Crime compatibility condition
In detail
What is the crime compatibility condition?
You may specifically collect and use personal information for the purposes of detecting, investigating or preventing crime. For example, you may install a CCTV surveillance system for this purpose. In this case, you expect to use and share the personal information you collect for these purposes.
However, in some situations, you may collect personal information without expecting to use or share it for detecting, investigating or preventing crime. But using personal information in this way can help protect people from harm and can serve the interests of society. Data protection law allows you to reuse personal information where it is necessary to:
- prevent and report crimes; or
- prosecute offenders (including suspected offenders).
Annex 2 says:
“Crime
6. This condition is met where the processing is necessary for the purposes of—
(a) detecting, investigating or preventing crime, or
(b) apprehending or prosecuting offenders.”
We call this the ‘crime compatibility condition’ (although this term is not used in the legislation itself. The UK GDPR doesn’t give definitions for the different purposes listed in this compatibility condition. But you can rely on their ordinary meaning when deciding if you can meet the condition.
A variety of economic crimes are included in the scope of this condition, including:
- money laundering;
- financing terrorists; and
- committing scams and fraud against people or organisations.
How do we apply the crime compatibility condition?
To apply the crime compatibility condition, you must:
- intend to reuse the personal information to help:
- detect, investigate or prevent a crime, or
- catch and prosecute an offender or suspect; and
- ensure that reusing the personal information is necessary for this purpose.
You must satisfy a lawful basis for reusing personal information in this way. Remember, if you originally collected the personal information under the lawful basis of consent, you must consider whether it is reasonable to ask for consent for the new processing. In the context of the crime condition, it’s less likely this is reasonable.
In most cases, it’s likely that you can rely on recognised legitimate interest and the crime condition for this purpose. This is virtually identical to the annex 2 compatibility condition and is likely intended to complement it. However, not all organisations that handle personal information relating to crime can rely on recognised legitimate interest. For example, you cannot use it if you’re a:
- public authority that needs to handle criminal offence data as part of your tasks; or
- competent authority processing information under part 3 of the Data Protection Act 2018 (the DPA).
If you’re handling criminal offence data, you must also meet the requirements of article 10 of the UK GDPR. In some cases, reusing personal information under the crime compatibility condition may involve special category data. If so, you must also meet a condition for processing in article 9 of the UK GDPR, in addition to identifying a lawful basis.
If you can satisfy the crime condition of the recognised legitimate interest lawful basis, you’ll likely be able to satisfy an appropriate condition for processing criminal offence data from the DPA.
Example
A company receives a complaint from a member of the public about an alleged assault by one of its employees. The employee denies being on site at the time of the alleged incident.
The company maintains an attendance sign-in system for health and safety reasons. It decides it needs to reuse the personal information it holds on the system to check for evidence of whether the employee was on site during the alleged incident.
It also receives a request from the police for information relating to the alleged assault.
The company decides it’s necessary to reuse the information for the purposes of detecting, investigating and prosecuting crime. It therefore decides it can rely on the crime compatibility condition to further use the employee’s attendance information for the date of the alleged incident. The further use includes sharing this information with the police.