Where an employer has been asked by the police to provide information on an employee, will data protection laws prevent it from complying with the request?
Data protection legislation will not always prevent an employer from providing information requested by the police, but this depends on the nature of the information and the reason for the request. The Data Protection Act 2018, which supplements the provisions of the UK General Data Protection Regulation (retained from EU Regulation 2016/679 EU) (UK GDPR), contains an exception that would allow the employer to disclose information about the employee for the purposes of prevention or detection of crime or the apprehension or prosecution of offenders, where the application of certain provisions of the UK GDPR would otherwise prejudice this. The employer is exempt from the duty to inform the employee that the data is being processed and from the requirement that it be processed fairly and transparently. Therefore, provided that the police have confirmed that the information is required for the prevention or detection of crime or the apprehension or prosecution of offenders, the employer can supply it without contravening the UK GDPR.
Information that specifically relates to a criminal offence attracts additional protection under the UK GDPR. However, the Data Protection Act 2018 includes a further exception, authorising processing of such information if this is necessary for the prevention or detection of unlawful acts.