(a) Why has the responsibility for the provision of this information (in the form of a
Police Certificate) been transferred from the National Identification Service (NIS)
to ACRO
(b) Please supply electronic copies of correspondence relating to the decision to
transfer this responsibility, including any briefing and decision papers required by
the Commissioner and/or the police authority in agreeing to the transfer
1. Minutes of the ASSOCIATION OF CHIEF POLICE OFFICERS OF ENGLAND,
WALES AND NORTHERN IRELAND (ACPO) DATA PROTECTION AND
FREEDOM OF INFORMATION PORTFOLIO GROUP - 2nd March 2007
8. ACPO CRIMINAL RECORDS OFFICE
An update was provided and the issue discussed at the meeting on 1st March. One
of the issues arising was that of embassies and employers misusing subject access.
An action was agreed that in conjunction with the embassies, Forces would go back
to their regions and consider whether to be pro-active in enforcing people who are
applying for jobs to go through Disclosure Scotland. The Chair advised caution as
the CRB should be doing this work. He could not recommend this course of action on
behalf of ACPO. He stressed that disclosure was covered by ACC Adrian McAllister
and Gary Linton is carrying out this work for him. He would take this issue up with
Gary Linton and ask him to include it in his work stream.
ACTION: Gary Linton to progress issues relating to enforced subject
access/ Feedback required from forces on Disclosure Scotland.
Visas
Gary Linton has been given the go ahead from ACPO to commence this piece of work
on Visas. He has a number of other issues to deal with but it is something that he
would like to try and resolve this year.
2. Minutes of the HAMPSHIRE CONSTABULARY FREEDOM OF
INFORMATION & DATA PROTECTION REGIONAL MEETING - Friday 25th
January 2008
6.
ACRO Police Certificates
This agenda item was swapped as Nick Apps from ACRO attended the meeting to
give a talk on the new ACRO Police Certificates. Nick advised the group that ACRO is
looking at Immigration Subject Access checks.
ACRO has approached the four main embassies, Canada, New Zealand, USA &
Australia in a bid to set up an alternative to Subject Access in relation to
immigration. This process would involve applying the step mode, so only having live
information available. The pilot for this process has now been secured and
certificates went live in the early part of this month.
1
The Certificate is available on the ACPO Internet for members of the public and a
letter from Elsa Beaton is available on the ACPO Intranet.
Since the beginning of the month, ACRO has dealt with 53 requests. The pilot is
running for 4 to 6 months but it is hoped it will continue in the future.
The new certificate is an alternative to Subject Access so members of the public
apply for one or the other, they do not need to apply for both. The standard turn
around time is 10 days at a cost of £35 or two working days for the premium service
at a cost of £70. So far 25% of requests have been for the premium service.
Jason commented at the success of the pilot so far. All SEO’s in Hampshire have
been trained to advise members of the public about this service when an enquiry is
received. The Hampshire Constabulary website has also been updated for members
of the public with a link to the ACPO Website.
Over the next few weeks this information will be disseminated down to DP Officers
throughout the country.
3. Minutes of THE POLICE CERTIFICATE REVIEW -16/05/2008
Overview:
GL gave an overview of the Police Certificate pilot. ACPO Cabinet agreed to the pilot which
commenced on January 9th 2008. It involves four Embassies/High Commissions including
Australia, New Zealand, Canada and the USA. The pilot has been set up to move the process
away from the Subject Access arena and to enable the enactment of Section 56 of the Data
Protection Act.
IR…explained that what used to happen under the Subject Access process is wholly
inappropriate and for 9 years, the ICO has asked that we take responsibility for this. ACRO are
trying to do something about it now.
