Personal and sensitive information

Personal data relates to specific information about a living individual or information, which could be used by a data controller to identify an individual. The definition applies to information already in the possession of agency, or is likely to come into its possession. The Data Protection Act also defines personal information as including any expression of opinion or any proposed course of action, which the agency (including those outlined by an employee) intend to take in respect of that individual.

Sensitive personal data covers both facts and opinions about the individual including information regarding the intentions of the data controller towards the individual.  These are defined in Section 2 of the Data Protection Act 1998.  Sensitive personal data means personal data consisting of information about racial or ethnic origin, the subject's political opinions, religious beliefs, sex life, physical or mental health, any proceedings for offences committed, if the subject is a trade union member, or has commissioned an offence.  Limited exemptions apply to these and include certain categories of information associated with crime reduction activities. These are outlined in more detail below in the section entitled the Data Protection Act.

The common law duty of confidentiality, Data Protection Act and Human Rights Act seek to ensure that an individual’s privacy is safeguarded from the point from which the information is collected, that this is only done for a sound purpose and that information is used for a legitimate purpose. Except where there are good reasons for doing otherwise, the informed consent of the individual concerned should be obtained.

Crime & Disorder is an area of work, where the exchange of personal information without consent may be considered. For example, in the context of a criminal investigation it would be nonsense, if the suspect’s consent were required before information could be exchanged between relevant agencies.

Similarly, only the minimum amount of information needed to fulfil the purpose should ever be exchanged and there must always be a clear legal basis for doing so. An outline of more detailed legal considerations, which may apply can be found below.

If personal information is mixed with non-personal information and it is not possible to permanently separate the two types, the whole block of information/data must be treated as if it were personal.

Personal information identified in the public domain may normally be exchanged although care must be taken to ensure that it is not subject to any other form of legal restriction.

Types of personal data, where relevant, which may be exchanged for crime reduction activities include, for example, names, addresses and dates of birth.

Back to Sources of Information