{"id":470340,"date":"2026-03-11T21:42:07","date_gmt":"2026-03-11T21:42:07","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/470340\/"},"modified":"2026-03-11T21:42:07","modified_gmt":"2026-03-11T21:42:07","slug":"police-scotland-fined-66000-after-sharing-contents-of-victims-phone-with-alleged-rapist","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/470340\/","title":{"rendered":"Police Scotland fined \u00a366,000 after sharing contents of victim’s phone with alleged rapist"},"content":{"rendered":"

Police Scotland has been fined \u00a366,000 by the UK data watchdog after sharing the entire contents of a rape survivor\u2019s phone with her alleged attacker.<\/p>\n

On July 5, 2022, the woman received a letter from a police data protection officer confirming that personal data and images had been shared incorrectly with third parties.<\/p>\n

Her phone had been submitted voluntarily as part of an investigation into criminal allegations against a serving police officer.<\/p>\n

The data was passed to Police Scotland\u2019s Professional Standards Department (PSD). As part of the procedure, the officer subject to investigation is provided with the investigator\u2019s report and relevant documents prior to a hearing.<\/p>\n

On June 14, 2022, all of the woman\u2019s mobile data was provided to the accused officer, his police federation representative and his solicitor.<\/p>\n

In a letter seen by STV News, Police Scotland said this was \u201chuman error\u201d.<\/p>\n

Three days later, the discs were retrieved from the officer. On June 22, 2022, the information was retrieved from the SPF and the solicitor.<\/p>\n

One disc contained 39,233 pages of information following the initial download of the phone. One included 697 image files, 17 uncategorised files and 13 video files, the majority of which were not relevant to the investigation.<\/p>\n

Only one disc contained messages between the victim and the accused officer.<\/p>\n

A review carried out by officers identified 15 images described as intimate which had been incorrectly shared along with the woman\u2019s medical records.<\/p>\n

Almost two months following the breach, an email from a Police Scotland data protection officer stated that the PSD National Complaint Assessment and Resolution Unit determined the matter \u201ccould be considered under criminal legislation\u201d.<\/p>\n

The woman told STV News: \u201cThis has left me with significant psychological issues.<\/p>\n

\u201cAt the time this happened, I had a five-month-old child. I don\u2019t remember a lot about their early years because of the toll this had on me.<\/p>\n

\u201cIt has been traumatic.\u201d<\/p>\n

\u2018Substantial volume of\u00a0highly sensitive\u00a0information\u2019<\/p>\n

In the initial letter sent to the woman, Police Scotland determined that the breach \u201cdid not meet the statutory notifiable requirements\u201d for the force to report itself to the data watchdog, the Information Commissioner\u2019s Office (ICO).<\/p>\n

But, Police Scotland claimed in the letter that it reported the breach to \u201cdemonstrate accountability and transparency\u201d.<\/p>\n

However, in an email seen by STV News, an ICO lead investigator stated they were not made aware until the affected woman lodged a complaint on September 2, 2022 \u2013 three months after the incident.<\/p>\n

The ICO confirmed it would investigate the \u201cunlawful disclosure\u201d of data and Police Scotland\u2019s \u201cmobile phone extraction process\u201d.<\/p>\n

On Wednesday, March 11, 2026 \u2013 three and a half years after it being reported \u2013 the ICO said it had issued a \u00a366,000 fine and a reprimand to Police Scotland for serious failures in the handling of sensitive personal information.<\/p>\n

\u201cThe ICO\u2019s investigation found that\u00a0Police Scotland extracted the\u00a0entire\u00a0contents of a\u00a0person\u2019s\u00a0mobile\u00a0phone\u00a0after they reported an alleged crime,\u00a0without ensuring there were sufficient safeguards to\u00a0prevent access to irrelevant\u00a0personal\u00a0information,\u201d the watchdog said.<\/p>\n

\u201cAs a result, officers collected a substantial volume of\u00a0highly sensitive\u00a0information,\u00a0much\u00a0of which\u00a0had no\u00a0bearing on\u00a0the investigation.\u201d<\/p>\n

The impacted woman believes a full audit should be carried out into the number of data breaches that may not have been reported by Police Scotland.<\/p>\n

She said: \u201cPeople who hand over their phones as part of sensitive enquiries should be aware that the data may be handed into the wrong person\u2019s hands.<\/p>\n

\u201cMore things need to be in place to ensure this doesn\u2019t happen again. It\u2019s too late for me.\u201d<\/p>\n

In a letter this month, chief superintendent Helen Harrison said that processes surrounding personal data had been strengthened, training and support for staff had improved, and oversight had increased to ensure similar incidents don\u2019t happen.<\/p>\n

She added: \u201cPolice Scotland is committed to learning from this incident and ensuring people\u2019s information is treated with care\u201d.<\/p>\n

The Information Commissioner\u2019s Office determined that the complaint \u201chighlighted serious data protection concerns\u201d.<\/p>\n

Sally-Anne Poole, ICO head of investigations, said: \u201cAt its heart, data protection is about people, and this incident is a stark example of the devastating consequences of poor data protection practices on individuals.<\/p>\n

\u201cPolice Scotland failed in its obligation to safeguard the personal information of someone who had reached out to them for help. Instead, they exposed them to further risk and distress by disclosing highly sensitive information to a third party.<\/p>\n

\u201cPeople should be able to trust that organisations will treat their personal information with care, fairness and respect. When organisations fail to do so, they can expect enforcement action from us.\u201d<\/p>\n

On the ICO ruling \u2013 Deputy Chief Constable Alan Speirs said: \u201cPolice Scotland has received the Information Commissioner\u2019s Office reprimand and penalty notice, and reflected on its findings.<\/p>\n

\u201cWe acknowledge the organisation did not meet expectations and regulations relating to data handling in regards to this matter. We have also apologised to those involved in this matter.<\/p>\n

\u201cPolice Scotland has taken organisational learning from this incident. Substantive steps have already been made to strengthen our processes for handling personal data, improving training and support for staff, as well as increasing oversight to reduce the risk of something similar happening in the future.\u201d<\/p>\n

A Police Scotland spokesperson said: \u201cThis data breach occurred as a result of human error in the preparation of a pack relating to an internal investigation.<\/p>\n

\u201cPolice Scotland reported the breach to the ICO in June 2022.<\/p>\n

\u201cWe acknowledge there was a delay in the reporting process and have implemented processes to minimise the risk of this occurring again in the future.\u201d<\/p>\n

STV News is now on WhatsApp<\/p>\n

Get all the latest news from around the country<\/p>\n

Follow STV News <\/a>Follow STV News on WhatsApp<\/p>\n

Scan the QR code on your mobile device for all the latest news from around the country<\/p>\n

\"WhatsApp<\/p>\n","protected":false},"excerpt":{"rendered":"Police Scotland has been fined \u00a366,000 by the UK data watchdog after sharing the entire contents of a…\n","protected":false},"author":2,"featured_media":470341,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-470340","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/470340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=470340"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/470340\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/470341"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=470340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=470340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=470340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}