4. Briefing from MERILYNE DAVIES (HEAD OF PUBLIC ACCESS OFFICE) for
delivery at a meeting of the MPS PUBLIC ACCESS OFFICE – 07/02/2008
Disclosure Scotland and ACRO
As of Monday 25th February we will now be using both Disclosure Scotland and ACRO for certain
Subject Access Enquiries. The differences between each system is as follows:
Disclosure Scotland
Currently, employers who are not exempt under the Rehabilitation of Offenders Act have been
using Subject Access under the DPA as an unofficial vetting system for potential and current
employees. This means that those who have a right to withhold details on their "spent"
convictions when applying for jobs are being forced to do so as their employer requires them to
apply for a "PNC Check" / "Police Clearance Certificate" / "Police Clearance Check" via the PAO.
Section 56 of the Data Protection Act makes this type of unofficial vetting an offence, however,
this section has not come into force yet. The important fact here is that the ICO believes that the
practice of requiring subject access for vetting may still breach other provisions of the Act, or the
Human Rights Act 1998 or the Rehabilitation of Offenders Act 1974. It is with this fact in mind we
2
have now agreed that the MPS will no longer accept SARs for employment vetting purposes from
Monday 25th February 2008.
Instead, those who wish to pursue a certificate for employment vetting purposes will be pointed in
the direction of Disclosure Scotland. DS processes such requests for £20 and only discloses
"unspent" convictions and have a current turn around time of 14 days.
Applications can be obtained from the following details:
Help line
0870 609 6006
The Help line is available during the following hours: Monday to Friday - 8:00am to 6:00pm
Email [email address]
or write to:
Disclosure Scotland
PO Box 250
Glasgow
G51 1YU
• If you receive a call from a customer seeking a "PNC Certificate" etc for employment related
purposes then you must refer them to Disclosure Scotland on the above details as of Monday
25th February 2008.
ACRO
As with employment vetting PNC enquires, there are a number of countries which require a VISA
before a foreign national can enter their country. Some Visa applications require a disclosure of
criminal history and require applicants to provide a "PNC Check" / "Police Clearance Certificate" /
"Police Clearance Check" via the PAO. This is very much like the above scenario and this too is
excessive disclosure.
In order to remedy this ACRO now handles all requests for "PNC Check" / "Police Clearance
Certificate" / "Police Clearance Check" for those who wish to travel to the following countries:
• Australia
• New Zealand
• USA
• Canada
ACRO has two turn around phases and fees for these requests and they are as follows:
P1 - Standard Request: turnaround of 10 working days = £35
P2 - Premium Service: 2 working days = £70
For info - All submissions and enquiries relating to this process should be directed to ACRO, who
can be contacted through the following routes:
• Telephone: 0845 6013999 (during their office opening hours of 8:30-16:30, Monday
to Friday)
• E-mail:
[email address]
<mailto:[email address]>
• Address: ACRO, PO Box 481, Fareham, PO14 9FS
A copy of the application form can be obtain from the following website:
http://www.acpo.police.uk/certificates.asp
3
5. Letter from AILSA BEATON, HEAD OF ACPO INFORMATION
MANAGEMENT BUSINESS AREA PORTFOLIO, to all CHIEF CONSTABLES
AND COMMISSIONERS – 04/01/08
I am writing to you in my capacity as ACPO lead on Information Management. I
would like to draw your attention to the implementation of the “pilot” Police
Certificate Service. The duration of the pilot is 09/01/2008 - 08/06/2008 inclusive.
At present valuable police resources are used to process Subject Access checks for
immigration / Embassy purposes, often as pre-condition of visa applications. A
subject access check entails a print out from PNC. The resultant print out reveals an
entire record for disclosure. This has led to confusion and misinterpretation by
Embassies, for example the “further intelligence” marker may refer to the applicant’s
possession of a firearms certificate. Moreover the current practice of "enforced
subject access" is viewed by the Information Commissioner as an abuse of the right
of access (2003 Annual Report). Conversely this use of subject access does limit the
ability of criminals to travel abroad undetected and stops wanted persons from
leaving the country.
For the pilot the ACPO Criminal Records Office (ACRO) will act as a single point of
contact for both the Embassies and the Public, thus relieving the burden on Police
Forces and enhancing the customer experience for the Public and Embassies.
