Enacting Other Rights Under Data Protection Legislation

There are various rights enshrined within data protection legislation that allow an individual to ask the Police Service of Northern Ireland to request the erasure, rectification, and restriction of personal data. We will process these requests in line with our legislative obligations. This does not mean that we will delete offending histories including court convictions when requested as a matter of routine.

There is no legislative definition of what a criminal record is, what it should contain and what should be excluded from it. The Police Service of Northern Ireland holds a broad range of criminality information including convictions, diversions and other penalties, procedural records such as arrests and acquittals and ‘intelligence’ information. We will access information held on the Police National Computer (PNC) and will have locally held police information on our systems. All of these sources make up an individual’s criminal history information held by the Police Service of Northern Ireland. There are important reasons why criminal history information should be retained, and to delete this may create significant safeguarding, public protection and other associated law enforcement risks.

There are a broad range of criminal justice organisations in Northern Ireland, including the Police Service of Northern Ireland, that hold and share information for legitimate and lawful purposes in relation to an individual’s ‘criminal history’. Since 2002, we have joined a number of criminal justice organisations including Forensic Science Northern Ireland, the Public Prosecution Service, the Northern Ireland Courts and Tribunal Service, the Northern Ireland Prison Service and the Probation Board for Northern Ireland to implement a jointly owned system known as Causeway.

The Police Service of Northern Ireland processes a large range of data for policing purposes including details of convictions, diversions and other penalties, investigative information including records such as arrests, intelligence information as well as biometric data. Once a person has been charged or reported for an offence, the Causeway system tracks the case through the Criminal Justice process and facilitates access to an individual’s criminal history, including information uploaded to the Causeway system by us. Access is granted based on statutory and business need, with significant safeguards built into this system to protect the personal data.

Where an individual is or has been investigated for one or more ‘Recordable offences’ (as defined by the Police and Criminal Evidence (Northern Ireland) Order 1989) the Police Service of Northern Ireland will upload this information to the Police National Computer (PNC). This is accessible by all UK Police Services, law enforcement agencies and other registered bodies across the United Kingdom for policing and other regulated processes.

In order to discharge our statutory obligations, the Police Service of Northern Ireland retains individual criminal history information for 100 years from the person’s date of birth. There is provision for deletion or amendment of a criminal history in exceptional circumstances, for example inaccurate information, attributed to the wrong individual, the court outcome is recorded incorrectly, or misspelling of a person’s name.

Any individual who wishes to dispute their court conviction may wish to obtain legal advice about making an appeal to the court. The Police Service of Northern Ireland does not have a mechanism for amending information held in relation to court outcomes.

Will my criminal history be automatically disclosed on a pre-employment check?

AccessNI was established in 2008 and assumed responsibility for pre-employment checking in Northern Ireland. A basic, standard or enhanced AccessNI check will disclose different types of information about an individual’s criminal record and criminal history to an employer. Some cautions, fines, offences and spent convictions will not appear however convictions for certain crimes stay unspent and will always appear on a criminal record. Part V of the Police Act 1997 requires AccessNI, on receipt of an application for an ‘Enhanced’ criminal records check, to ask the Police Service of Northern Ireland whether any information is held which ”might be relevant” for the job in question and ”ought to be” included in the certificate. The Police Service of Northern Ireland applies standards referred to as the ‘Quality Assurance Framework’ to determine whether any information is relevant and whether it ought to be disclosed. The Quality Assurance Framework is used by all UK police services to process, consider and disclose police information. We will not therefore automatically disclose previous offending behaviour or criminal history information for enhanced employment vetting checks submitted by AccessNI. Disclosure will be in line with established frameworks and public protection requirements, taking into account a variety of factors including the nature of the offending, whether the offence is ‘stepped down’, as well as the role for which the individual has applied.

Information about AccessNI checks can be obtained online on the nidirect website or by phoning AccessNI on 0300 200 7888.

For personal data being processed under the law enforcement provisions the following rights are applicable to individuals in certain circumstances, as noted below.

The right to rectification

You shall have the right to obtain from the Police Service of Northern Ireland without undue delay for the rectification of inaccurate or incomplete personal data concerning you. Also included in this right is to have a supplementary statement added to your personal information. 

Where the Police Service of Northern Ireland would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, we must (instead of rectifying the personal data) restrict its processing.

The right to erasure or restriction of processing

The Police Service of Northern Ireland must erase personal data without undue delay where, (a) the processing of the personal data would infringe the data protection principles and aspects of safeguarding of data or, (b) the Police Service of Northern Ireland has a legal obligation to erase the data.

Where we would be required to erase personal data but the personal data must be maintained for the purposes of evidence, we must (instead of erasing the personal data) restrict its processing.

Where you contest the accuracy of personal data, but it is not possible to ascertain whether it is accurate or not, the Police Service of Northern Ireland must restrict its processing.

Rights in relation to automated decision making and profiling

Significant decisions, based solely on automated processing cannot be taken unless required or authorised by law.

For these purposes a “significant decision” is the following:

     a) Produces an adverse legal effect concerning you, or

     b) Significantly affects you.

For personal data being processed under GDPR the following rights are applicable to individuals in certain circumstances, as noted below.

The right to rectification

You shall have the right to obtain from the Police Service of Northern Ireland without undue delay the rectification of inaccurate or incomplete personal data concerning you. Also included in this right is to have a supplementary statement added to your personal information.

