12 November 2025
Tracking People without Consent
By Jess Pembroke, Director of Information Law Services
I saw the College of Policing’s project, “Dementia safeguarding scheme to reduce missing person cases”, and it struck me on a deeply personal level. I’ve seen first-hand the distress caused when a loved one with dementia wanders off, the fear that they might walk into traffic or become lost in unfamiliar surroundings. It’s a situation no family should have to face. In those moments, the right to privacy feels secondary to the right to life. This is where data protection, often seen as a barrier, can be a force for good.
Balancing Rights: Privacy vs. Protection
The UK GDPR is built to protect individuals’ rights, including the right to privacy. But it also recognises that these rights must be balanced against others. Data protection law is rooted in human rights legislation, and in safeguarding contexts, especially involving vulnerable individuals there is some flexibility.
When I read about the Dementia Safeguarding Scheme, which uses trackers to monitor vulnerable people’s whereabouts, my data protection training immediately got me thinking about which legal basis would be most appropriate for the use of this personal data. There are several legal bases available under UK GDPR, including consent and public task. Where special category data is concerned, further legal bases such as substantial public interest or vital interests that must also be considered.
The Problem with Consent
Consent is often a first choice in organisations, but in safeguarding scenarios, it’s not likely to be appropriate. Many individuals with Dementia may lack the full capacity to give informed consent, and others may withdraw it without understanding the consequences. In these cases, relying on consent can be risky and ineffective.
Other Legal Basis
The other legal basis which may have been used for this project include:
- Article 6(1)(e) – Public Task
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. - Article 6(1)(c) – Legal Obligation
If police forces are under statutory duties to safeguard vulnerable adults, this basis may also apply.
2. Article 9 – Lawful Basis for Processing Special Category Data
Because the scheme involves health-related data (e.g. dementia status), a lawful basis under Article 9 is also required. The most relevant are:
- Article 9(2)(g) – Substantial Public Interest
Supported by Schedule 1 of the Data Protection Act 2018, particularly:- Paragraph 6 – Statutory and Government Purposes
- Paragraph 18 – Safeguarding of children and individuals at risk
These provisions allow processing where it is necessary to protect vulnerable individuals and is carried out under a legal obligation or public authority.
- Article 9(2)(h) – Health or Social Care
If the scheme is integrated with health or social care services.
I would hope that the organisations involved in this project have completed a Data Protection Impact Assessment to ensure that they have selected the most appropriate legal basis, and that the other elements of data protection law such as security and retention have been considered.
Security and Scope Matter
If we’re going to track vulnerable individuals, we must do so securely. Devices must be tamper-proof, data must be encrypted, and access must be strictly controlled. The police are sometimes criticised for being overly keen to conduct surveillance[1] on the population, but I believe this project is a case where tracking is not only appropriate, it’s essential. That said, tracking must remain proportionate and wider monitoring of individuals should not be done for unrelated purposes.
Why This Matters
Projects like this help me remember that data protection isn’t just about ticking boxes. In the case of dementia and similar conditions, we need frameworks that allow carers and support organisations to act swiftly and safely, without compromising our other human rights.
Would you benefit from training on Data Sharing or are you interested in taking your Data Protection knowledge to the next level, if so enrol now on our Advanced Certificate in Data Protection dates in November or contact us about in-house training options.
For support on Dementia please see Dementia UK
[1] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/04/statement-on-police-use-of-facial-recognition-technology-frt/