ICO fines Police Scotland over data-sharing debacle in gross misconduct case

The UK's data protection watchdog has fined Police Scotland £66,000 ($88,000) for what it calls a "serious failure" in handling an alleged victim's sensitive data.

The Information Commissioner's Office (ICO) said that Police Scotland, the UK's second-largest police force, was "excessive and unfair" in its decision to lift the entire contents from a mobile phone belonging to an individual who reported a crime.

Police Scotland needed to extract the text messages between the individual, a woman, and the alleged offender, a man, as part of its investigation into a 2021 incident, which involved two Police Scotland employees. 

However, according to the ICO's reprimand and penalty notice [PDF], the senior investigating officer justified a full extraction as proportionate to the case and in the interest of returning the device as soon as possible.

This led to the police acquiring a "substantial volume" of highly-sensitive ...