Necessity and proportionality: questions police must ask when considering sharing personal information with the public

Emily Keaney is the ICO's Deputy Commissioner for Regulatory Policy, and is responsible for overseeing the ICO’s policy work programme.

In February, the ICO announced it would be asking Lancashire Police to set out how they reached the decision to include personal information in media statements as they sought to find Nicola Bulley.

This was an important piece of work around a high profile case. We wanted to reassure the public that there are rules in place to protect how personal information is used and shared. And we wanted to be clear that while police can disclose information to protect the public and investigate crime, they would need to be able to demonstrate such disclosure was necessary and proportionate.

We have now spoken with Lancashire Police to better understand the steps they took before releasing information. We heard in those conversations the challenging nature of considering whether and how to share personal information during fast paced, important cases. Based on our conversations with Lancashire Police, we don’t consider this case requires enforcement action. We’ll be able to provide further details around this decision following the inquest into Nicola Bulley’s death.

While this concludes our work with Lancashire Police, it is clear that their consideration of what information to share during a fast-paced case is a challenge all police could face. We therefore wanted to share the wider lessons all police can benefit from.

Data protection law does not prevent police from doing their job. It is part of helping police do that job well. The law specifically considers the challenges law enforcement organisations may face using personal data, and asks police to consider the risks of disclosing information alongside the valuable role disclosure can play in an investigation, in particular when police are calling on the public’s help to find a missing person.

Police can better understand their legal requirements by asking themselves the following questions:

1. Is sharing this information necessary? If it is important the public know something sensitive about a missing person, then the law provides ways information can be shared. But it is important to think about whether there are alternatives to disclosure that would also achieve your objectives.
2. Is sharing this information proportionate? You need to consider any harm or detriment that may come from sharing information, and make sure this does not outweigh what you are trying to achieve. This is particularly important for sensitive information. The law specifically sets a higher standard for sharing information about someone’s health, for instance.
3. Will there be an impact on others? It is important to consider who else might be affected by any disclosures: sharing information about one individual may also have an effect on the privacy rights of their family and friends.
4. Are you recording the factors being considered in your decision making? As the Lancashire Police case has shown, there will be times when the ICO expects police to set out how they reached a decision to disclose information.
5. What is the Data Protection Officer’s view? When it comes to answering all of these questions, the police’s DPO will be ideally placed to draw together their knowledge of data protection, as well as their understanding of their organisation’s operating processes, to help consider the balance between privacy, the public interest, and the interests of all those involved.

By considering the factors we are sharing today, police can make informed decisions about how to respect people’s data protection rights during fast-moving and high-profile investigations while still getting the job done. We’ll continue to offer our advice and support to police, and will be sharing these tips more widely.