The right to erasure

In certain instances individuals can ask that their personal data is erased. Those which may be relevant to the Police Service of Northern Ireland are noted below:

1. When personal data is no longer necessary for the original purpose.
2. Consent is withdrawn and there is no other basis for processing.
3. The data subject objects under “Right to Object” and there is no overriding legitimate interest.
4. Personal data has been unlawfully processed.
5. The data needs to be erased to comply with a legal obligation.

Any deletion of personal data by the Police Service of Northern Ireland will be carefully considered. Where there is an underlying business requirement we may reject this request and continue to process the data for the following reasons:

1. A legal obligation
2. A task carried out in the public interest/exercise of official authority
3. The establishment, exercise or defence of legal rights
4. Archiving purposes.

The right to restrict processing

Where it is claimed that data is inaccurate or the “Right to Object” has been exercised individuals can require the Police Service of Northern Ireland to restrict processing until verification checks have been completed. Individuals may also require us to restrict processing where there is no legal basis (unlawful) however you oppose erasure, or if it is only needed for legal claims.

In certain circumstances, you shall have the right to obtain from the Police Service of Northern Ireland restriction of processing. “Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future. Where it has been restricted, processing other than storage should only occur for a number of specific reasons, namely – your consent, legal claims of yourself, to protect rights of others or in the public interest.

The right to data portability

The right to data portability allows individuals to obtain and reuse, for free, their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The personal data must be provided in a structured, commonly used and machine readable form.

The right to portability does not apply to all data. The data must have been obtained through consent or contract and the processing of such needs to be automated. Data applicable to this right must have been knowingly and actively provided by you, the individual.

This right will not apply to the data if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Police Service of Northern Ireland.

The right to object

Objection on grounds relating to your own situation

Individuals have the right to object to the Police Service of Northern Ireland processing their personal data where processing is necessary for the performance of a tasked carried out in the public interest or in the exercise of official authority vested in us, or when processing is based on legitimate interests.

To continue processing, we have to be able to demonstrate compelling legitimate grounds, which override the interests, rights and freedoms of the data subject. Or it must be necessary for the establishment, exercise or defence of legal claims.

Rights in relation to automated decision making and profiling

The GDPR gives individuals the right to object to decisions made about them solely on the basis of automated processing, where those decisions have legal or other significant effects. This includes processing where there is no human intervention. Where a significant decision has been taken based solely on automated processing we must, as soon as practicable, advise data subject with regards to this. 

Whilst we rarely use these technical features, we do have in place provisions which allow us to safeguard our processes and ensure the possibility of human intervention if required. 

Processing by these means can continue if it is:

• Necessary for entering into, or the performance of a contract between the Police Service of Northern Ireland and yourself
• Authorised by UK law
• Based on your explicit consent.

Under data protection legislation, you have the right to obtain from the Police Service of Northern Ireland, unless an exemption applies (see below), a response to your request and, where applicable, details of action taken by us within one calendar month. An additional two months may be taken if a request is deemed complex, you will be advised of this extension if it applies.

We will respond to you regardless of whether we are able to comply with your request or not. Where we are complying with your request we will inform you of how we have complied, for example, the personal data that has been amended, or erased; the scope of this data and the details of anyone we have contacted about amending data we have shared. Where we have decided to continue processing personal data, due to the fact that we have a lawful basis for doing so, we will, where possible, inform you of the rationale for our decision.

It is important to remember that not all personal information is covered and there are ‘exemptions’ within the data protection legislation which may allow us to refuse to comply with requests in certain circumstances. We will not provide personal data if we feel releasing it to you would be likely to prejudice policing purposes, some of these reasons could include, for example:

• The prevention and detection of crime
• The apprehension and prosecution of offenders
• The interests of national security

The Police Service of Northern Ireland is also not likely to provide you with information that identifies other individuals.

If you wish to make a request for your personal data to be reviewed under any of the rights listed above, PSNI would request you do so in writing, preferably by completing our Individual Rights form (DAT3). This form allows us to best ascertain your identity and your requirements. There is no charge for this service; however, we also ask you to provide documentation to confirm who you are. Your application must be accompanied by at least two forms of identification. Between them, they should bear a combination of your name, address, and date of birth (e.g. driving licence, passport, medical card, birth/adoption certificate, bank statement, or utility bill). It is advised that, if you are posting your request to us, you send photocopies of original documents - we cannot be held accountable for original documents lost in the post.

Information about children may be released to a person with parental responsibility. However, the best interests of the child will always be considered.

Even if a child is very young, data about them is still their personal data and does not belong to anyone else. It is the child who has rights regarding the information held about them.

Before responding to a request for information held about a child, the Police Service of Northern Ireland will consider whether the child is mature enough to understand their rights. If we are confident that the child can understand their rights, then we will respond to the child rather than the parent. What matters is that the child is able to understand (in broad terms) what it means to ask for a right to be exercised and how to interpret the information they receive as a result of doing so.

The Police Service of Northern Ireland can only supply your personal data to yourself. If you are making an application on behalf of any other person (third party), please ensure you enclose an original letter of authorisation from that individual. Please also ensure that this individual has signed the DAT3 form (if submitted) and provided their identification documents.

Any queries in relation to any of these rights should be referred to:

Operations Support Department
Staff Office
Police Headquarters
65 Knock Road
Belfast
BT5 6LE

Email: [email protected]