Police Scotland Fined £66K for Serious Data Breach Exposing Crime Reporter’s Phone Data On March 11, 2026, the UK’s Information Commissioner’s Office (ICO) fined Police Scotland £66,000 ($88,400) for a "serious" data breach in which an individual’s mobile phone data was improperly disclosed to a third party. The incident occurred after the victim reported a crime, raising concerns over the mishandling of sensitive personal information by law enforcement. The ICO determined that Police Scotland failed to adequately protect the complainant’s data, violating data protection laws. The fine underscores the regulator’s ongoing scrutiny of public sector organizations handling personal information, particularly in cases involving vulnerable individuals. Details of the breach, including the nature of the disclosed data and the identity of the third party, remain undisclosed. The case highlights the risks of unauthorized data sharing within policing and the legal consequences for non-compliance with data protection standards.

Police Scotland reported 10 data breaches to the ICO, exposing sensitive personal and biometric information of both members of the public and police staff. The compromised data included names, addresses, dates of birth, contact details, photographs, fingerprints, health records, and vehicle registrations. Several breaches also involved failures to comply with GDPR requirements, including fair, transparent, and secure data processing. The incidents were severe enough to warrant regulatory reporting, with 2024 marked as the worst year on record for the force, followed by two additional breaches in early 2025. The leaks risked identity theft, fraud, reputational damage, and financial penalties under GDPR, while also eroding public trust in the institution’s ability to safeguard highly sensitive data. Remedial measures were implemented, but the scale of exposure—particularly involving biometric and health data—highlights systemic vulnerabilities in handling high-risk personal information.

ICO Fines Police Scotland £66,000 for Mishandling Crime Victim’s Sensitive Data The UK’s Information Commissioner’s Office (ICO) has fined Police Scotland £66,000 following a series of data protection failures involving a crime victim’s mobile phone. The incident, which occurred during an internal misconduct investigation in 2021, saw officers extract and improperly share highly sensitive personal information from the victim’s device. During the investigation into an alleged offence involving two Police Scotland employees, officers sought text messages between the victim and the accused. Instead of retrieving only the relevant data, they performed a full download of the phone’s contents, including "special category data" such as health records, religious beliefs, and other protected personal details. The senior investigating officer justified the approach as a means to return the device quickly, but the ICO determined the decision was neither lawful nor proportionate. The breach worsened when the full dataset, including the victim’s sensitive information, was shared with Police Scotland’s Professional Standards Department (PSD) as part of the misconduct review. In a further error, the officer facing disciplinary action was mistakenly provided with the complete phone extraction, exposing the victim’s data unnecessarily. The victim filed a complaint with the ICO in September 2022, prompting a formal investigation in May 2023. The ICO found that Police Scotland violated the Data Protection Act 2018 by failing to ensure lawful data collection, adequately safeguard the information, and report the breach within the required 72-hour window. Information Commissioner John Edwards emphasized the harm caused by poor data protection practices, while the ICO’s head of investigations, Sally-Anne Poole, described the case as a "stark example" of the consequences of such failures. The £66,000 fine was adjusted to avoid disproportionate impact on public services. Police Scotland acknowledged the shortcomings, with Deputy Chief Constable Alan Speirs stating the force had implemented new measures including additional training, improved oversight, and revised processes to prevent future breaches. The incident highlights the risks of improper data handling, particularly when dealing with sensitive victim information.