Ronald Hudson - Fotolia

IPT fines Police Scotland for communications breach of privacy

The case comes as the UK government prepares to introduce the Investigatory Powers Bill, which will give sweeping powers for suspicion-less surveillance of telephone, web and email communications

The UK’s top intelligence court has ordered Police Scotland to pay £10,000 to a former officer after finding that the force unlawfully obtained his communications data, as well as that of other officers.

In the 8 August 2016 judgement, the Investigatory Powers Tribunal (IPT), which heard the case in Scotland on 22 July 2016, ruled that Police Scotland had interfered with the privacy rights of the complainants; two serving police officers and two former police officers and their partners.

The IPT found Police Scotland to be in contravention of the Human Rights Act 1998.

The case comes as the UK government prepares to introduce the Investigatory Powers Bill, which will give sweeping bulk data collection powers, and powers for suspicion-less surveillance of telephone, web and email communications.

One of the complainants, Gerard Gallacher, became a journalist after serving as a police officer. He later wrote about a police investigation, that lasted two and a half years, into the murder of Emma Caldwell, a 27-year-old prostitute, near Glasgow in April 2005.

Gallacher estimated that the investigation cost more than £4m, making it the most expensive murder inquiry in Scottish history.

His investigation, which began in 2013 and lasted 18 months, revealed that police officers had complained to their superiors about the force’s failure to pursue enquiries about a suspect in the case.

Gallacher’s “Forgotten Suspect” stories were published in April 2015 in the Scottish Sunday Mail, prompting the Scottish Crown Office to instruct Police Scotland to reopen the murder inquiry.

The stories also led to Police Scotland’s Counter Corruption Unit (CCU) launching a covert criminal investigation on 7 April 2015, to identify any police officers, serving or retired, who might have “made unauthorised disclosure of sensitive/restrictive information that appeared in the articles”.

Police misused surveillance to search for possible media leak

Police Scotland made applications for surveillance authorisations, claiming that Gallacher was researching a book about the unsolved murders of prostitutes in the Glasgow area, and that it was likely that he had been provided with information by police insiders.

The Interception of Communications Commissioner’s Office (Iocco) later wrote to the complainants, as required by law, to notify them that they might have been targeted for surveillance.

It told them that they “may have been adversely affected by a contravention of Regulation of Investigatory Powers Act (Ripa) and/or of the Acquisition of Data Communications Code of Practice”.

Police Scotland ignored new data code

In November 2015, Iocco ruled that Police Scotland contravened a code of practice which required judicial pre-approval to use communications data to identify a journalist’s source, or any related intermediaries between a journalist and a source, on five occasions.

Iocco’s investigation revealed that Police Scotland acquired nine subscriber data sets and 32 days’ worth of communications traffic data. Police Scotland took no further action after reviewing the data.

According to the IPT, Iocco had “found no evidence suggesting that there has been an intentional act by any employee of Police Scotland to avoid the requirements of Ripa or the code,” but that the failures could be described as “reckless”.

“It is evident from these applications that Police Scotland sought data to determine either a journalist’s source or the communications of those suspected to have been acting as intermediaries between a journalist and a suspected source,” Iocco wrote in a letter to Police Scotland.

Police Scotland admitted breaches

According to the IPT judgement, Police Scotland “very speedily conceded that it had acted unlawfully, and formally stated that it would not be defending the complainants’ applications”.

David Moran, a second complainant, and a serving police officer, alleged to the IPT that he was wrongly identified as a police source for a newspaper story on the Caldwell murder investigation. However, only Gallacher and his wife claimed compensation.

Gallacher was awarded £10,000 “to reflect the stress he has suffered and his loss of earning capacity”. His wife was not awarded compensation, although the tribunal recognised that her rights had been infringed.

Launch of independent inquiry

At the end of July 2016, the Chief Constable of Police Scotland asked the Chief Constable of Durham Constabulary, Mike Barton, to carry out an independent inquiry into the complaints against Police Scotland.

Police Scotland said in a statement that it was committed to act on the findings of both Iocco and the IPT judgement.

“Police Scotland notes the publication of the judgement by the Investigatory Powers Tribunal and will now consider and act on its findings,” it said.

“The Interception of Communications Commissioners Office found that Police Scotland breached guidelines around approval processes for communications data applications in 2015.

“Police Scotland has fully accepted that standards fell below those required in this case. It would be inappropriate to comment further at this stage given the investigation to be conducted by Chief Constable Barton.

“HMICS [Her Majesty’s Inspectorate of Constabulary in Scotland] has also conducted a review of counter corruption and work is ongoing to address the recommendations made following its inspection.”

Read more on Privacy and data protection