ACRO will utilise the step down model when processing its certificates. This will
ensure that convictions that are stepped down, with the intention of being
restricted from non-police view, are not disclosed. The process was approved by
ACPO in 2006. As a result the Police Service will be less open to criticism against our
information being used inappropriately. ACRO will produce its certificates in 10
working days, from the date the request is accepted to the date of despatch.
The pilot project will engage with four Embassies; USA, Canada, Australia and New
Zealand over a 6 month period; during which time the Embassies will continue to use
Subject Access alongside the Police Certificate service. The pilot will be evaluated at
the conclusion of the 6 months after consultation and feedback from the Embassies
involved.
The service is projected to be self funded and therefore cost neutral. It is proposed
that any surplus revenue will be used to support ACPO business as agreed by the
ACPO President.
6. Emails between AILSA BEATON (Head of ACPO INFORMATION
MANAGEMENT BUSINESS AREA PORTFOLIO), CARL WIDDISON (ACPO
Staff Officer to Ailsa Beaton) AND ALLEN BROOK (Assistant Staff Officer to
Ailsa Beaton) RE: ACPO INTRANET LETTER – 04/01/08
Ailsa thank you for the track changes. As to your questions:
4
1. the request for subject access can only be made by an individual. The Embassy do not
have the right. However by the individual disclosing the information to a third party this is
regarded by the Information Commissioner as an abuse of the right. 2. consultation with the Embassy's in question has revealed they need convincing that
this is an efficient and effective process, that all issues are ironed out before full
implementation. Moreover the cost differential (£10 v £35) can be justified before closing
the door on individual subject access. If you are content with my reply can we go ahead with publication? regards Carl
-----Original Message----- From:
Brook Allen - DoI On Behalf Of
Beaton Ailsa E - DoI
Sent:
04 January 2008 09:36
To:
Widdison Carl - DoI
Subject:
RE: ACPO INTRANET letter from you.
Carl,
Ailsa has made some track changes, which are shown on the attachment.
<< File: ACRO Letter.doc >> Ailsa is also seeking confirmation:
1. That the request for the subject access information currently comes from the embassy
to the Force
2. Why we are duplicating the information during the pilot - why not just have these four
embassies only contact ACRO and divert the work from the constabularies?
Regards,
Allen Allen Brook |
Assistant Staff Officer to Ailsa Beaton, Director of Information Directorate of Information, Metropolitan Police Service
7. Extract from Legal Advice from JAMES STRACHAN to ACRO – 14/05/08
Background
3. Section 7 of the Data Protection Act 1998 (“DPA 1998”) sets out an individual’s right of access
to personal data held by a data controller. This right is often referred to as “subject access”
(“SA”), and the exercise of the right a “subject access request” (“SA request”).
5
4. SA is subject to certain exceptions and exemptions, but the basic right enables an individual to
ask in writing whether personal data is being processed, and if so, to request a description of that
data, the purposes for which it is being processed, the recipients or classes of recipients to whom
it may be disclosed, and details of the information.
5. Pursuant to section 7(2) of the DPA 1998, a data controller is not required to supply the
information unless the SA request is made in writing and, except in certain prescribed cases,
payment of any fee (subject to the prescribed maximum) which the data controller may require.
6. Pursuant to section 7(8) of the DPA 1998, a data controller must comply with a SA request
promptly and, in any event, before the end of the prescribed period.
7. The provisions of section 7 apply to the police, and an individual is entitled to make a SA
request in respect of information held by the police about an individual on the Police National
Computer and other similar information, including records of criminal convictions.
8. The prescribed maximum fee for such a SA request is £10 and the maximum period for
compliance for responding to the request is 40 days.
9. The current procedure for making such a SA request of the police usually involves an individual
calling at a police station, completing the necessary written application and providing proof of
identity, and payment of the £10 fee. I am instructed that the fee is paid to the Government, and
the time taken to process an application is normally 40 or more days.
