Police Scotland has been hit with a £66,000 fine and a public reprimand after a shocking failure to protect a crime victim’s most private information. The UK’s data watchdog found officers downloaded an entire phone without limits, then sent masses of unrelated sensitive material to someone who should never have seen it.
The incident has left the victim facing fresh trauma on top of an already devastating experience of reporting a crime.
What Went Wrong
The case began when a member of the public came forward to report an alleged sexual offence. Instead of extracting only relevant evidence, officers downloaded the complete contents of the complainant’s mobile phone.
This sweeping approach captured years of private messages, health records, intimate photos and other deeply personal data that had no connection to the investigation.
The Information Commissioner’s Office ruled the extraction was excessive, unnecessary and unfair.
Later, when preparing a separate misconduct case, Police Scotland included the entire unredacted phone download in a disclosure bundle and sent it to a third party who had no right to see it.
No one properly reviewed or redacted the material first. Basic security steps were missed entirely.
The ICO’s Damning Findings
Investigators listed multiple serious failures:
- No proper policies to limit what data could be taken from devices
- Staff lacked clear guidance on handling sensitive information
- Inadequate redaction and review processes before sharing files
- Failure to report the breach to the ICO within the required 72 hours
Sally-Anne Poole, ICO Head of Investigations, did not hold back.
“Someone reached out to police for help after a traumatic experience, yet Police Scotland exposed them to further risk and distress by disclosing highly sensitive information to a third party,” she said.
“People must be able to trust that when they report crimes, their personal information will be treated with care, fairness and respect.”
Victim Left “Devastated and Betrayed”
Although the individual’s identity remains protected, the ICO confirmed the breach caused significant distress.
Friends of the victim told Scottish media the person felt “completely violated” after learning their private life had been handed over without warning or consent.
One source close to the case said the victim now struggles to trust any authority figure and has needed additional counselling because of the police failure.
Police Scotland’s Response and Changes Made
Deputy Chief Constable Alan Speirs issued a full apology.
“We got this wrong and we are truly sorry for the distress caused to the individual concerned,” he said.
“We have already strengthened our policies, improved training and introduced new technical controls to prevent this happening again.”
Police Scotland says it has now rolled out:
- New “proportionate extraction” guidelines for mobile devices
- Mandatory redaction training for all staff handling disclosure material
- Better auditing of what data leaves the force
- Upgraded systems to flag excessive downloads
The force also highlighted that it voluntarily reported other issues to the ICO as part of its commitment to improve.
Why This Matters to Everyone
This case exposes a uncomfortable truth: even the organisations we trust most with our safety can sometimes treat our personal information carelessly.
When someone reports rape or sexual assault, they are already at their most vulnerable. The last thing they need is police adding to their trauma through sloppy data handling.
The ICO reduced the original potential fine because Police Scotland is a public body and higher penalties could affect frontline services. Many campaigners argue the £66,000 penalty still feels too low given the harm caused.
This incident follows a pattern of similar problems across UK police forces. Several other services have faced ICO action for excessive phone downloads in recent years.
Campaigners are calling for national standards and independent oversight of how police extract data from victims’ and suspects’ devices.
The message from the watchdog is clear: treat people’s personal information with respect, or face serious consequences.
What do you think about this case? Do you believe police need stricter rules on phone downloads? Drop your thoughts below, and share using #PoliceDataBreach if you’re discussing it on social media.
