THE INFORMATION Commissioner’s Office (ICO) has released an investigation report into the use of mobile phone extraction by police forces when conducting criminal investigations in England and Wales.
When concerns arose about the potential for excessive processing of personal data extracted from mobile phones, the ICO launched an investigation to understand the privacy and data protection risks.
Information Commissioner Elizabeth Denham said: “Many of our laws were enacted before the phone technology that we use today was even thought about. The existing laws that apply in this area are a combination of common law, statute law and statutory Codes of Practice. I found that the picture is complex and cannot be viewed solely through the lens of data protection. As this report makes clear, a whole-of-system approach is needed in order to improve privacy protection while achieving legitimate criminal justice objectives.”
The ICO’s investigation found that police data extraction practices vary across the country, with excessive amounts of personal data often being extracted and stored without an appropriate basis in existing data protection law.
With these findings, the ICO’s investigation report examines the relevant data protection rules in some detail. It explains the significant requirements that an organisation must meet to rely on the legal basis of consent for data extraction.
Deterred from assistance
The report also describes an alternative condition for processing: where it is necessary for the performance of a task carried out for a law enforcement purpose by a competent authority.
Denham continued: “People expect to understand how their personal data is being used, regardless of the legal basis for processing. My concern is that an approach that does not seek this engagement risks dissuading citizens from reporting crime, while victims may be deterred from assisting the police.”
The ICO’s report recommends that a number of measures are implemented across law enforcement in order to improve compliance with data protection law and regain some public confidence that may have been lost. The ICO is also recommending the introduction of a new Code of Practice to improve mobile phone extraction practices and better support police and prosecutors in their work.
In conclusion, Denham stated: “While the work needed to implement my recommendations must not fall by the wayside, I’m acutely aware that this report is issued at a time of unprecedented challenges flowing from the COVID-19 pandemic. I therefore acknowledge that the timeline for change will be longer than usual, but I’m keen that we begin to make progress as soon as practicable and am wholly committed to supporting that work at all stages.”
Joint response from the NPCC, the CPS and the College of Policing
The National Police Chiefs’ Council, the Crown Prosecution Service and the College of Policing have issued a joint statement in response to the report from the Information Commissioner’s Office.
It reads: “Police investigators must balance the need to follow all reasonable lines of enquiry, thereby guaranteeing a fair trial, and with the need to respect privacy. We thank the Information Commissioner for this detailed and thoughtful report which acknowledges the complexity of this issue and the growing volumes of data which exist in criminal cases. We will now carefully consider the recommendations of the report.”
The statement adds: “We note that the Commissioner recognises the need for consistency in how digital evidence is processed for use in criminal investigations. We have all committed to working with stakeholders to ensure this is right and will be continuing such work in light of the recommendations contained in this report.”