10. The information sought under a SA request is often required by an individual in respect of
immigration procedures, where another country may require an individual to provide such
information if they wish to travel to that country. I am instructed that it is estimated that 50% of all
SA requests of the police in England and Wales relate to immigration.
11. Section 56 of the DPA 1998 is yet to come into force. However, it provides (amongst other
things) that a person must not require another person or third party to supply a relevant record in
connection with the recruitment of another person as an employee, or the continued employment
of another person or any contract for the provision of services to him by another person. A
relevant record means any record which has been, or is to be obtained by a data subject from
any specified data controller in exercise of the SA right under section 7 of the DPA 1998, which
contains information relating to any matter specified in relation to that data controller. The police
records of convictions and cautions are specified for these purposes.
6
12. It is clear that the intent of this provision, once it comes into force, is to prevent the process of
Enforced Subject Access, by which employers (and others) can effectively require an applicant to
produce personal details relating to previous convictions or cautions as part of any application for
employment, outside the specific procedures for criminal record certificates set out in the Police
Act 1997
Criminal Record Certificates under the Police Act 1997
13. Part V of the Police Act 1997 sets out statutory procedures for the provision of certificates by
the Secretary of State relating to criminal records, on request by particular persons. This
procedure is administered by the Criminal Records Bureau.
14. Section 112 deals with provision of criminal conviction certificates to individuals. This
provision is not yet in force in England and Wales, although such a procedure does exist for
provision of criminal conviction certificates which is administered by Disclosure Scotland.
Police Certificate Pilot Scheme
15. In view of the perceived difficulties with the current arrangements for compliance with SA
requests for immigration purposes (in particular the time taken for compliance with such requests
and the current administrative burden on the police forces of compliance with these requests),
and in light of perceived advantages of a more streamlined process, ACPO entered into
discussions with four major embassies and High Commissions to pilot a scheme for the provision
of Police Certificates. These Certificates could be requested on payment of a prescribed fee, and
would provide the information that would normally be requested under a SA request, but at an
accelerated rate and with the potential to exclude spent convictions. The intention is that the
individual may choose to use this service and pay for such a certificate to be used when making a
visa application.
16. The pilot scheme commenced in January 2008. It has proved to be very successful in
providing a much quicker and more efficient service for individuals. The fees charged are £35 for
provision of a Police Certificate within 10 days, and £70 for provision within 2 days.
17. At the time of setting up the pilot scheme, ACPO sought legal advice. This was to the effect
that the police were allowed to charge a reasonable rate for a service that was outside their core
functions and that this work fell outside such core functions, and that the service provided was not
SA (within the meaning of section 7 of the DPA 1998).
7
8. Extracts from the PRIVACY IMPACT ASSESSMENT OF THE ACRO POLICE
CERTIFICATE INITIATIVE – 30/04/08
3. Criteria for small-scale PIA
3.7
Does the project involve new or changed data collection policies or practices that
may be unclear or intrusive?
Providing Police Certificates for immigration purposes is a new concept. The collection processes
differ in that the ACRO Police Certificate application form is available to download online. This
now means that individuals living abroad can apply for a Police Certificate. Some police checks
are only available to those living in the UK. The information required and the way in which that
information is used is not a new or changed practice.
3.10
Does the project involve new or changed data access or disclosure arrangements
that may be unclear or permissive?
A Police Certificate is provided to the Applicant at their request for immigration purposes only.
This is clearly stated on the Certificate. After the Applicant receives their Certificate, they can
choose not to disclose this information, however, in most cases, the Embassies and High
Commissions will require this information in order to proceed with their visa application.
The conviction information provided differs slightly to current police check arrangements in that
the ACRO Police Certificate takes into account the tep down model. This means that the
information provided is not a direct print of the PNC record. The Certificate will only display
conviction nformation that has not been stepped down.
4. Background
4.1
Foreign Embassies, High Commissions and Immigration Agencies have been requesting
that individuals obtain subject access checks so that they can determine an individual’s suitability
to obtain a Visa.
