Foreword

There can be few other areas of our lives where our wider human rights and our information rights come together so vitally than in the area of criminal justice.

When concerns arose about the potential for excessive processing of personal data extracted from mobile phones, in a process known as mobile phone extraction, I resolved to inquire into and understand the privacy and data protection risks. Many of our laws were enacted before the phone technology that we use today was even thought about. The existing laws that apply in this area are a combination of common law, statute law and statutory codes of practice. I found that the picture is complex and cannot be viewed solely through the lens of data protection. As this report makes clear, a whole-of-system approach is needed to improve privacy protection whilst achieving legitimate criminal justice objectives.

Our smart phones are powerful repositories of highly sensitive personal information, including our intimate conversations, family photographs, location history, browsing history, biometric, medical, and financial data. They reveal patterns of our daily personal and professional lives and enable penetrative insights into our actions, behaviour, beliefs, and state of mind. It is no exaggeration to say that the personal data found in our mobile phones richly depict our lives.

Those working in the criminal justice system recognise, as I do, the value of mobile phone data for achieving appropriate criminal justice outcomes, as well as the challenges that the high volumes of data can bring, given the proliferation of digital information being created and stored through the widespread use of mobile phones.

This report explains how current mobile phone extraction practices and rules risk negatively affecting public confidence in our criminal justice system. Of particular concern is my finding that police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.

In reaching this conclusion, my report examines the relevant data protection rules in some detail. It explains the significant requirements that an organisation must meet to rely on the legal basis of consent for data extraction. The report also describes an alternative condition for processing: where it is necessary for the performance of a task carried out for a law enforcement purpose by a competent authority.

Central to either approach is communication and meaningful engagement with complainants and witnesses. People expect to understand how their personal data is being used, regardless of the legal basis for processing. My concern is that an approach that does not seek this engagement risks dissuading citizens from reporting crime, and victims may be deterred from assisting police.

I am therefore calling on government to introduce modern rules, through a code of practice that improves data extraction practices. This will build public confidence, notably the confidence of victims of crime and witnesses in permitting extraction of their sensitive personal data. It will also better support police and prosecutors in their vital work. I propose the creation of a national consortium of relevant public agencies and organisations to work collaboratively to help construct such a code.

In conducting this investigation, I listened intently to a range of views from within the criminal justice sector and across civil society and victims’ groups. I am grateful for the time stakeholders have taken to assist this investigation and for the valuable insights provided.

I am encouraged by the consensus across all stakeholders that more needs to be done to govern mobile phone extraction practices while increasing public confidence. This report offers a detailed technical analysis of data protection law, but the implications for individuals’ privacy are abundantly clear, as is the need for significant reform and improvements in practice.

While the work needed to implement my recommendations must not fall by the wayside, I am acutely aware that this report is issued at a time of unprecedented challenges flowing from the COVID-19 pandemic. I therefore acknowledge that the timeline for change will be longer than usual, but I am keen that we begin to make progress as soon as practicable, and I am committed to supporting that work at all stages.

 

Elizabeth Denham CBE

Information Commissioner