Police and prosecutors have been told to stop the mass collection of personal information from rape victims or face being fined by the UK’s data watchdog.

The Information Commissioner’s Office (ICO) said they must immediately stop getting complainants in rape and serious sexual offence cases to sign forms, known in England and Wales as Stafford statements, which give officers general consent to obtain often highly sensitive third-party materials, including medical, education and counselling records.

In a report, published on Tuesday, the ICO says the current approach is undermining trust and confidence in the criminal justice system and re-victimising complainants, who can be subjected to a far greater level of interrogation about their personal information than the suspects they accuse.

John Edwards, the UK information commissioner, said: “We’ve got to this position now that when somebody fronts up and makes a complaint about serious sexual assault, they have a form stuck in front of them saying: ‘Please authorise us to access any information we want’ and they [the police or prosecutors] are just not exercising the thoughtfulness and discipline we would expect and they’re going off on these quite wide fishing expeditions.

“We think these practices are widespread and they need to change and we’ve sort of put some stakes in the ground for investigators so that they understand what the limits are of their ability to investigate. What we’re saying is: ‘Here are the rules and if you don’t comply with those, we will come back with an enforcement hat on.’”

Rape prosecutions fell nearly 60% in four years to 2,102 in 2019-20 even as the number of reports to police increased. Figures published last year showed the proportion of rape complainants dropping out of cases had risen from 25% to 43% over a five-year period to December 2020. Edwards said one of the reasons women were dropping out were because of intrusive information collection.

He said that by addressing the issue he hoped to improve “one little bit of the criminal justice system” and predicted it “could have a greater impact on people’s lives than any other work my office has been involved with”.

The report says: “Data minimisation is key” and any personal data obtained relating to a victim must be adequate, relevant and not excessive. Forms requesting information from third parties should make clear whether the requests are voluntary or mandatory and explain that the information sought might end up being disclosed to the defendant, it says.

The ICO’s report was welcomed by victims’ rights campaigners, who said intrusive and irrelevant requests of personal data from rape complainants had become habitual.

Claire Waxman, the victims’ commissioner for London, said: “The message is clear: the justice system is asking too much of rape victims and denying them justice … I am yet to see a case where primary school records or counselling notes hold any relevant information, yet these requests are regularly made.”

Dame Vera Baird QC, the victims’ commissioner for England and Wales, said such requests had played “a crucial role in the collapse of rape prosecutions” and urged the government to legislate to limit the pursuit of third-party material in its victims bill.

Jayne Butler, the CEO of Rape Crisis England and Wales, said the recommendations “have the potential to drastically improve the experiences of victims and survivors going through the criminal justice process. If implemented, these changes could support the police and CPS [Crown Prosecution Service] to prioritise victims’ rights and ensure they have a voice.”

Rebecca Hitchen, from the End Violence Against Women Coalition, said the report was “completely at odds with the CPS decision last week to lower the bar for disclosure and the sharing of counselling notes, further weakening any sense of privacy that victims have”.

A CPS spokesperson said: “We are working jointly with police and criminal justice partners to get this right and rebuild confidence, by providing early advice to focus the investigation on relevant lines of inquiry and looking at the suspect’s behaviour before, during and after the alleged incident.”

The ICO’s report follows its previous warning that police are extracting “excessive amounts of personal data” from the mobile phones of victims and witnesses during investigations.