4.2
DCC Ian Readhead requested that the ACPO Criminal Records Office
(ACRO)
explored the development of a bespoke Police Certificate service to replace the current use of the
subject access process for Embassy Visa checks.
4.3
The Information Commissioner recognises that subject access is an important legal right
to personal information, but should only be used for that purpose, for personal information. The
Information Commissioner has described the use of subject access by third parties for
immigration and employment purposes as ‘enforced subject access’. ACPO agrees that the
8
link to page 9 link to page 9
continued use of the subject access process for such reasons is inappropriate.
5. Police Certificate Pilot
5.1
ACRO has negotiated with four countries to commence a pilot to produce Police
Certificates for immigration purposes. These are Australia, Canada, New Zealand and the USA.
5.2
The Police Certificate process does not replace the right of an individual to request a
subject access check. Subject access checks contain all information held on the PNC about an
individual. That includes non conviction information including arrests and acquittals as well as the
conviction history. The ACRO Police Certificate contains only conviction information in
accordance with the Retention Guidelines of Nominal Records held on the Police National
Computer
1.
5.3
In order to obtain a Police Certificate, the Applicant must complete an application form
which can be sent via the post, or downloaded from the ACPO website
2.
5.4
The application form must be accompanied by a passport sized colour photograph, which
is endorsed by a professional who has known the Applicant for a minimum of 2 years, a copy of
the Applicant’s passport and copies of 2 pieces of correspondence containing their current
address. The identity documents are required to confirm the identity and address of the
Applicant. By requesting identity documents, ACRO are able to cross reference the signed
photograph with the passport thus reducing the number of fraudulent applications.
5.5
A Police Certificate is produced only at the request of the Applicant and the personal
details supplied on the application form are used only to update the PNC where necessary and to
produce the Certificate. Before the application is sent to ACRO, the Applicant must sign the
declaration at the bottom of the form, giving ACRO consent to use their personal information to
conduct appropriate checks against police systems and update the PNC where necessary.
9. Update to the ACRO GOVERNANCE BOARD – 8th May 2007
Subject Access
The Data Protection Act 1998 enables an individual to enquire what personal information is held
on police systems by making a Subject Access request to the Chief Constable of the police force
1 The Retention Guidelines for Nominal Records held on the Police National Computer
can be found at www.acpo.police,uk
9
area. The right of Subject Access is an important element of Data Protection and is considered
by the Information Commissioner, a ‘cornerstone of a transparent and accountable society’
(Information Commissioners response to Subject Access questionnaire, January 2003). A subject
access check costs £10. This fee is set by the Secretary of State.
Currently there are approximately 250,000 PNC Subject Access checks conducted in England
and Wales per annum. These checks are conducted by the National Identification Service, who
are hosted by the Metropolitan Police Service.
The checks can be broken down into three broad categories;
Individuals requesting access to their personal data
Prospective employers requesting individuals to obtain checks for employment vetting purposes
Foreign embassies requesting individuals to obtain checks to determine suitability to obtain a
Visa.
It is estimated that 60-80% of the total number of subject access checks can be attributed to
employment vetting and Embassy Visa applications (Jayne Lawler, notes from meeting held
21/04/06). Such third party checks are often referred to as ‘Enforced Subject Access’ and are
outside the spirit of the Act as they are for the purposes of determining suitability rather than
required by the individual for their own personal information.
It is impossible to provide more accurate figures as the majority of forces do not ask individuals
why they are requesting subject access, nor have the legal right to do so.
The Data Protection Act 1998 revised the previous 1984 Act. The revisions includes a Section 56
provision which enables the Secretary of State to invoke further powers and criminalise any
procedure whereby an individual is required to apply for information about themselves by a third
party. This provision is not yet enacted, pending the implementation of the basic disclosure
check by CRB.
The Information Commissioner continues to express concern about the use of the procedure
outside the spirit of the Data Protection Act and considers that Subject Access should only be
used to enable individuals to access personal information held on them for personal use.
