qualifications. First, he does not accept that it is to be interpreted as invariably requiring a written request in advance of the disclosure. He submits there may well be cases where the police have an urgent need for the information and the university ought to be at liberty to provide that information, even though no written request has been made in advance. Secondly, he submits that even if the policy in the document is not followed, that does not entitle the claimant to the relief which he now seeks in the action, since the policy document was not contractual and cannot give rise to any other form of relief. Accordingly, Mr Knight submits the claimant’s claim against the university is still bound to fail, notwithstanding the information which has come forth from the police. 32. In my judgment, the claim based on the Data Protection Act is unarguable. The Act clearly contemplates the data controller, (which is what the university was,) being exempt from the first data protection principle if the information is sought by the police for the purpose of detection of crime or the apprehension or prosecution of offenders. There is nothing in s.29 which stipulates that that request must be made in writing. There are conditions, but I accept the submission of Mr Knight that the condition in 6.1 of the schedule was plainly satisfied in this case. I bear in mind that the police were investigating a series of serious sexual assaults that were of great concern to the university community and, quite apart from the university’s general desire to assist the police in the detection of crime, there were added reasons why it should be keen to do so in this particular case. 33. In my judgment as well, the claim based on an alleged breach of contract also has no realistic prospect of success. I accept that when the matter was before Master Yoxall this aspect of the claimant’s claim may not have had the attention which it would otherwise have done, since on the basis of the information provided by Ms Yule it appeared that the university had had a written request in advance from the police and as Mr Knight has accepted, that was not so. But nonetheless, it seems to me that the argument that the data protection policy was incorporated as a contractual document simply is not sustainable. 34. The registration document to which I have referred and which the claimant signed, does not purport to incorporate the data protection policy as part of the contract between the student and the university, nor does the policy itself. 35. Mr Masters, in the course of his submissions, asked the rhetorical question, well if it was not part of the contract what was its purpose? The answer to that is clear. Like many non-contractual policies, it articulated what the policy was that the university expected to adopt, but failure to follow through on those policies does not necessarily mean that there is a claim for breach of contract and, in my judgment, in the context of this case, it is unarguable that that was the effect of the data protection policy. 36. I accept as well Mr Knight’s argument, that the policy cannot be understood to mean that there will be an invariable rule that information will only be provided to the police if a written request is made in advance. I appreciate the point made by Mr Masters that the policy says the information will not be provided in response to a telephone request and there must be a written request. Although that is written in mandatory terms, it seems to me that it is inconceivable that the drafter of the policy would have intended