UK police forces are routinely extracting and storing excessive amounts of personal information from the mobile phones of victims, witnesses and suspects without an appropriate basis in existing data protection law, which could ultimately deter people from reporting crimes.
That is the stark conclusion of a new investigation carried out by the Information Commissioner’s Office into the use of mobile phone extraction by police forces when conducting criminal investigations in England and Wales.
The report follows the controversial introduction of digital consent forms by the National Police Chiefs’ Council (NPCC) and Crown Prosecution Service (CPS). Victims of crime - including sexual offences - were told that if they did not hand over their phones, charges against alleged attackers might be dropped.
While police data extraction practices vary across the country, some forces were found to be retaining large volumes of data, including intimate details of the private lives of device owners as well as their family, friends and colleagues.
In many cases the photographs, messages, emails and social media posts were being stored in unencrypted format presenting “considerable risks to privacy”.
Information Commissioner Elizabeth Denham said: “The existing laws that apply in this area are a combination of common law, statute law and statutory codes of practice. I found that the picture is complex and cannot be viewed solely through the lens of data protection. As this report makes clear, a whole-of-system approach is needed to improve privacy protection whilst achieving legitimate criminal justice objectives.”
“People expect to understand how their personal data is being used, regardless of the legal basis for processing. My concern is that an approach that does not seek this engagement risks dissuading citizens from reporting crime, and victims may be deterred from assisting police.”
The ICO’s report recommends that a number of measures are implemented across law enforcement to improve compliance with data protection law and regain some public confidence that may have been lost.
The ICO is also recommending the introduction of a new code of practice to improve practices and better support police and prosecutors in their work.
Denham said: “While the work needed to implement my recommendations must not fall by the wayside, I am acutely aware that this report is issued at a time of unprecedented challenges flowing from the Covid-19 pandemic. I therefore acknowledge that the timeline for change will be longer than usual, but I am keen that we begin to make progress as soon as practicable, and I am committed to supporting that work at all stages.”