Criminal Offence Data

You are here:
Estimated reading time: 2 min
In this article
Information Commissioner’s Office, “Guide to the GDPR”, retrieved on 18th January 2021, licensed under the Open Government Licence.

At a glance

  • If you have official authority, you can process personal data about criminal convictions and offences, because you are processing the data in an official capacity.
  • If you do not have official authority, you can only process criminal offence data if you can identify a specific condition for processing in Schedule 1 of the DPA 2018.
  • You cannot keep a comprehensive register of criminal convictions, unless you do so in an official capacity.
  • You must determine your condition for processing criminal offence data, or identify your official authority for the processing, before you begin the processing, and you should document this.
  • You must still have a lawful basis for your processing under Article 6.
  • In many cases, you also need an ‘appropriate policy document’ (external link, Word document) in place in order to meet a Schedule 1 condition for processing in the DPA 2018.
  • You need to complete a data protection impact assessment (DPIA) for any type of processing which is likely to be high risk. You must therefore be aware of the risks of processing the criminal offence data.

Checklist

  • We have checked that the processing of the criminal offence data is necessary for the purpose we have identified and are satisfied there is no other reasonable and less intrusive way to achieve this purpose.
  • We have identified an Article 6 lawful basis for processing the criminal offence data.
  • Where applicable, we have identified in law our official authority to process the criminal offence data.
  • Where we do not have official authority to process criminal offence data, we have identified an appropriate DPA 2018 Schedule 1 condition.
  • Where required, we have an appropriate policy document (external link, Word document) in place.
  • We have considered whether we need to do a DPIA.
  • We include specific information about our processing of criminal offence data in our privacy information for individuals.
  • We have considered whether the risks associated with our use of criminal offence data affect our other obligations around data minimisation, security, and appointing Data Protection Officers (DPOs) and representatives.

In brief

  • What is criminal offence data?

    The GDPR gives extra protection to “personal data relating to criminal convictions and offences or related security measures”. We refer to this as criminal offence data.

    This covers a wide range of information about:

    • criminal activity;
    • allegations;
    • investigations; and
    • proceedings.

    It includes not just data which is obviously about a specific criminal conviction or trial, but also any other personal data relating to criminal convictions and offences, including:

    • unproven allegations;
    • information relating to the absence of convictions; and
    • personal data of victims and witnesses of crime.

    It also covers a wide range of related security measures, including

    • personal data about penalties;
    • conditions or restrictions placed on an individual as part of the criminal justice process; or
    • civil measures which may lead to a criminal penalty if not adhered to.
  • What are the rules for criminal offence data?

    You must always ensure that your processing is generally lawful, fair and transparent and complies with all the other principles and requirements of the GDPR. To ensure that your processing is lawful, you need to identify an Article 6 basis for processing.

    In addition, you can only process criminal offence data if the processing is either:

    • under the control of official authority; or
    • authorised by EU or member state law. In the UK, this means you need to meet one of the conditions in Schedule 1 (external link) of the DPA 2018.

    You may only keep a comprehensive register of criminal convictions if this register is “under the control of official authority”.

    Public bodies, or private bodies who are given public sector tasks, may have “official authority” laid down by law to process criminal offence data. This official authority may derive from either common law or statute. If you are a public body, it is your responsibility to identify the specific law that gives you the official authority to process criminal offence data.

    If you do not have official authority for the processing, it must be authorised by EU or member state law. In the UK, this authorisation in law is set out in the conditions listed in Schedule 1 of the DPA 2018 (external link).

    You must also identify whether you need an “appropriate policy document” under the DPA 2018. ICO’s template appropriate policy document (external link, Word document) shows the kind of information this should contain.

    You must do a DPIA for any type of processing that is likely to be high risk. This means that you are more likely to need to do a DPIA for processing criminal offence data. For further information, please see our guidance on DPIAs.

    You may also need to consider how the risks associated with criminal offence data affect your other obligations – in particular, obligations around data minimisation, security, transparency, and DPOs.

  • What are the Schedule 1 conditions for processing criminal offence data?

    The 28 conditions which are available for the processing of criminal offence data are set out in paragraphs 1 to 37 Schedule 1 of the DPA 2018:

    1. Employment, social security and social protection
    2. Health or social care purposes
    3. Public health
    4. Research
    5. Statutory and government purposes
    6. Administration of justice and parliamentary purposes
    7. Preventing or detecting unlawful acts
    8. Protecting the public against dishonesty
    9. Regulatory requirements relating to unlawful acts and dishonesty
    10. Journalism in connection with unlawful acts and dishonesty
    11. Preventing fraud
    12. Suspicion of terrorist financing or money laundering
    13. Counselling
    14. Safeguarding of children and individuals at risk
    15. Elected representatives responding to requests
    16. Disclosure to elected representatives
    17. Informing elected representatives about prisoners
    18. Publication of legal judgments
    19. Anti-doping in sport
    20. Standards of behaviour in sport
    21. Consent
    22. Vital interests
    23. Not-for-profit bodies
    24. Manifestly made public by the data subject
    25. Legal claims
    26. Judicial acts
    27. Administration of accounts used in commission of indecency offences involving children
    28. Insurance

    You should identify which of these conditions appears to most closely reflect your purpose. Our detailed guidance gives you some further advice on how the conditions generally work, but you always need to refer to the detailed provisions of each condition (external link) in the legislation itself to make sure you can demonstrate it applies.

    For some of the conditions, you also need to justify why you cannot give individuals a choice and get explicit consent for your processing. In many cases, you must have an ‘appropriate policy document’ (external link, Word document) in place.

No questions matching current filter
Relevant provisions in the GDPR – see Article 10

External link

Key provisions in the DPA 2018 – See sections 10 and 11, and Schedule 1

External link

In more detail – ICO guidance

We have produced more detailed guidance on criminal offence data.

Thank you for reading.

Was this article helpful?
Dislike 0
Views: 507