Police Scotland Fined £66,000 After Detective's Intimate Images Leaked in Rape Case
Police Scotland has been fined £66,000 and severely reprimanded by the Information Commissioner's Office following a catastrophic data breach that saw intimate images and personal information of a detective who reported being raped by a colleague leaked to the alleged perpetrator during the investigation.
Detective's Personal Data Shared With Alleged Rapist
Detective Constable Lianne Gilbert, 34, has been left feeling "tortured" after all data from her mobile phone was shared with a third party during an investigation into rape allegations she made in 2020. The "serious data breach" in 2022 saw her intimate images, medical records, emails, messages, contacts, and case documents provided to the male colleague she had accused of rape as part of a "misconduct pack" within the investigation.
Speaking publicly and waiving her right to anonymity, Gilbert explained she joined the police force in 2014 and worked as a Detective Constable until the data breach forced her onto extended sick leave. "I have had health issues including PTSD which arose from the data breach, and other failings of the Police, as well as the systematic and misogynistic abuse I suffered at the hands of my employer," she said.
Systemic Failures in Handling Sensitive Information
The Information Commissioner's Office investigation revealed "serious failures in the handling of sensitive personal information" by Police Scotland. The ICO found that extraction of the entire contents of Gilbert's mobile phone was excessive and unfair, and that inadequate policies and procedures contributed to the unlawful disclosure of sensitive personal information to a third party.
Sally-Anne Poole, ICO Head of Investigations, stated in the report: "People should be able to trust that organisations will treat their personal information with care, fairness and respect. When organisations fail to do so, they can expect enforcement action from us."
Years-Long Ordeal and Ongoing Trauma
Gilbert's ordeal began in Autumn 2020 when she reported multiple abuse offences, including sexual abuse and rape by a male colleague. Following her allegations, a criminal inquiry was opened and the alleged perpetrator was suspended. However, Gilbert says she remains in the dark about the sexual abuse case, which she believes is still being investigated six years later.
The data breach occurred on July 14, 2022, when a full download of Gilbert's mobile phone was copied onto CD-type discs. Three copies were created, with two given to her abuser's solicitor and Scottish Police Federation representative. "The data protection legislation stipulates that I should have been notified about a breach without undue delay – but it was over a week later I was notified," Gilbert explained.
Police Response and Accountability Issues
When Gilbert attempted to report the breach through proper channels, she encountered further obstacles. After calling the police non-emergency 101 number, the call handler asked her to repeat her statement that "Police Scotland have provided intimate images of me to a male who raped me," then repeatedly claimed this would never have happened.
Police Scotland initially sent Gilbert a letter calling it a "non-reportable data breach" but agreed to meet for "accountability and transparency." At the July 21, 2022 meeting, she was told the breach had been reported to the ICO. However, a follow-up letter from Police Scotland stated: "I consider that this concludes the matter insofar that my role requires and allows, and do not intend further corresponding further."
ICO Investigation and Delayed Justice
Gilbert contacted the ICO directly to report the data breach, but the investigation took over two years to complete. "In November I got a call from somebody at the ICO, very apologetic, saying that the request had been sitting in the pile, and they knew nothing about the case," she recalled.
The ICO finally opened the investigation in November 2023, with Gilbert noting: "It took some time, I was led to believe this was due to how serious this was and the sensitive nature."
Impact on Personal Life and Trust
Gilbert expressed satisfaction with the ICO's outcome but highlighted the ongoing trauma: "I am satisfied with the outcome. It has been dealt with appropriately by the ICO. The fact that Police Scotland have been fined shows the severity of the breach."
However, she revealed that Police Scotland has yet to let her see the discs containing her data. "They told me he was provided with intimate images of me. I still don't know what these images are four years on, which has been torturous."
The psychological impact has been severe: "I have been diagnosed with PTSD. It impacts my everyday life. My body has been under stress and trauma for years, it has meant I couldn't sleep at night and I have been left with significant health issues."
Gilbert's trust in data protection has been so damaged that she now avoids documenting memories, even with her daughter. "We were in Edinburgh the other weekend, I just wanted to take a selfie. I can't do that now. I only have a handful of photographs of me and my daughter together."
Police Scotland's Response and Organizational Changes
In response to the data breach, a Police Scotland spokesperson stated: "This data breach occurred as a result of human error in the preparation of a pack relating to an internal investigation."
Deputy Chief Constable Alan Speirs added: "Police Scotland has received the Information Commissioner's Office reprimand and penalty notice, and reflected on its findings. We acknowledge the organisation did not meet expectations and regulations relating to data handling in regards to this matter."
Speirs continued: "Police Scotland has taken organisational learning from this incident. Substantive steps have already been made to strengthen our processes for handling personal data, improving training and support for staff, as well as increasing oversight to reduce the risk of something similar happening in the future."
Regarding the sexual assault and rape case, Police Scotland said: "A report outlining enquiries already undertaken and seeking further instruction has been submitted to the Crown Office and Procurator Fiscal Service."
The ICO spokesperson emphasized their commitment to handling sensitive cases appropriately: "We know the impact data breaches can have and we always strive to treat complainants with sensitivity and care, particularly when their complaint involves sensitive personal information."
