Preventing crime, protecting the public and helping those in need
The Data Protection Act 1998 gives us all certain rights. It allows us to find out what information is held about us on a computer, and some paper records. This is known as a "Right of Subject Access".
It also states that people recording and using personal information must be open about how the information is used. Anyone processing 'personal data' must comply with the eight principles of good practice. These state that data must be:
Find out how we handle your information and your individual rights of access.
Read some of the frequently asked questions regarding Data Protection and West Midlands Police. If you cannot find the answer to your question there please contact:
This explains how West Midlands Police obtains, holds, uses and discloses information about people, the steps we take to ensure that it is protected, and the rights individuals have to it.
The use and disclosure of personal information is governed in the United Kingdom by the Data Protection Act 1998 ('the Act'). The Chief Constable of West Midlands Police is registered with the lnformation Commissioner as a 'data controller' for the purposes of the Act. As such, the Chief Constable is obliged to ensure that West Midlands Police handles all personal information in accordance with the Act.
West Midlands Police takes that responsibility very seriously and takes great care to ensure that personal information is handled appropriately in order to secure and maintain individuals' trust and confidence in the force.
West Midlands Police obtains, holds, uses and discloses personal information for two broad purposes:
a.) The Policing Purpose - which includes the prevention and detection of crime; apprehension and prosecution of offenders; protecting life and property; preserving order; maintenance of law and order; rendering assistance to the public in accordance with force policies and procedures; and any duty or responsibility of the police arising from common or statute law.
b.) The provision of services to support the Policing Purpose - which include:
In order to carry out the purposes described under Section 1 above West Midlands Police may obtain, use and disclose (see Section 7 below) personal information relating to a wide variety of individuals including the following:
West Midlands Police will only use appropriate personal information necessary to fulfil a particular purpose or purposes. Personal information could be information which is held on a computer, in a paper record such as a file, as images, but it can also include other types of electronically held information such as CCTV images.
In order to carry out the purposes described under Section 1 above West Midlands Police may obtain, use and disclose (see Section 7 below) personal information relating to or consisting of the following:
In order to carry out the purposes described under Section 1 above West Midlands Police may obtain personal information from a wide variety of sources, including the following:
West Midlands Police may also obtain personal information from other sources such as its own CCTV systems, or correspondence.
In order to achieve the purposes described under Section 1 West Midlands Police will handle personal information in accordance with the Act. In particular we will ensure that personal information is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal information used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up-to-date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals' rights under the Act (see Section 8 below).
West Midlands Police takes the security of all personal information under our control very seriously. We will comply with the relevant parts of the Act relating to security, and seek to comply with the Association of Chief Police Officers' Community Security Policy and relevant parts of the 1S027001 Information Security Standard.
We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal information contained within them. These procedures are continuously managed and enhanced to ensure up to date security.
In order to carry out the purposes described under Section 1 above West Midlands Police may disclose personal information to a wide variety of recipients in any part of the world, including those from whom personal information is obtained (as listed above). This may include disclosures to other law enforcement agencies, partner agencies working on crime reduction initiatives, partners in the Criminal Justice arena, Victim Support, and to bodies or individuals working on our behalf such as IT contractors or survey organisations. We may also disclose to other bodies or individuals where necessary to prevent harm to individuals.
Disclosures of personal information will be made on a case-by-case basis, using the personal information appropriate to a specific purpose and circumstances, and with necessary controls in place.
Some of the bodies or individuals to which we may disclose personal information are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal information to such territories, we will take proper steps to ensure that it is adequately protected as required by the Act.
West Midlands Police will also disclose personal information to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Support Agency, the National Fraud Initiative, and the Home Office and to the Courts.
West Midlands Police may also disclose personal information on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.
Individuals have various rights enshrined in the Act:
The most commonly exercised right is that used by individuals to request, in writing, a copy, subject to exemptions, of their personal information processed by West Midlands Police. Details of the application process, known as 'Subject Access' can be found in the WA162 form.
Under Section 10 of the Act an individual is entitled, in limited circumstances, to write to West Midlands Police requiring that we do not handle their personal information in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person.
Requests under Section 10 must describe the personal information involved; describe the handling to which the individual objects; state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another; describe the damage or distress; state that the damage or distress was/would unwarranted; and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.
All requests of this nature may be sent in writing to the Data Protection Unit, West Midlands Police (see Section 10 below). It is worth noting that the Act includes certain provisions which may mean in a particular case West Midlands Police can continue to handle the personal information as intended despite the objection.
