ICO Investigation: The Nicola Bulley Case
Due to the nature of the law surrounding digital and technology law, we are encouraged at Digital Law to research and apply our growing knowledge to current events.
If you have been following the news, you will have no doubt heard the tragic case about Nicola Bulley. For context, Ms. Bulley disappeared when out walking her dog. She had previously been involved in a work call on Teams however, it was later discovered that she had left her phone on a park bench while still logged in to the call.
As the search continued to find Ms. Bulley, police were doing all they could to find her – including releasing information that may help establish what happened. This included publishing information about her personal life. “A police spokesman said it was clear after speaking to Ms. Bulley’s family she had “in the past suffered with some significant issues with alcohol which were brought on by her ongoing struggles with the menopause”.”
This statement caused controversy, as while on a surface level, the police were giving the public information that may help the investigation however, many have spoken out against the release of such information. The police have been criticised on social media for disclosing information relating to Ms. Bulley’s past health and wellbeing. Zoe Billingham, formerly a lead inspector for the police watchdog HMICFRS, tweeted that she was “deeply troubled” by its release at this stage.
The released information by its very nature could be classified as personal data, possibly even special category data as the ‘alcohol problems’ could relate to Ms. Bulley’s health. Similarly, the mention of menopause is yet another piece of medical data which is again, classed as special category data and therefore, should be protected at a high level.
To clarify, police and enforcement services do not follow the same General Data Protection Regulations (“GDPR”) as enacting into UK law through the Data Protection Act 2018 (“DPA’18”) as other organisations. The rules are slightly less stringent to enable the police and other relevant authorities to do their jobs as efficiently as possible.
The law enforcement purposes are defined under section 31 of the DPA’18 as:
‘The prevention, investigation detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
To apply this to Ms. Bulley’s case, information was released as part of the ongoing investigation into Ms. Bulley’s disappearance.
Just because Data Protection regulations are not as stringent for police and other enforcement agencies, it does not mean that they do not have to show compliance. Any information that is being processed for law enforcement purposes must adhere to the governance requirements of Part 3 of the DPA’18. These include logging requirements, categorisation and obligations about the principles and rights of individuals.
In a similar way to the more generalised regulations relating to personal data, there are also special considerations when police and enforcement agencies are processing special category data. These regulations are contained in Schedule 8 of the Act:
- necessary for judicial and statutory purposes – for reasons of substantial public interest;
- necessary for the administration of justice;
- necessary to protect the vital interests of the data subject or another individual; and
- necessary for the safeguarding of children and of individuals at risk.
The above list contains only a few specifications that can be used to satisfy the release of special category data, any of which may be applied to Ms. Bulley’s case. However, the police must be able to demonstrate that the processing is strictly necessary and satisfy one of the conditions in Schedule 8.
The question remains, was publishing the statement of “in the past suffered with some significant issues with alcohol which were brought on by her ongoing struggles with the menopause” strictly necessary? Did it have a positive impact on the case?
Due to the controversy, the Information Commissioner’s Office (“ICO”) has made the following statement:
“We recognise that at this stage of an intensive, live investigation, the force must focus all their energies on the enquiry. But given the high profile nature of this case, we will be asking Lancashire Police to set out how they reached the decision to disclose this information in due course.”
One thing that may well be a sticking point in the ICO investigation of this case is the definition of personal data outlined on the ICO website “Any information relating to an identified or identifiable living individual. An identifying characteristic could include a name, ID number or location data. You should treat such information as personal data even if it can only be potentially linked to a living individual”. This article has been written after the tragic identification of Ms. Bulley’s body and therefore, there is a chance that the police may well rely on the above definition for their actions, as Ms. Bulley is unfortunately now deceased. However at the time that the Police made their disclosure, this was yet to be confirmed and Ms. Bulley had to be presumed to be alive.