what is a dpia?
a dpia is a process designed to help organisations identify and minimise the data protection risks of a project. where the processing (eg obtaining or recording) of personal data (eg names, addresses and information about racial or ethnic origin) is likely to result in a high risk to individuals, a dpia needs to be completed. for more information, read data protection impact assessments.
what is criminal offence data?
criminal offence data is personal data that relates to criminal convictions and offences or related security measures. this includes information about:
-
criminal activity
-
allegations (including unproven allegations)
-
investigations
-
proceedings
-
personal data of victims and witnesses of crime
-
personal data about penalties
-
conditions/restrictions placed on someone as part of the criminal justice process
-
civil measures that may lead to a criminal penalty if not adhered to
for more information, read the information commissioner’s office (ico) guidance.
processing criminal offence data
organisations can only process criminal offence data if they have a lawful basis for processing. this means that at least one of the six grounds for processing (eg consent or public interest) is met. it is important to note that employers should not rely on consent as their lawful basis for processing if they need to carry out dbs checks on potential employees, as it would not constitute valid consent under the uk gdpr. however, employers must obtain potential employees' consent before carrying out disclosure and barring service (dbs) checks on them. for more information on this, read compliance for dpias.
even after a lawful basis for processing has been established, criminal offence data can only be processed if the processing is either carried under the control of official authority or authorised by domestic law.
processing under the control of official authority
if the processing of criminal offence data is carried out ‘under the control of official authority’ no further authorisation under uk law is needed. moreover, organisations may only keep a comprehensive register of criminal convictions if the register is ‘under the control of official authority’.
public bodies (and private bodies given public sector tasks) may have such ‘official authority’ to process criminal offence data set out in the law. a body claiming such ‘official authority’ is responsible for identifying the specific law granting them the authority to process criminal offence data. further, if the body wishes to maintain a comprehensive register of criminal convictions, they will need to consider if they have sufficient official authority to do so.
for example, the dbs, courts and dvla have specific official authority to process criminal offence data they hold, in addition to keeping a comprehensive register.
processing authorised by domestic law
where there is no official authority to process criminal offence data, any such processing must be authorised by uk law. this means that one of the 28 conditions set out in the data protection act 2018 (dpa) needs to be met.
organisations will need to identify which of the conditions for processing criminal offence data most closely reflects their purpose. reference will need to be made to the detailed provisions of each condition to demonstrate that the condition applies to the specific situation. if an organisation’s purpose for processing is not covered by any of the conditions the criminal offence data cannot be processed (regardless of how good the reason for processing is).
most of the 28 conditions rely on the organisation demonstrating that the processing is necessary for a specific purpose. being ‘necessary’ doesn’t mean that the processing has to be absolutely essential, but it must be more than useful or habitual. it must also be a targeted and proportionate way of achieving the purpose. the processing is not necessary if the organisation can reasonably achieve the same purpose by less intrusive means and if it can do so by using data unrelated to criminal offences.
conditions for processing
to be able to demonstrate that the processing is authorised by uk law, organisations need to meet one of the following conditions:
employment, social security and social protection |
this condition is met if the processing is necessary for performing (or exercising) obligations (or rights) imposed (or conferred) by law on the organisation or the data subject (ie the individual the data relates to) in connection with employment, social security or social protection. read compliance for dpias (specifically the associated conditions in the ‘employment, social security and social protection’ section) for more information on what exactly this means. |
health or social care purposes |
the processing is necessary for health or social care purposes. read compliance for dpias (specifically the associated conditions in the ‘health or social care’ section) for more information on what exactly this means. |
public health |
the processing is necessary for reasons of public interest in the area of public health and is carried out:
read compliance for dpias (specifically the associated conditions in the ‘public health’ section) for more information on what exactly this means. |
research |
the processing is:
read compliance for dpias (specifically the associated conditions in the ‘archiving, research and statistics’ section) for more information on what exactly this means. |
statutory and government purposes |
the processing is necessary for the exercise of a function:
|
administration of justice and parliamentary purposes |
the processing is necessary for:
|
preventing or detecting unlawful acts |
the processing is:
|
protecting the public against dishonesty |
the processing is necessary for the exercise of a protective function. this is an action intended to protect members of the public against:
the processing must also be carried out without the data subject’s consent in order to not prejudice the exercise of that function. |
regulatory requirements |
the processing is necessary to comply with (or assist others to comply with) a regulatory requirement involving a person taking steps to establish whether another person has:
in these circumstances, the organisation cannot reasonably be expected to obtain the consent of the data subject to the processing. |
journalism, academia, art and literature |
the processing:
|
preventing fraud |
the processing is necessary to prevent fraud or a particular kind of fraud and:
an anti-fraud organisation is any body corporate, unincorporated association or other person that enables or facilitates any sharing of information to prevent fraud or a particular kind of fraud or which has the prevention of fraud or any kind of fraud as its purpose (or one of its purposes). |
suspicion of terrorist financing or money laundering |
where the processing is necessary to make a disclosure in good faith under the:
|
counselling |
the processing is:
|
safeguarding of children and individuals at risk |
the processing is:
|
elected representatives responding to requests |
the processing is:
where the request is made by someone other than the data subject, the above conditions are met only if the processing must be carried out without the data subject’s consent for one of the following reasons:
|
disclosure to elected representatives |
this condition is met if the:
where the request to the elected representative is made by someone other than the data subject, the above conditions are met only if the disclosure must be made without the data subject’s consent for one of the following reasons:
|
informing elected representatives about prisoners |
this condition is met if the:
|
publication of legal judgments |
the processing:
|
anti-doping in sport |
the processing is necessary for the purposes of:
|
standards of behaviour in sport |
the processing:
‘measures designed to protect the integrity of a sport or a sporting event’ means measures to protect a sport of sporting event against:
|
consent |
this condition is met if the data subject has given consent to the processing. read compliance for dpias (specifically the ‘explicit consent’ section) for more information on what exactly this means. |
vital interest |
the processing is necessary to protect the vital interests of an individual and the data subject is incapable of giving consent (physically or legally). read compliance for dpias (specifically the ‘vital interest’ section) for more information on what exactly this means. |
not-for-profit bodies |
the processing is carried out in the course of the body’s legitimate activities (with appropriate safeguards), and:
read compliance for dpias (specifically the ‘not-for-profit bodies’ section) for more information on what exactly this means. |
manifestly made public by the data subject |
the processing relates to personal data which is manifestly made public by the data subject themselves. read compliance for dpias (specifically the ‘made public by the data subject’ section) for more information on what exactly this means. |
legal claims |
the processing is:
read compliance for dpias (specifically the ‘legal claims or judicial acts’ section) for more information on what exactly this means. |
judicial acts |
the processing is necessary when a court or tribunal is acting in its judicial capacity. read compliance for dpias (specifically the ‘legal claims or judicial acts’ section) for more information on what exactly this means. |
administration of accounts used in the commission of indecency offences involving children |
this condition is met the processing is of personal data about a conviction or caution for an offence listed below:
further, the processing must be necessary for the purpose of administering an account relating to the payment card (including credit, charge and debit cards) used in the commission of the offence or cancelling that payment card. |
insurance |
this condition is met if the processing would meet:
but for the requirements for the processing to be of a category of personal data revealing racial/ethnic origin, religious/philosophical beliefs, genetic data/data concerning health or trade union. |
for some of the above conditions, an appropriate policy document (apd) must be in place at the time of processing. for more information, read appropriate policy documents and the ico’s guidance on processing criminal offence data.
if you have any questions or require assistance, ask a lawyer.