Conspiracy to Defraud: Unpacking the Legal Ramifications in the BPS Case

Why this matters

On 11 August 2024, the issue of possible fraud language arose in the continuing dispute about the handling of my Subject Access Request to Balliol Property Services. The immediate concern was not an abstract legal theory. It was whether the handling of the SAR, if deliberately obstructive, could reveal something more serious than poor administration or data-protection non-compliance.

That question has to be approached with discipline. A failed or delayed SAR can be serious. It may justify complaint to the Information Commissioner, a request for review, a claim for compensation, a court application, or regulatory escalation. But it does not automatically mean fraud, conspiracy or criminal conduct.

The correct approach is to separate three things: what is known, what is suspected, and what the documents would need to show before criminal language could responsibly be used.

Why criminal language needs care

Conspiracy to defraud is a serious criminal-law concept. In broad terms, it concerns an alleged agreement between two or more people to act dishonestly so as to prejudice another person’s rights or economic interests. The focus is not simply poor behaviour. It is dishonest agreement.

That distinction matters in a SAR dispute. An organisation may miss a deadline, misunderstand the request, mishandle identity verification, apply an exemption wrongly, or respond defensively because litigation is in the background. Those matters may be unlawful, unfair or unreasonable. They may still fall short of criminal fraud.

Responsible public-interest criticism should therefore avoid jumping from “BPS failed to handle my SAR properly” to “BPS conspired to defraud me” unless there is a document trail showing an agreement, dishonest purpose and intended gain, loss or risk of loss.

The BPS context

The concern in the BPS dispute is whether the SAR process was handled transparently and lawfully. If the organisation failed to respond, withheld information without proper basis, relied on unjustified delay, or allowed the SAR to be shaped by litigation considerations, those matters may justify serious scrutiny.

However, the legal route depends on what the evidence shows. A controller’s failure to comply with the UK GDPR is not the same as proof of criminal conspiracy. A complaint may properly say that the SAR process appears obstructive, conflicted or inadequately explained. It should avoid asserting fraud unless the evidence supports that conclusion.

The strongest position is to focus first on the documents: the SAR, the deadline, the responses, any refusal, any identity-verification correspondence, any internal inconsistency, and any evidence suggesting that disclosure decisions were coordinated for an improper purpose.

What the documents would need to show

The practical test is not whether the conduct felt dishonest. It is whether documents, communications or witness evidence show a coordinated plan that crosses the line from poor compliance into dishonest conduct.

In a SAR dispute, that might include evidence that people agreed to conceal records, falsify search results, misstate whether data existed, invent a reason for delay, destroy or alter documents, or use the SAR process to gain an improper advantage in related proceedings. Even then, the precise legal characterisation would require specialist advice.

Without that pathway, the safer and stronger route is to frame the matter as SAR non-compliance, inadequate transparency, possible misuse of process, or a failure of controller accountability.

Legal routes

The available route depends on the evidence and the remedy sought. If the issue is access to personal data, the immediate route is usually data-protection enforcement: complaint, review, direct correspondence with the controller, and possible civil action where loss or distress has been caused.

If the concern is deliberate document manipulation, false records, destruction of documents, or coordinated deception, the matter may require a different strategy. That could include preserving evidence, obtaining legal advice, considering whether a criminal report is appropriate, and avoiding public allegations that cannot yet be proved.

Fraud language should not be used to strengthen a weak evidential record. It should be reserved for cases where the factual pattern, documentary material and legal advice support it.

Corporate governance point

Even where criminal thresholds are not met, the governance issue remains important. Organisations that handle personal data should have clear systems for SAR compliance, escalation, record retention, searches, redactions, exemptions and response deadlines.

Where a SAR arises during a dispute, those systems become more important, not less. The organisation should be able to show that data-protection compliance was handled separately from litigation advantage, reputational concern or internal defensiveness.

Closing point

The possibility of fraud should not be dismissed where documents genuinely suggest dishonest coordination. But criminal language must be earned by evidence. It is not enough that a SAR was delayed, obstructed or mishandled.

The immediate task is therefore practical: preserve the documents, map the decision chain, identify who knew what and when, and separate regulatory non-compliance from any possible dishonest agreement.

If the evidence only shows poor SAR handling, the route is data-protection enforcement and civil accountability. If it shows coordinated deception, the matter may require a different response. Either way, the strongest position is precise, evidenced and legally disciplined.