2 www.acpo.police.uk
10
Whilst subject access is an important legal right to personal information, ACPO recognise that the
continued use of the subject access process for employment vetting and Embassy Visa checks is
inappropriate.
Embassy Visa checks
DCC Ian Readhead has requested that the ACPO Criminal Records Office (ACRO) explore the
development of a bespoke Visa service to replace the current use of the subject access process
for Embassy Visa checks.
From preparatory work including a number of visits to the American and New Zealand
Embassies, it would appear that a higher number of Enforced Subject Access checks are
attributable to Visa applications than initially thought. Therefore, by providing a bespoke Visa
service, a large proportion of Enforced Subject Access checks will be removed.
There are additional policing benefits, which emerge from the relationship between the police and
Embassy’s in the context of this proposal. They include opportunities to limit criminals travelling
abroad undetected and in some cases this will include wanted persons. It will also provide an
opportunity to create an appropriate intelligence exchange function relating to organised crime
and terrorist activity. These additional benefits reinforce the importance of developing this area of
policing.
10. Minutes of the ACPO Criminal Records Office Governance Board Minutes -
8th March 2007
6.6 Embassy Visas
6.6.1. MM explained that ACRO were developing a bespoke Visa Service under the direction of
DCC Ian Readhead. If the use of subject access could significantly be reduced, it is likely that
section 56 of the DPA could be invoked and Enforced Subject Access effectively outlawed. MM
explained that he had discussed proposal with the USA, Canada and New Zealand as these were
known to represent the majority of the Visa business currently.
11
(c) Identify who was consulted regarding the transfer of responsibility from the
NIS to ACRO, and what responses were received to any such consultation
11. ACRO update to the ACPO DATA PROTECTION AND FREEDOM OF
INFORMATION PORTFOLIO GROUP – 06/07/07. This is attended by
representatives of the ACPO police service Regional Groups, NIS and SOCA.
Embassy Visas
Since I advised conference of the potential to set up a pilot service with New Zealand, we have
been contacted by Canada who following a recent meeting is particularly enthusiastic to
participate.
12. Email from ROBERT FARLEY (MPS HEAD OF INFORMATION
COMPLIANCE) to MERILYNE DAVIES (MPS DATA PROTECTION OFFICER) –
06/09/2007
Although the pilot has not yet started things are looking positive. [ACRO] is actively working with
New Zealand and has an outline request for the information they require to be disclosed on a
police certificate. [ACRO] has looked over the requirements and is confident that most can readily
be provided. Canada have expressed an interest and USA and Australia are waiting in the wings.
ACRO were thinking that an MOU or SLA should be produced to support the process, but NZ
have said they do not see the need for one. This will speed things up considerably.
ACRO are close to being ready to start a pilot with NZ, the pilot duration is yet to be established -
but is likely to be longer than three months, but will start this side of Christmas.
13. Minutes of the POLICE CERTIFICATE REVIEW ( 16/05/2008). This was
attended by representatives of the ACPO Data Protection and FOI Portfolio,
ACRO, Hampshire Constabulary, Suffolk Constabulary, the Metropolitan Police
Service, NIS, NPIA and the Home Office.
Legal Advice:
IR said that after the legal advice, there is a very fine line and interpretation issues. Section 7 of
the legal advice mentions the Home Office. He feels that this should be discussed with the Home
Office as he is aware that Jackie Sear has raised concerns over the legality of the service. Jackie
and Home Office colleagues need time to consider it and decide where to go with this.
12
IR proposed a meeting with colleagues to consider the legality of the process – to include
James Strachan.
JR said that to establish whether the process sits outside of Subject Access is to write to the
Information Commissioner’s Office to ask if it sits outside of Subject Access.
RB agreed that Home Office colleagues would need time to read and digest the advice.
GL stated that Jackie Sear also raised concerns over section 25 of the Police Act. James
Strachan concurred that section 25 was inappropriate and recommends that section 18 of the
Police Act is more appropriate.
RB will highlight section 18 to Jackie Sear
IR has written to the APA [Association of Police Authorities] and Hannah Shah agrees that the
APA should be on the Governance Board. If presented to the APA, they may sanction that
ACRO are acting on behalf of Police Authorities.
14. Email from JONATHAN BAMFORD (ASSISTANT INFORMATION
COMMISSIONER) TO GARY LINTON (ACRO) – 04/04/08 AND 12/05/08
Dear Gary
Thank you for providing the update about the pilot “Police Certificate” scheme and I apologise for
the delay in replying.
The police certificate initiative does appear to go a long way towards tackling a problem which is
not effectively covered by the provisions of the Data Protection Act. Even when section 56 of the
Act is enabled and “enforced subject access” is made illegal then it may not cover the
circumstances where an individual is effectively forced to provide conviction information to a
foreign authority for immigration purposes. As the regulator, when section 56 comes into effect
we will take action against organisations within the UK who abuse an individual’s right of subject
access. However the perception is that it would be very difficult to do so against foreign
authorities. As a consequence ACRO’s initiative in potentially reducing the amount of sensitive
personal data which could be disclosed in these circumstances is a positive move.
13
I understand that this is a pilot and no doubt there will be fine detail to correct as the scheme
progresses and unforeseen issues that occur. However there is one issue which stands out to us
and which we would like to know more about. From our vantage point there appears to be some
confusion over whether ACRO is a data controller in its own right or whether it is acting as a data
processor for the individual police forces. If it is the latter, are there written contracts between
ACRO and the forces? I would be grateful if you could provide the answer to this query.
In general I and my colleagues would be keen to learn more about the operation and the results
of this pilot in due course. In the meantime if there any other data protection issues which arise
and that you wish to discuss further then we would be pleased to do so.
Yours sincerely
Jonathan Bamford
Assistant Information Commissioner
15. Response from Gary Linton (ACRO) to JOHNATHAN BAMFORD (ICO) –
12/05/2008
Dear Jonathan
Re: ACRO Police Certificate Initiative
Thank you for your letter dated 4 April 2008. The ACRO Police Certificate Initiative has
undoubtedly reduced the volume of subject access checks processed by forces for immigration
purposes. Additionally, application of the Retention Guideline Step Down principles prior to the
issuance of an ACRO Police Certificate completely removes the disclosure of non conviction
information.
Advice from the Secretary of the ACPO Data Protection portfolio has led the ACPO Criminal
Records Office to register as a Data Controller on behalf of ACPO. We consider this an important
step to ensure that the wide range of activity undertaken by ACRO is appropriately monitored and
regulated by your office. In the context of processing Police Certificates, ACRO are processing
these on behalf of individual police forces. Ailsa Beaton, who is the ACPO Information
Management portfolio lead has requested that ACRO undertake this work on behalf of ACPO and
therefore all police forces.
14
We welcome your interest in the initiative and you are of course very welcome to visit our offices
in Hampshire to see the work in progress.
Gary Linton
ACPO Criminal Records Office
16. Update to the ACRO Governance Board – 9th July 2008. This is attended by
representatives of ACPO, ACRO, the Home Office, NIS, Police Service of
Northern Ireland, Scottish Police Services Authority, NPIA, HMIC, the
Metropolitan Police Service, Hampshire Constabulary
Police Certificates update
Legal advice has now been obtained from James Strachan (see attached paper linked to action
7.1.9) The Chair has also written to the Home Office who had representatives at a meeting in
James Strachan’s chambers on Monday 23rd June to clarify all legal points.
A review of the Pilot Certificate work has also been undertaken on Friday 16th May (minutes
attached). Letters have been received by all Embassies involved, which provides positive
feedback regarding the service.
Data Protection Officers were provided with a briefing and a question and answer session at their
National Conference in Scotland on Thursday 12th June and consultation has also taken place
with colleagues from PSNI and ACPOS.
