What is criminal offence data, and when can you use it?

What it is

Article 10 UK GDPR restricts processing of personal data relating to criminal convictions and offences or related security measures. The DPA 2018 extends the meaning to include the alleged commission of offences, proceedings for offences and their disposal, including sentencing. DBS checks, records of suspected offences and court outcomes are all covered.

When you can process it

• Under the control of official authority, such as the police or a court. UK GDPR Art 10
• Where a condition in DPA 2018 Sch 1 Parts 1, 2 or 3 is met, for example employment obligations, preventing or detecting unlawful acts, or consent. DPA 2018 s.10(5); Sch 1
• You must also have an Art 6 lawful basis for the processing. UK GDPR Art 6

What is not covered

• Processing by competent authorities for law enforcement purposes: that falls under Part 3 of the DPA 2018, not Art 10. DPA 2018 Part 3

Who is responsible

The controller, which must identify the Schedule 1 condition and, for most conditions, keep an appropriate policy document. A comprehensive register of criminal convictions may only be kept under official authority.

What it involves

1. Confirm an Art 6 basis.
2. Identify the Sch 1 condition.
3. Keep an appropriate policy document where the condition requires one.
4. Limit access tightly and set retention periods.

If it goes wrong

Regulatory

Processing without official authority or a Schedule 1 condition breaches Art 10 and is unlawful processing under the lawfulness principle in Art 5(1)(a). A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

Requiring someone to obtain their own criminal records through a subject access request as a condition of employment or a service is an offence under DPA 2018 s.184 (unlimited fine). Unlawful obtaining or disclosure is an offence under s.170.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.