information should be included on an enhanced DBS certificate. The decision as to whether local police information should be disclosed on a certificate rests with chief officers in forces. Recognising the sensitivity of disclosing such information, they must have regard to statutory disclosure guidance issued by the Secretary of State.