The Chair DCC Ian Readhead will be addressing ACPO Cabinet regarding Police Certificates on
the morning of 9th July
The liaison points within each of the Embassies involved, collectively estimated that we should
expect 50,000 applications for Police Certificates in our first year of operation. By the 20th June,
we had processed 21,688 applications, resulting in a total of 25,330 certificates, which generated
an income of £899,655.
There has been a decline in the numbers of applications since the middle of May. Embassy
colleagues suggest this is a seasonal occurrence and numbers will increase once the holiday
season is over.
15
link to page 16
(d) Identify what relationship exists between NIS and ACRO regarding the
access to and processing of data from the PNC and other police/national
databases
17. Minutes of the POLICE CERTIFICATE REVIEW ( 16/05/2008)
Sequence of letters:
GL stated that ACRO has been communicating with the ICO. He has raised issues in reference
to section 56 of the Data Protection Act and that Embassies do not have to comply with British
legislation – however they recognise the importance of it and want to comply with our data
processing procedures.
He went onto explain that the ACRO Police Certificates apply the step down process as outlined
in the Retention Guidelines and that ACRO has registered as a data controller under ACPO.
ACRO would welcome a visit from the Information Commissioner to see how the process works.
18. Extracts from the PRIVACY IMPACT ASSESSMENT OF THE ACRO
POLICE CERTIFICATE INITIATIVE – 30/04/08
6. Data Collection
6.1
On behalf of ACPO, their Criminal Records Office has registered with the Information
Commissioner’s Office as a Data Controller. This was necessary due to the personal information
collected during the Police Certificate application process.
7. Fair Processing
7.1
ACRO are a registered body with the Information Commissioner’s Office and aim to
comply with guidance issued by the Information Commissioner’s Office regarding the fair
processing of information
3. The fair processing of information, according to the Information
Commissioner includes the following:
(a)
the identity of the data controller
(b)
of the data controller has nominated a representative for the purposes of the
Act, the identity of that representative
(c)
the purpose or purposes for which the data are intended to be processed and,
3 Extract taken from the Police Data Protection Manual of Guidance
16
link to page 17
(d)
any further information which is necessary, taking into account the specific
circumstances in which the data are or are to be processed, to enable processing
in respect of the data subject to be fair.
This will be provided to data subjects or be made readily available to them, so far
as practicable, via a ‘fair processing notice’ when personal data is obtained by
the police.
7.2
The guidance notes which accompany the Police Certificate application form have been
amended to include a fair processing notice. The guidance clearly states that ACRO will use the
information provided by the Applicant to search databases such as the Police National Computer
and Causeway where applicable to produce a Police Certificate containing details of criminal
convictions. The guidance also clarifies that the information provided will only be retained for a
period of 12 months. It is made clear that the information will not be disclosed to a third party
unless there are exceptional circumstances to do so, or if the Applicant gives their consent for the
information to be disclosed.
7.3
As part of the Fair Processing procedure, one of the aims is to ensure that the guidance
notes are clear and easy to understand. In order to ensure that Applicants were able to clearly
understand what was asked of them and to ensure that the application form and guidance notes
were written in ‘plain English’, ACRO have sent the application form to the ‘Plain English
Campaign’
4, who believe that everyone should have access to clear and concise information.
Additionally, ACRO have also incorporated suggestions made by Lesley Thomas, an employment
consultant working for Kudos Employment which is a charitable organisation working with people
with learning difficulties, into the application form and guidance notes.
12. Summary
12.5
ACRO are not a police force, but have registered ACPO with the Information
Commissioner’s Office as a data controller due to the processing of personal information
including conviction information carried out by ACRO. By notifying the Information Commissioner
about the personal data processed by ACRO, the statutory requirement of notification under the
Data Protection Act 1998 has been fulfilled by ACRO.
4 Details of the Crystal Mark Campaign can be found at www.plainenglish.co.uk
17
Document Outline
