gdpr england-and-wales police data-protection subject-access-request
How can data received in online subject access request form be used by ACRO?
<p>Meet Bob. Bob has requested his PNC file from <a href="https://www.acro.police.uk/" rel="nofollow noreferrer">ACRO Criminal Records Office</a>
under the Data Protection Act.</p>
<p>Their online request form solicits much intrusive information. What purposes may information so supplied be used for?</p>

<p>From ACRO's <a href="https://www.acro.police.uk/SA-Further-guidance#Why_do_I_need_to_supply_proof_of_ID?" rel="nofollow noreferrer">Subject access - further guidance</a> web page:</p>
<blockquote>
<p><strong>Why do I need to supply proof of ID?</strong></p>
<p>We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC.</p>
</blockquote>
<p>As for this proof of ID (personal data) provided when submitting a Subject Access Request, ACRO's <a href="https://www.acro.police.uk/Privacy-Policy" rel="nofollow noreferrer">Privacy policy</a> states:</p>
<blockquote>
<p>We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. At the moment this information consists of:
 </p>
<ul>
<li><p>Statistical information obtained using Google Analytics. No information collected can be used to identify individual users. For more details about how this affects your privacy please visit the Google Analytics Privacy Centre. If you don’t want to send information to Google Analytics, an Opt-out Browser Add-on is also available or you can configure your browser to let you to choose which, if any, cookies are allowed to be created.</p>
</li>
<li><p>Information obtained by our content management system to examine what people are searching for, what they find and occasions where no results are returned. Information collected can’t be used to identify individual users.</p>
</li>
<li><p><strong>Information provided by users through online forms; it's held in our UK-based secure data centres and is retained in line with the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679, and our retention policies.</strong></p>
</li>
</ul>
</blockquote>
<p>However, I have not been able to locate publicly available copies of the retention policies referred to in the emboldened text.</p>
