Recommendation - Durham Constabulary, July 2024
We identified organisational learning from a review following a local police investigation.
A member of the public complained that the police had shared personal and sensitive information with their university for safeguarding purposes, and that this was not in line with privacy and data handling legislation.
IOPC reference
Recommendations
The IOPC recommends that Durham Constabulary should conduct a review into the way it shares people's personal and sensitive information with a view to ensuring relevant staff are appropriately trained and understand the powers they are using, and that processes comply with legislation and ICO expectations.
This recommendation has arisen following an IOPC review into a complaint where Durham Constabulary shared a person's personal and sensitive information with their university for safeguarding purposes. It became evident from the review, that the officers who shared the information were not familiar with the legislation or powers that govern information sharing, or the expectations of the Information Commissioner's Office (ICO) when such information is shared (for example: documenting the rationale for sharing).
Accepted
The force has disseminated the College of Policing Operational and Non-Operational “Managing Information” to all relevant officers and compliance is monitored. This is a national course aimed at all staff and takes accord of ICO Statutory Code of Practice on data sharing. The upcoming October 2024 “Managing Information” course includes information sharing both under an ISA / MOU or without one, for one-off sharing.
The new ICO Code of Practice is currently being considered for the new College of Policing Operational and Non-operational Managing Information course, that will be issued in October 2024.
The College of Policing share the view that for operational police officers, it is sufficient for them to justify their sharing of information. This is, that they acknowledge they have done it within an existing MOU or ISA and that the purpose of their case specific share was within the expressed terms as detailed in the MOU or ISA. Officers are not required to know the fine detail of ICO’s Code of Practice for data sharing (and / or also parts or schedules of the DPA 2018) – it is enough for them to be able to justify why the disclosure accords with the stated general reasons as detailed in any MOU or ISA and that is the justification for the disclosure.
As a result of this complaint and subsequent investigation the below link will be recirculated to all staff within the Durham Constabulary All-Circular email w/c 26th August 2024 as agreed by DCC Irvine. This is to ask all force staff to refresh their knowledge of data sharing and ensure staff who have not yet completed the mandatory College of Policing “Management of Information” course to do so.
Staff will be updated on the details of the new College of Policing course ahead of it’s launch in October 2024 and compliance of this course will be monitored.
For the above reasons, and in consultation with the Head of Information Rights and Disclosure it is the force’s view that it has complied with the recommendation. All relevant staff are appropriately trained on the sharing of information, to ensure legislation is adhered to.
It is of note in this complaint, that at the time of the disclosure in 2022, neither of the officers identified within the complaint, had completed the required mandatory College of Policing “Management of Information” training. This was completed by the officers concerned in March and April 2023.