The GDPR Request and the Missing File
A data subject, Mr. Doyle, submits a written access request for all personal data held about him by the station. Sergeant Kelly locates a pulse incident file, a statement he gave as a witness, and a note in a notebook about a neighbour dispute. The notebook entry contains information about a third party, Mr. Walsh, including an allegation Walsh made about Doyle. Doyle's request arrives on a Monday; Kelly is told by a colleague to 'just give him the statement, it's the only thing that matters.' The station's file also shows a 2019 incident where Doyle was a suspect but never charged.
1. What must Kelly consider before responding, and what is the correct approach to the third-party information?
Read the worked answer
Framework: A data subject has a right of access to their personal data, subject to specific exemptions. The response must be timely and must not disclose another person's data without a lawful basis.
Considerations:
- Scope - the request covers all personal data, not just the statement. The pulse file, witness statement, notebook entry and 2019 incident record are all potentially in scope.
- Third-party data - Mr. Walsh's information and the allegation he made are Walsh's personal data. Kelly must redact Walsh's identifying details unless disclosure is necessary and lawful, or Walsh consents.
- The 2019 incident - even though Doyle was never charged, the record is his personal data. Investigative or law-enforcement exemptions may apply, but they must be assessed, not assumed.
Action: Do not follow the colleague's advice to hand over only the statement. Conduct a full search, redact third-party data, document the reasoning for any redaction or exemption, and respond within the statutory timeframe.
2. The 2019 uncharged-suspect record is sensitive. How do you balance access against investigative exemptions?
Read the worked answer
Balance:
- The exemption for preventing, investigating or detecting crime is not blanket. It applies only to the extent that granting access would prejudice an ongoing or potential investigation.
- A 2019 matter where no charge followed is unlikely to be an active investigation. The default should therefore lean towards disclosure, subject to redaction of third parties.
- Kelly should document the exemption assessment: what was considered, why any part was withheld, and who authorised it.
Risks of getting it wrong:
- Over-withholding invites a complaint to the Data Protection Commission and undermines public trust.
- Under-withholding can prejudice investigations or breach third-party rights.
Practical step: Where uncertain, consult the station's data protection officer or legal adviser before responding. The sergeant's role is to ensure a reasoned, recorded decision - not to make an ad hoc judgement at the counter.