Latest news & updates.

Articulating your legitimate interest before you instruct an enquiry agent or investigator

Articulating your legitimate interest before you instruct an enquiry agent or investigator

Very recently we were contacted by a solicitor to trace the son of client who was dying. The fathers dying wish was to speak with his son and include him within his will. It was explained to me that the pair had not spoken for several years following an argument and that the father wanted to try and make amends. The experienced solicitor was somewhat surprised when I explained that what we first needed to do was address whether the father had a ‘legitimate interest’ to commission the inquiry.


Tremark have been tracing debtors, personally serving documents, and undertaking various investigative enquires for 25 years.

During that period our industry has hit quite a few sticky patches; allegations of systematic blagging by tracing agents, SOCA’s revelation that 104 well known legal firms employed enquiry agents found guilty of data offences, the Leveson inquiry, the Parliamentary Home Affairs Select Committee inquiry into Private Investigators – Yet no UK government has implemented regulation of the investigatory industry as per legislation that received royal assent in 2001 in the form of the Private Security Act.

The absence of regulation has undoubtedly allowed some to thrive, who let’s be honest, would not get away with it had they had someone to be accountable to.

At last, it appears that we all do have someone to be accountable to, thanks to GDPR.


The Data Protection Act 2018 (or GDPR), places great responsibility on a solicitor and any third party that they instruct when it comes to processing an individual’s data. The Information Commissioners Office (ICO) have made it extremely clear that we must all be able to demonstrate governance and compliance and that we will be accountable.

Before processing any personal data, you must ensure that you have a lawful basis for processing data on which you are to rely. There are six legitimising processing conditions as set out in Article 6:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.


Given that a 99% of our activity as professional investigators and process servers is necessarily undertaken without the subject’s knowledge and therefore consent, it is most probable that we and our client will be seeking to justify processing on the grounds of having ‘Legitimate Interests’.

The ICO go into some detail into the subject of legitimate Interest and the requirements upon which it can be used as a legal basis to process data without consent.

• The legitimate interests can be your own interests or the interests of third parties. They can include commercial interests, individual interests or broader societal benefits.

• The processing must be necessary. If you can reasonably achieve the same result in another less intrusive way, legitimate interests will not apply.

• You must balance your interests against the individual’s. If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests.

• Keep a record of your legitimate interests’ assessment (LIA) to help you demonstrate compliance if required. You must include details of your legitimate interests in your privacy information.


The ICO talk about the need to demonstrate compliance a lot. On the subject of legitimate interest, it is clear that you must be able to articulate why your legitimate interest outweighs the data subject’s fundamental right to privacy, before relying on it as your legal basis to process. *[1] 

Tremark undertake a LIA in the form of a Data Processing Impact Assessment (DPIA) on our clients’ behalf on every single instruction we receive and before any data processing takes place. This DPIA is retained on file to demonstrate that consideration was undertaken before any processing took place and that our planned data processing was proportionate.

Each DPIA includes:
• A systematic description of the envisaged processing operations and purposes of processing

• An assessment of the risks to the rights of data subjects

• The measures envisaged to address the risks, including safeguards, security and mechanisms to ensure protection of the personal data.

• An assessment of the necessity and proportionality of the processing

  • is there a legitimate interest behind the processing?
  • is the processing necessary for that purpose?
  • is the legitimate interest overridden by the individual’s interests, rights or freedoms?


Clearly, in the example above the son has an absolute right to privacy, he has had the ability to get in touch with his father who had not moved address but had chosen not to do so. Does the fathers wish to ‘make amends’ outweigh the sons fundamental right to privacy? No.

However, in such cases, the investigator can put ‘measures’ in place, such as trying to obtain post trace consent to limit the risk that any negative effect that the processing may have. In other words, obtain permission from the individual traced to pass back their whereabouts to the instructing party.

This may also include the speaking with or the passing of a letter from the instructing party by the investigator to the traced individual.

Tremark Associates undertake process serving, people tracing and a wide range of investigatory services. They can be contacted by clicking here or via email to

[1] A useful document written by the ICO on the subject of legitimate interests can be downloaded by clicking here.

About The Author

Mark Hodgson is the Managing Director of Tremark Associates, one of the UK’s leading providers of investigative services. Mark formed Tremark aged just 25 in 1995 and has over 30 years experience in private investigations and commercial debt recovery industries. He is a leading figure and a campaigner for regulation of the Industry and past President of the Association of British Investigators, a member of the World Association of Detectives, The Chartered Institute of Credit Management, The Institute of Paralegals and an associate member of R3 -The Association of Business Recovery Professionals. Mark splits his time between the Leeds and London Offices. He is a dad of two, a keen runner, cyclist and a Leeds United season ticket holder.