Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office under the Data Protection Act.

Their online request form solicits much intrusive information. What purposes may information so supplied be used for?

1 Answer 1


From ACRO's Subject access - further guidance web page:

Why do I need to supply proof of ID?

We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC.

As for this proof of ID (personal data) provided when submitting a Subject Access Request, ACRO's Privacy policy states:

We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. At the moment this information consists of:  

  • Statistical information obtained using Google Analytics. No information collected can be used to identify individual users. For more details about how this affects your privacy please visit the Google Analytics Privacy Centre. If you don’t want to send information to Google Analytics, an Opt-out Browser Add-on is also available or you can configure your browser to let you to choose which, if any, cookies are allowed to be created.

  • Information obtained by our content management system to examine what people are searching for, what they find and occasions where no results are returned. Information collected can’t be used to identify individual users.

  • Information provided by users through online forms; it's held in our UK-based secure data centres and is retained in line with the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679, and our retention policies.

However, I have not been able to locate publicly available copies of the retention policies referred to in the emboldened text.

  • Yes but is it permitted to be retained and/or used for any other purposes? Commented Oct 13, 2022 at 19:19
  • Retain what? Your PNC record, or your ID used to get it?
    – user35069
    Commented Oct 13, 2022 at 21:11
  • No the additional data received in relation to your request to obtain the data on you which was already previously held. Commented Oct 13, 2022 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .