Making off without payment 183/2026

FOI Reference: 183/2026

Request

Under the FOI Act, please can you provide me with the following information for 'making off without payment' offence under the Theft Act 1978.

1. Provide me with the full list of 'making off without payment' offences reported to the force which contained the word 'pub' or 'restaurant' in
   the summary in 2025. For each report, include the date, summary and outcome.
2. Provide me with the full list of 'making off without payment' offences reported to the force which contained the word 'pub' or 'restaurant' in the
   summary in 2024. For each report, include the date, summary and outcome.

Response

I can confirm that Dyfed-Powys Police does hold the information requested; however, we are exempting part of that information as we believe that the following exemptions are relevant:

Section 40(2) Personal Information

The Section 40(2) is a class-based absolute exemption and there is no requirement to consider the public interest in disclosure. That being said, where Section 40(2) is engaged in order to make the exemption absolute there needs to be evidence that a data protection principle would be breached by disclosure. In this case, it would not be fair to process information which could lead to the identification of an individual. Therefore, the first principle of the Data Protection Act would be breached.

Section 40(2) Personal Information:

Section 40(2) applies to third party personal data and is exempt from disclosure under the Freedom of Information Act 2000 if disclosure, in relation to data subject to law enforcement processing, would breach any of the data protection principles contained within Part 3 - Chapter 2 of the Data Protection Act 2018. Under Section 34 within Chapter 2 “The Controller in relation to personal data is responsible for and must be able to demonstrate, compliance with” Chapter 2. Such information would not be released under the Freedom of Information Act 2000 unless there is a strong public interest. One of the main differences between the Freedom of Information Act 2000 and the Data Protection Act 2018 is that any information released under FOI is released into the public domain, not just the individual requesting the information and disclosure under the Act must be made with that in mind. As such, any release that identifies an individual through releasing their personal data, even third party personal data is exempt.

Personal data is defined under Section 3 of the Data Protection Act 2018 as:

“(2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a) An identifier such as a name, an identification number, location data or an online identifier, or

(b) One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

All members of the public including those employed by the force have an intrinsic right to privacy and these rights are protected by virtue of the Human Rights Act, the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) and a public authority must not interfere with that right. Any release of the information subject to the exemption is likely to compromise those rights.

Data Protection Act 2018

Part 3 – Law Enforcement – Chapter 2 Principles Section 35

The first data protection principle:

“(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.”

General Data Protection Regulation

Article 5 of the GDPR – ‘Principles relating to processing of personal data’ provides:

“1. ‘Personal data’ shall be

(a) Processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency);

(b) Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest…

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

Dyfed-Powys Police would not want to disclose any information that could potentially identify an individual. In this particular case, to release details would lead to the identification of the individuals involved. To release such information would be a direct breach of Data Protection legislation as a consequence I am satisfied that Section 40(2) Personal Information exemption is applicable to the release of the information.

The Section 40 exemption is a class-based exemption. This means that the legislators when writing the legislation considered that the release of such information under the Freedom of Information Act 2000 would cause harm to the public authority or individual concerned. There is therefore no requirement to carry out a HARM Test in respect of such information.

The Section 40 exemption is in part qualified and in part absolute, in the present case it would be absolute as to release the information would breach Data Protection legislation and therefore there is no requirement to carry out a public interest test.

(This is a response under the Freedom of Information Act 2000 and disclosed on 05/03/2026)