Although West Midlands Police does not engage in direct-marketing, under Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing that West Midlands Police stops, within a reasonable time, or does not start, using their personal information for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals. Any requests under Section 11 may be sent to the Data Protection Unit, West Midlands Police (see Section 10 below).
Although West Midlands Police is unlikely to carry out any automated decision-taking that does not involve some human element, under Section 12 of the Act, and subject to certain exemptions, an individual has the right to require that West Midlands Police ensures that no decision that would significantly affect them is taken by West Midlands Police or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply.
Requests under Section 11 may be sent to the Data Protection Unit, West Midlands Police (see Section 10 below).
Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers
Under Section 13 of the Act any individual who believes they have suffered damage and/or distress as a result of any contravention of the requirements of the Act, may be entitled to compensation from West Midlands Police where the force is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement.
Any claim for compensation arising from this provision may be sent to the Legal Services Department, West Midlands Police, PO Box 52, Birmingham B4 6NQ.
Under Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal information handled by West Midlands Police. The right cannot be exercised directly to West Midlands Police.
Right to request the lnformation Commissioner to assess a data controller's processing
Under Section 42 of the Act any person can request the lnformation Commissioner to make an assessment if they believe that they are or have been adversely affected by the handling of personal information by West Midlands Police. Such requests should be made direct to the lnformation Commissioner whose contact details can be found below.
Generally, if individuals have any concerns regarding the way their personal information is handled by West Midlands Police or the quality (accuracy, relevance, non-excessiveness etc.) of their personal information they are encouraged to raise them with the Data Protection Unit, West Midlands Police (see Section 10 below).
The lnformation Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act's requirements. The lnformation Commissioner's Office may be contacted using the following:
West Midlands Police keeps personal information as long as is necessary for the particular purpose or purposes for which it is held. Personal information which is placed on the Police National Computer is retained, reviewed and deleted in accordance with agreed national retention periods which are subject to period change.
Other records containing personal information relating to intelligence, custody, crime, firearms, child abuse investigations, domestic violence will be retained in accordance with the ACPO endorsed.
Guidance on the Management of Police lnformation 2010.
West Midlands Police may monitor or record and retain telephone calls, texts, emails and other electronic communications to the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under Section 1 above.
West Midlands Police does not place a pre-recorded 'fair processing notice' on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.
Any individual with concerns over the way West Midlands Police handles their personal information may contact the Data Protection Unit as below:
Personal information is managed in accordance with the following legislation and policy:
Reference will also be made to relevant case law and to legal guidance and codes of practice issued by the Information Commissioners Office (ICO).
The person ultimately responsible for the management of personal information by West Midlands Police is the Chief Constable. All employees of West Midlands Police act as the representatives and agents of the Chief Constable.
West Midlands Police has notified the Information Commissioner’s Office (ICO) that personal information is held and used for the following purposes:
Provision of necessary services to support the Policing Purpose including:
Full details of West Midlands Police notification can be obtained from the ICO’s website.
Disclosure or passing of personal information to other organisations or individuals is strictly controlled. There are some occasions when we will pass personal information to other official agencies because we are required to do so by law or because that agency has a legitimate reason supported by legislation to be given the information. For example: the Health and Safety Executive when investigating accidents, the Inland Revenue when investigating tax fraud and Social Services when considering child protection and welfare.
The Police work in partnership with other agencies to reduce crime and disorder, reduce the fear of crime and protect the vulnerable. In order to work together it is necessary to share information. Often this information is about crime figures or areas where crime or disorder is a particular problem. However, sometimes it is necessary to share personal information to tackle a particular problem involving an identified offender or victim.
Sometimes information is shared to assist the partner agency in carrying out their lawful functions, but only when it is necessary and proportionate to do so. Agencies we work in partnership with include:
The Data Protection Act provides the right for the individual to request a copy of personal information held about them by a data controller. This is known as 'subject access' (see Section 7 of the Data Protection Act 1998).
If you would like to request a copy of your personal information which may be held by West Midlands Police you are required to complete a subject access application form.
Many people need this information for a variety of reasons. You will be asked to complete an ACRO SAR1 in order to provide the information necessary to search against police records. You will also be required to provide two documents that prove your identity and a fee of £10 is charged. More information is given on the form.
The Association of Chief Police Officers Criminal Records Office (ACRO) based at Fareham, Hampshire, carries out these checks on behalf of West Midlands Police. When you complete form ACRO SAR1 you need to send it directly to ACRO and all queries about the progress of and response to your application must be made with ACRO.
ACRO will reply directly to you at the postal address you give on the form. The reply will take the form of a letter, which has a watermark and two blue bands to identify it as an authentic record.
