{"id":4817,"date":"2026-03-13T06:37:32","date_gmt":"2026-03-13T06:37:32","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2026\/03\/13\/police-scotland-fined-after-sharing-victims-phone-data\/"},"modified":"2026-03-13T06:37:32","modified_gmt":"2026-03-13T06:37:32","slug":"police-scotland-fined-after-sharing-victims-phone-data","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2026\/03\/13\/police-scotland-fined-after-sharing-victims-phone-data\/","title":{"rendered":"Police Scotland Fined After Sharing Victim\u2019s Phone Data"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n

Police Scotland has been fined \u00a366,000 and reprimanded after a serious data protection failure when it shared the entire contents of a female officer\u2019s phone with a colleague she accused of rape.<\/p>\n

The incident, which spanned several months in early 2021, stems from an internal officer misconduct investigation.<\/p>\n

An Information Commissioner\u2019s Office (ICO) penalty notice redacted many of the details, but the victim in question subsequently waived her right to anonymity in a BBC report.<\/p>\n

According to the ICO, the police force obtained the victim\u2019s phone in order to download text messages between her and the \u201cthird party\u201d under investigation.<\/p>\n

However, the full contents of the device were apparently extracted because it was deemed \u201crelevant and proportionate\u201d to the investigation and \u201cin the interest of returning the device at the earliest opportunity to the data subject.\u201d<\/p>\n

Read more on ICO fines for police forces: South Yorkshire Police Deletes 96,000 Pieces of Digital Evidence.<\/em><\/p>\n

While this course of action was found by the ICO to be \u201cexcessive and unfair,\u201d the second incident involved an even more egregious error by the force.<\/p>\n

The phone data \u2013 which reportedly included medical records, intimate photos and friends and family contact details \u2013 was erroneously passed to the officer under investigation.<\/p>\n

According to the ICO, Police Scotland also failed to notify it of these serious contraventions of the Data Protection Act within the required 72-hour timeframe.<\/p>\n

In fact, the victim, a detective constable in the force, told the BBC she was first notified about the incident in June 2022 by the Scottish Police Federation (SPF).<\/p>\n

She complained to the ICO later that year that Police Scotland had refused to provide her with a copy of the information it erroneously disclosed. The ICO subsequently began its investigation in May 2023.<\/p>\n

Counting the Human Cost<\/strong><\/h2>\n

The ICO concluded that Police Scotland had failed to:<\/p>\n