Emergency Requests for Personal Information
In order to protect the vital interests of an individual or individual(s) in emergency situations, authorised agencies such as the Police or Hospitals, may request personal data about specific individuals from the University. Examples are medical emergencies, accidents, and next-of-kin requirements.
Schedule III(3) of the DPA provides authorised agencies with the mechanism to request, and the University the authority to either release or decline to release, personal data without the explicit consent of the individual(s). The University (a) must ensure that the release is necessary, (b) that it is not possible or practical in the circumstances to seek the necessary consent(s), and (c) that it is acting in good faith.
In all cases, including those refused, the request must be logged for audit purposes including:
- details of the request,
- an assessment of the veracity of the request,
- the requester(s) name and role [eg: Police Officer, A&E doctor/nurse],
- the requester(s) warrant card number or similar official identification details - when appropriate
- the University person(s) handling the request,
- the action(s) taken,
- the date/time for each action,
- the information released.
If such a request is via phone then do not simply assume that the phone number provided by the requester is genuine unless you are entirely confident as to the identity of the requester - seek and use the phone number of the organisation [eg: Police Office, Hospital] from the phone directory or similar.
If in doubt about a request, you must seek advice from the Head of Registry, the Director of Human Resources, the Head of Central Services, or the University's Data Protection Officer.
The Police, and other authorised agencies, may request personal data about specific individuals from the University for the purposes of the prevention or detection of crime, and the apprehension or prosecution of offenders. These requests are covered in a separate entry elsewhere in this A to Z Guide - Police requests for personal data.