• 2 min read

What is criminal offence personal data?


Like special category personal data (which we considered in our 13 December 2022 Q&A article), data relating to criminal allegations, proceedings, offences and convictions is personal data which is considered to need more protection in law as it is data relating to sensitive matters.

The Information Commissioner’s Office (or ICO, which is the UK data protection regulatory authority) explains that criminal offence personal data “covers a wide range of information about offenders or suspected offenders in the context of criminal activity, allegations, investigations and proceedings”. Examples of the holding and processing of criminal offence personal data by a business include:

  1. Shop or warehouse CCTV footage – a business may have CCTV footage which shows an employee or a member of the public stealing goods.
  2. Driving offence data e.g. penalty points on an employee’s driving licence – this criminal offence data may be held by businesses which employ drivers or provide company cars to their employees.
  3. Criminal records (DBS) check (even if it is clear and confirms the person has no criminal convictions) – this may be held by a firm of solicitors, a children’s sports coaching business or a care provider about its employees.
  4. A business being informed that one of its employees has had a restraining order taken out against them by a former partner.

It is essential that if a business asks for and collects criminal offence personal data it only does so if it is lawful to do so (for example, it is necessary to process the criminal offence data to comply with a legal obligation to which the business is subject) and the processing meets one of the conditions set out in Schedule 1 of the Data Protection Act 2018 (for example, the individual whose criminal offence data it is has freely given informed, affirmative and unambiguous consent to the processing). Otherwise, the processing of such personal data will be in breach of data protection law.

Our data protection team have many years of experience in advising organisations on their compliance with UK data protection law. To speak to one of the team you can get in touch here or call us on 0800 2800 421. 

If you have not received this article directly, but would like to receive articles and data protection news alerts from Trethowans, please click below.

Answers are just a click away

Make an enquiry