The Data Protection Act requires that you are given a response to any request for your personal information within 40 days. On average, ACRO respond within 14-30 days. Occasionally, due largely to volumes, responses may take the full 40 day period.
Such a request is managed via subject access. You will be asked to complete an in-house data protection form WA162 in order to provide the information necessary to search against our records.
You will also be required to provide two documents that prove your identity and a fee of £10 is charged. More information is given on the form. You may make such a request through your solicitor if appropriate, and give your authority for the information to be disclosed directly to them.
Subject access does not entitle you to receive information that might identify another person, known as a third party. If possible and appropriate we may contact the third party and ask for their consent to disclose their information to you. If we cannot obtain their consent the information may be removed, in the case of whole documents, or obscured in the case of information contained within a document. The Data Protection Act requires that you are given a response to any request for your personal information within 40 days. We will always try to respond to your application in the early part of this period. However, if the enquiry is particularly complicated or there is a lot of information to locate, check and reproduce, the response may take the full 40-day period to reach you.
The Data Protection Act 1998 does contain some exemptions from providing information following a subject access request. In brief, those most likely to be relevant to information held by the police are:
Subject Access entitles you to computerised records, except when an exemption is relevant. Manual or paper records are included if they are held in a 'relevant filing system'. This term is used in the Data Protection Act 1998. Such a system will be managed in a way that is similar to a computer system so that specific information about a person is easily located, using indexes, reference numbers, file dividers etc.
It may be the case that information about you or provided by you is held by West Midlands Police in paper form and in an unstructured format, that is, it cannot be easily located without looking through large volumes of information. Section 9A of the Act provides an exemption relating to unstructured personal data where the estimated cost of complying with section 7(1) would exceed the appropriate fee limit – currently £450 or 18 person / working or equivalent-hours. The exemption does not cover the need to inform the applicant whether their personal data is being processed unless to do so alone would exceed the appropriate fees limit.
The following is provided as an example where section 9(A) would likely to be utilised:
Application seeking access to personal data held in large unstructured crime file dating from the 1960s where the appropriate fee limit was likely to be breached.”
The Data Protection Act contains a number of exemptions that may be applied to refuse disclosure of information. More information about these exemptions can be found on the Information Commissoners Office website. Please note that the legislation does not require that the applicant is informed when an exemption has been applied.
You cannot be forced by an employer to make a subject access application in order to provide to them proof of your criminal record. In the near future it will become an offence under the Data Protection Act 1998 for an employer to require an employee or candidate for employment to make a subject access request for this purpose. Most types of employment are subject to the Rehabilitation of Offenders Act 1974, meaning that a person does not need to declare a conviction if a certain amount of time has passed and no further offences have been committed.
If you chose to make a subject access request for this purpose you should make an application using form ACRO SAR1. However, you should be aware that the response will include all conviction records, including any that you are not required to declare to an employer under the Rehabilitation of Offenders Act.
The government agency Disclosure Scotland provides a Basic Check which includes only those convictions that a person would have to declare. You can apply for this check yourself by going to www.disclosurescotland.co.uk/ or calling 0870 609 6006.
Please see the next questions if your work will involve access to children, vulnerable adults or the elderly.
You should not use the subject access procedures if your work will involve these categories of people. The Disclosure and Barring Service (DBS) has been established by the Home Office to provide employers with a means of checking the criminal background of potential employees.
If you will be working or volunteering with children, vulnerable adults or the elderly you should ask your employer to contact the Disclosure and Barring Service on 0870 9090811 or go to the Disclosure and Barring Service website.
If you are self-employed and will have access to children or vulnerable adults you should seek advice from the Disclosure and Barring Service. A number of employment/recruitment agencies have become registered bodies and can facilitate a DBS check for you – they may charge an administration fee.
The Data Protection Act 1998 gives you the right to request that inaccurate information is corrected or deleted. You can also request that your information is no longer used or held if you can show that you are being caused significant and unwarranted damage or distress. In some cases you might be entitled to compensation.
Making such a request will not automatically result in the information being changed or removed. If West Midlands Police can show that the information is necessary and relevant to its lawful and legitimate functions as a police force the information will be retained.
Click here to view all our latest news stories
Click here for our latest campaign
Click here for more information
Get advice on fines, payment and speed awareness courses here
Get help and advice here
Answers to questions we are often asked
If it's not an emergency call us: 101
If life is in danger or a crime is in progress: 999
More ways to contact us
Contact your local team by entering your postcode:
Copyright West Midlands Police