Police Scotland forced to give evidence to Scottish Parliament on intrusive mobile phone extraction technology following Privacy International's report

Following on from the publication of our ‘Digital Stop and Search’ report last month, into the use of intrusive technology that enables officers to download all of the data stored on our mobile phones, we are pleased that Scotland's Justice Sub-Committee on Policing have been scrutinising Police Scotland over their use of the technology.

During the hearing by Scotland's Justice Sub-Committee on Policing on 10th May John Finnie MSP stated he personally did not feel reassured, after grilling Police Scotland for an hour over trials of so-called 'cyber kiosks' and plans for a roll-out throughout Scotland. The controversial use of mobile phone extraction technology, enables police forces to download all of the content and data from people’s phones. This can apply to suspects, witnesses and even victims – without their knowledge. 

Its use in Scotland has come to light following Privacy International's report 'Digital Stop and Search', which highlighted that use of this technology has taken place with little or no public or parliamentary awareness or scrutiny and on an unclear legal basis. Investigations by Sunday Herald journalist Peter Swindon has led to further details of the trials in Stirling and Edinburgh being exposed.  

The hearing is the first time Parliamentarians anywhere in the UK have held the police to account in relation to key issues around use of this technology including the absence of policy, failure to conduct Human Rights, Equality and Data Protection Impact Assessments and the deeply concerning fact that many individuals will be unaware that data is being extracted from their phones.

MSPs representing constituents from Edinburgh, where one of the trials took place, raised concerns that they were surprised at the lack of impact assessments, failure to consult with MSPs and absence of public awareness efforts prior to trials that resulted in over 600 phones being examined. Questioned whether advice was given to owners of a devices before extractions took place, DS Burnett of Police Scotland admitted it was not. 

Time and again DS Nicola Burnett, sought to emphasise that these are not new practices and instead let officers carry out what they already do more quickly. However, when challenged that information contained on smart phones was vastly different to what SIM cards held in the 1990's, DS Burnett acknowledged that the amount of information held on phones is growing.

When questioned about the legislative framework and independent oversight, it is clear that Police Scotland, as with other forces throughout the UK, are relying on unclear outdated laws that fail to account for the vast quantities of highly sensitive data we hold our phones. Police Scotland failed to point to any independent oversight and stated it relies on powers in the common law and other statutory powers such as Misuse of Drugs Act. When asked whether warrants had been obtained to carry out mobile phone extractions, Police Scotland were unable to respond stating that they had not retained this information and that the trial was considered a proof of concept about the technology, indicating they did not consider basic safeguards, much to the bemusement of many MSPs in the committee.

Whilst it is concerning that the police rushed ahead with trials before considering the impact of their practices on individuals, the need for independent oversight and basic safeguards, the scrutiny conducted by the Scottish Parliament stands in stark contrast to the rest of the UK. Despite Privacy International writing to the Home Office, the Science and Technology Committee, the Justice and Home Affairs Committee and the Joint Committee on Human Rights there has been a notable failure to take up this issue. 

However, an investigation by Elizabeth Denham, Information Commissioner, will hopefully shed light on potential breaches of data protection safeguards following Privacy International's complaint to the Information Commissioners' Office.