The UK data watchdog (ICO) has demanded an assurance that £700,000 mobile phone hacking devices will not be issued to police officers until their legality has been established.
The Information Commissioner’s Office (ICO) said that Police Scotland had yet to provide an articulate legal basis for its “
Police Scotland spent £370,684 on 41 devices in April but they were immediately shelved after a public outcry. Police asked the Crown Office for guidance in October and paid £316,678 to Cellebrite, the Israeli manufacturer, in December to license the devices for a further four years even though it was unclear whether they could be used.
The Crown advice, issued last month, failed to break the impasse, as it said police appeared to be under the misapprehension that counsel could offer broad guidance on police powers. Police Scotland interpreted this as a confirmation that the law allowed officers to use the cyberkiosks, angering human rights and privacy groups.
The ICO has written to Holyrood’s justice committee stating that the Crown advice was informative but not definitive. David Freeland, senior policy officer at ICO, urged the police to confirm that the devices will not be introduced until they have been approved and have the confidence of the public. He said: “Police Scotland must now definitively establish and clearly articulate to the public at large what their lawful basis is for the processing of evidence comprising personal data stored on digital devices.”
Human rights and privacy groups have called for a code of conduct and new legislation to prevent police looking at private material, such as intimate photos, or fishing for evidence that has nothing to do with an inquiry.
The Scottish Human Rights Commission said Police Scotland had based its case on laws that do not contain adequate safeguards. It said: “The commission recommended the Scottish parliament and government to consider a broader analysis of this area of law, digital forensics, and if appropriate to enact new legislation. There is a need for statutory guidance and/or a code of conduct for digital forensics.”
Privacy International said it was not satisfied there was a clear legal basis to support the use of the cyberkiosks.
It added: “We join the calls for the police to make this legal advice public and set out the lawful basis in clear straightforward terms.”
Detective Chief Superintendent Gerry McLean said: “We have confidence in the current legal basis for the use of cyberkiosks but will take time to consider the various submissions, along with the advice provided by Crown Office and Procurator Fiscal Service.”