A UK regulator has reprimanded Surrey and Sussex police for unlawfully recording more than 200,000 phone conversations and capturing personal data without the knowledge of the callers.
The Information Commissioner’s Office, which is the independent regulatory body for data protection, said on Tuesday that it had become aware in 2020 that 1,015 staff at both police forces had downloaded a mobile phone app that recorded incoming and outgoing calls.
The software was originally intended for use only by a small number of specialist police personnel but had been made widely available.
The revelations come as public confidence in the police in England has plunged following a spate of scandals involving racism, sexism and bullying, and the conviction of one officer in London’s Metropolitan Police for murder and another on multiple charges of rape.
“Sussex Police and Surrey Police failed to use people’s personal data lawfully by recording hundreds of thousands of phone calls without their knowledge,” said Stephen Bonner, ICO deputy commissioner.
“People have the right to expect that when they speak to a police officer, the information they disclose is handled responsibly,” he added. “We can only estimate the huge amount of personal data collected during these conversations, including highly sensitive information relating to suspected crimes.”
Police officers who downloaded the app were unaware that all calls would be recorded, and members of the public were not informed that their conversations were being recorded, the ICO said. The software has since been withdrawn and all related evidential material destroyed.
Instead of hitting each force with a £1mn fine, the regulator chose to issue a formal reprimand in line with a new approach that aims to reduce the impact of fines on public services.
“The reprimand reflects the use of the ICO’s wider powers towards the public sector as large fines could lead to reduced budgets for the provision of vital services,” Bonner said.
The ICO said that Surrey and Sussex police must ensure that data protection rights are respected before deploying new apps, and that staff should be given guidance on the issue. It has given both forces three months to provide evidence they are complying with data protection law.
The two forces acknowledged that “evidence of an offence that is or was under investigation” was found on a small number of the recordings, and in three instances these related to criminal cases.
Sussex Police said the majority of the ICO’s recommendations had already been implemented.
“A new governance process was put in place, ensuring that all new apps are compliant with current legislation before being made available. All staff are provided with instructions and data protection guidance in respect of the use of any apps via a message which appears on the front screen of all devices,” it said.
Fiona Macpherson, assistant chief constable of Surrey Police, said: “This case exposed a lack of governance around use of this digital application, and this is regrettable. As soon as the error was reported, we took urgent action to ensure that this did not happen again.”
