Your data after a phone examination in Scotland

Police Scotland’s own cyber kiosks page states that “all information is securely deleted from the cyber kiosk at the end of each examination.” That statement is about the kiosk itself, covered on the previous page. The quoted sentence does not mention a fuller extraction sent on to a digital forensics lab.

Part 3 of the Data Protection Act 2018 sets data protection principles for the processing of personal data for any of the law enforcement purposes. Under the Act, that processing “must be lawful and fair”; personal data processed for any of the law enforcement purposes must be “adequate, relevant and not excessive in relation to the purpose for which it is processed”; and it must be “kept for no longer than is necessary for the purpose for which it is processed.”

The Code of Practice on extraction of information from electronic devices, issued under the Police, Crime, Sentencing and Courts Act 2022, says in paragraph 138: “Information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.”

The same Code (paragraph 4) says it “only applies as regards the powers in Chapter 3 of Part 2 of the Act” and that “If another power is being used as the basis for extracting information from an electronic device, the guidance/code for that power will apply.” Section 37(1) of the 2022 Act is a power to extract information from a device a user has voluntarily provided and agreed to the extraction from. This site has not sourced a deletion rule specific to a phone seized under Scottish seizure powers.

The Data Protection Act’s fifth principle, s.39(1), states a necessity test — data “kept for no longer than is necessary for the purpose for which it is processed” — and no period of days. Para 138 of the Code, as quoted above, does not say who decides that information is “deemed not relevant” or how that is checked. The quoted sentence from Police Scotland’s cyber kiosks page is about the kiosk itself and does not mention material sent on for a fuller extraction.

For the equivalent position in England and Wales — including how the same PCSC Code and Data Protection Act provisions apply there — see retention and deletion.