Where an employer has been asked by the police to provide information on an employee will the requirements of the Data Protection Act 1998 prevent it complying with the request?
No, in most cases the Data Protection Act 1998 will not prevent an employer providing information requested by the police. Under s.29 of the Act, personal information that is processed (and for these purposes processing would include disclosure to the police) for the purpose of the prevention or detection of crime or the apprehension or prosecution of offenders is exempt from the non-disclosure provisions, from the right of subject access and from the requirement that personal data be processed fairly and lawfully, in any case in which the application of those provisions to the personal information would be likely to prejudice these matters. The principal purpose of the police is the prevention and detection of crime. Thus, provided that the police have confirmed that the information is required for this purpose, or for the purpose of the apprehension or prosecution of offenders, and failure to supply it is likely to prejudice this, the employer can supply it without contravening the Act.
Information that specifically relates to the commission or alleged commission of an offence is classed as "sensitive personal data" under the Act. The Act contains various exceptions to the general principle that sensitive personal data cannot be processed without the employee's explicit consent. While none of these specifically refers to allegations of criminal conduct, there are exceptions for the purposes of establishing, exercising and defending legal rights, for the administration of justice or for the exercise of any functions conferred by statute. There are also exceptions contained in the Data Protection (Processing of Sensitive Personal Data) Order 2000 (SI 2000/417). These include where the processing is in the substantial public interest, is necessary for the purposes of the prevention or detection of any unlawful act, and must necessarily be carried out without the explicit consent of the data subject so as to not prejudice those purposes. There is also an exception where the processing is necessary for the exercise of any functions conferred on a police officer by any rule of law. There should, therefore, be scope for the employer to rely on these exemptions in disclosing personal information relating to the commission of a criminal offence to the police without the employee's explicit consent.