Data protection concerns in a child abuse investigation

The Times reports that a senior figure at Ampleforth public school is under criminal investigation for alleged sex offences against boys.  The subject of the investigation has denied any wrongdoing.

On the 25th August, I talked about another report from Ampleforth concerning alleged child abuse. In that blog I talked about a school's duty to report alleged "misconduct" on the part of one of its teachers. 

Today I address the issue of data protection concerns, when a school is asked to assist the police with their enquiries in a criminal investigation.

In these cases, the police will probably ask to see the school's records, and they may ask for the personal records of other pupils/staff who have been mentioned in the complainants' statements. 

This kind of request raises data protection concerns, because a school's records may contain information that concern other people, who are nothing to do with the investigation or the police request. 

When the police request such information, they will normally submit a data protection form to the school, specifying precisely what they want to see. 

At its most basic level, the Data Protection Act 1998 forbids a school from disclosing other people's information except in certain circumstances, such in the context of a criminal investigation. 

The first Data Protection Principle says (Schedule 1 of the Act):-

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless--

(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."

"Processed" means disclosure to the police.

Schedule 2 of the Act describes the conditions necessary for processing i.e. disclosure of data. This includes (Para. 5) the administration of justice, or functions of a public nature. These categories would encompass a police investigation.

Schedule 3 of the Act relates to sensitive personal data. This type of information is racial/ethnic origin, political opinions, religious beliefs, trade union membership, physical/mental health, sexual life and criminal offences. Each of these may well be contained within the files requested by the police. A school can disclose this kind of data in circumstances similar to those in Schedule 2, i.e. a police investigation.

Furthermore Section 29(1) of the Data Protection Act 1998 states:-

“Crime and taxation.
1. Personal data processed for any of the following purposes--
a) the prevention or detection of crime,
b) the apprehension or prosecution of offenders, or
c) the assessment or collection of any tax or duty or of any imposition of a similar nature,

are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.”

Section 7 enables the data subject i.e. other pupils/staff to request details of what is being processed but they have to make the request first. 

Section 29(3) of the 1998 Act also states:-

"Personal data are exempt from the non-disclosure provisions in any case in which--

(a) the disclosure is for any of the purposes mentioned in subsection (1), and

(b) the application of those provisions in relation to the disclosure would be likely to prejudice any of the matters mentioned in that subsection."

Section 29(3)(b) is important because if the school redacts other people's information, which was contained in the requested files, it could be prejudicing the police investigation. So if Pupil A (whose records are requested) names Pupil B as a potential witness in the case, then the redaction of Pupil B's name could amount to prejudicing the investigation. That is a situation that may require legal advice. 

The Data Protection Act 1998 can be overridden by a court order. In civil compensation claims, where the Claimant wants to see the police file, then in my experience the police will expect that Claimant to secure a court order first of all. 

Generally speaking, the police are extremely careful to restrict the results of their investigation to the prosecution, who are then under certain duties as to what they disclose to the court and to the Defence in a criminal case. The process is also subject to control from the trial judge. It is however, quite common now in criminal proceedings for a person who is making a criminal complaint and a civil compensation claim, to have their solicitor's file disclosed to the Defence. Moreover information about a witness and their circumstances can come out during the course of trial.

There are also other potential pitfalls.  School files can contain information from the family and adoption courts. Again these are covered by data protection rules, but they also are covered by very strict rules contained within regulations and statutes which forbid their disclosure.