Relying on consent
This page provides an overview of the circumstances when we might ask an individual to provide us with their consent. It clarifies which instances of consent give us the lawful basis to do something with personal information and where this is the case, it also explains an individual’s data protection rights.
Last updated: March 2024
Background
The Data Protection Act 2018 and UK General Data Protection Regulation require an organisation to ensure it has a lawful reason for using or sharing information about people. There are several options known as a lawful basis within the data protection regime, one of which a lawful basis called ‘consent’.
As a law enforcement body and an employer, we will often have duties outlined in law which permit us to do something with people's information. This means we will usually have a more appropriate lawful basis that we can rely on instead of consent and we will only rely on consent as a lawful basis in very limited circumstances.
Consent as a lawful basis is used in the following scenarios
- taking part in some surveys
- allowing us to request the disclosure of medical records from a medical professional
- allowing us to share details with certain support services (for example, suicide support and independent domestic violence advocate)
- when the insurance industry requests us to disclose reports relating to property crime (outlined by the ACPO/ABI Memorandum of Understanding)
- when people produce an article containing highly sensitive information and request it to be published by us for the purpose of educating or informing members of the Constabulary about a topic, genre or an event
- allowing us to disclose dyslexia screening detail/outcomes to a line manager of one of our employees (for further support purposes) or to psychologist (exceptional circumstances)
- allowing us to take DNA and fingerprints in certain circumstances such as volunteer eliminations
Your rights when we use consent as a lawful basis
Where we have relied on your consent as a lawful basis to do something with your data, you will have the right to withdraw your consent. You will also have a greater right to ask us to erase your data.
You can usually withdraw your consent by contacting the relevant staff who have been dealing with you. However, you can also contact our data protection officer to exercise these rights via email or by telephone 101.
You also have a right to complain to the data protection regulator (the ICO) and to apply to a court under section 162 of the Data Protection Act 2018. The ICO can be contacted via the ICO website or by telephone (0303 123 1113).
Other use of the word ‘consent’
We may sometimes use the word ‘consent’ as an indication of your co-operation or preference but it is not considered a lawful basis under data protection law. This means you will not have the same right to withdraw consent or ask for erasure.
Examples of where this occurs are:
Sharing details with partners about vulnerable people
The word consent in this context stems from the Care Act 2014. We ask if a person consents for us to share as this provides an indication of preference and whether that person is likely to co-operate with a partner agency.
Sending a text message
Our call operators ask if a person consents to us sending a text message as a means of communication instead of sending a letter. We seek a preference for communication in these circumstances so that we can comply with The Victim's Code of Practice.
Taking DNA for internal recruitment purposes
We ask prospective employees to provide consent as a form of permission for to us take their fingerprints and DNA during the recruitment process. Consent as a lawful basis does not apply for this process as it is required by regulations (for officers and police specials) and as part of the contract of employment with PCSOs and certain staff roles.
Disclosure of witness statements
The word 'consent' is used as an indication of preference in relation to possible future disclosures of a person’s witness statement (for example, for purposes of civil or other proceedings). We are likely to have a legal obligation to disclose in these instances (such as a court order) or it will be covered by a specific data protection exemption. However, we will consider the person’s preference and any need to remove personal identifiable detail from the statement before disclosing it.