ICO fines Police Scotland £66,000 for disproportionate mobile phone extraction and unlawful disclosure of victim data

The UK Information Commissioner’s Office fined Police Scotland £66,000 and issued a formal reprimand after finding the force extracted the entire contents of a crime victim’s mobile phone when only text messages were needed, then unlawfully disclosed the highly sensitive special-category data to a third party. The ICO found the bulk extraction was disproportionate under Part 3 of the Data Protection Act 2018 and that the force failed to report the breach within the mandatory 72-hour window. The force has since revised its mobile phone extraction processes and introduced additional oversight.

In this domain: Sussex Police switch on Acusensus AI cameras for seatbelt and phone offences · First US conviction under Take It Down Act for AI-generated CSAM · Agentic AI governance gap identified as core EU AI Act compliance challenge