ICO releases study findings on use of mobile phone extraction by police forces

When concerns arose about the potential for excessive processing of personal data extracted from mobile phones, the ICO launched an investigation to understand the privacy and data protection risks.

Information Commissioner Elizabeth Denham said: “Many of our laws were enacted before the phone technology that we use today was even thought about. The existing laws that apply in this area are a combination of common law, statute law and statutory Codes of Practice. I found that the picture is complex and cannot be viewed solely through the lens of data protection. As this report makes clear, a whole-of-system approach is needed in order to improve privacy protection while achieving legitimate criminal justice objectives.”

The ICO’s investigation found that police data extraction practices vary across the country, with excessive amounts of personal data often being extracted and stored without an appropriate basis in existing data protection law.

With these findings, the ICO’s investigation report examines the relevant data protection rules in some detail. It explains the significant requirements that an organisation must meet to rely on the legal basis of consent for data extraction.

Deterred from assistance

The report also describes an alternative condition for processing: where it is necessary for the performance of a task carried out for a law enforcement purpose by a competent authority.

Denham continued: “People expect to understand how their personal data is being used, regardless of the legal basis for processing. My concern is that an approach that does not seek this engagement risks dissuading citizens from reporting crime, while victims may be deterred from assisting the police.”

The ICO’s report recommends that a number of measures are implemented across law enforcement in order to improve compliance with data protection law and regain some public confidence that may have been lost. The ICO is also recommending the introduction of a new Code of Practice to improve mobile phone extraction practices and better support police and prosecutors in their work.

In conclusion, Denham stated: “While the work needed to implement my recommendations must not fall by the wayside, I’m acutely aware that this report is issued at a time of unprecedented challenges flowing from the COVID-19 pandemic. I therefore acknowledge that the timeline for change will be longer than usual, but I’m keen that we begin to make progress as soon as practicable and am wholly committed to supporting that work at all stages.”

Joint response from the NPCC, the CPS and the College of Policing

The National Police Chiefs’ Council, the Crown Prosecution Service and the College of Policing have issued a joint statement in response to the report from the Information Commissioner's Office.

It reads: “Police investigators must balance the need to follow all reasonable lines of enquiry, thereby guaranteeing a fair trial, and with the need to respect privacy. We thank the Information Commissioner for this detailed and thoughtful report which acknowledges the complexity of this issue and the growing volumes of data which exist in criminal cases. We will now carefully consider the recommendations of the report.”

The statement adds: “We note that the Commissioner recognises the need for consistency in how digital evidence is processed for use in criminal investigations. We have all committed to working with stakeholders to ensure this is right and will be continuing such work in light of the recommendations contained in this report.”

Statement from London’s Independent Victims Commissioner

Speaking about the ICO study, Claire Waxman (London’s Independent Victims Commissioner) said: “I wrote to the Information Commissioner’s Office about the serious concerns victims have had in relation to excessive requests and processing of data from their mobile phones, and the fact they feel coerced into consenting to sharing sensitive and personal information, at a time of trauma, if they hope to ever access justice. I’m pleased that the ICO has published the findings of this long overdue investigation into how mobile phone data is used by the police service. This investigation confirms what we’ve known for some time in that major changes are needed when it comes to how the criminal justice system first gathers and then subsequently uses the personal data of victims and how this is being communicated to victims.”

Further, Waxman opined: “As the report rightly points out, the current practices around how police collect mobile phone data, how much data they request and how this data is shared with others is damaging public confidence in our criminal justice system, and can actively deter victims from pursuing the justice they deserve. It also highlights the deeply concerning inconsistency in terms of how police forces across the country gather and use mobile phone data and rightly highlights how vital it is that the police communicate clearly with victims about how their mobile phone data will be stored and used.”

Waxman continued: “We still need to understand how these requests from the police and the CPS for excessive personal data are fuelling high levels of victims withdrawing from cases. This is why, in London, I’m working with the Metropolitan Police Service to investigate mobile phone data requests and the impact on victims and justice outcomes.”

As far as Waxman is concerned, the ICO’s call for a Code of Practice is a good first step, but there is nonetheless a need to move quickly to clearly set out how much data from a mobile phone is needed to help an investigation and secure justice, while always ensuring a victim’s right to privacy is properly protected.

“It’s clear that the criminal justice system has lost sight of reasonable and proportionate requests, while the legislation itself has not kept pace with the development of technology. The sheer amount of personal and sensitive information we now have on our phones means that the current laws are no longer fit for purpose. We need the Government to urgently review legislation.”

In conclusion, Waxman said: “While I welcome the work the ICO has done for this investigation, I do feel the recommendations have not gone far enough to provide the clarity the police service urgently needs in order to ensure a consistent approach that not only complies with data protection laws, but is also needed such that victims can feel confident, when reporting a crime, that their data will not be used to discredit them and will be handled securely and with respect throughout the criminal justice process.”