Response on the APP extraction of digital data guidance
'Authorised Professional Practice: The extraction of digital data from personal devices' consultation response.
As Victims’ Commissioner for England and wales, although I appreciate this guidance relates to both victims, witnesses and suspects I will limit my comments in this response to reflect the needs of victims.
In recent years, the issue of digital disclosure, particularly in rape cases, has rightly been given a great deal of attention and scrutiny. There can be no question that ‘on the ground’ it has become practically routine for complainants’ of rape to be asked to hand over digital devices and for most or all of the material held therein to be trawled. Through my recent survey of rape complainants and through my network of stakeholders, I hear that the CPS will frequently seek this level of material and refusal to submit will result in the case not proceeding to charge. This is highly troubling for victims and ultimately will have a chilling effect on reports as well as having a direct impact on victim attrition.
I echo concerns of many senior police chiefs that there has been a fall in public and victim confidence in police in particular in relation to rape cases and the issue of digital data extraction plays a big role in this.
The Northumbria sexual violence complainant’s advocacy scheme pilot (SVCAS), which engaged local solicitors to provide legal advice and support to rape complainants in Northumbria primarily related to complainants’ Article 8 rights to privacy, demonstrated what is happening in practice, at least in that region, about 50% of requests were not strictly necessary and proportionate. These were challenged by the advocates through the scheme. As discussed in more detail below, the scheme proved to be useful for all the participants including the Police and CPS and I would urge the College to back it publicly.
Police, complainants and support workers who participated in the scheme expressed concerns about the current situation:
“I think a lot of things are asked for when we, the police in general in the past, not so much now, they just kind of hand it over without questioning it and I don’t think that’s, that’s sometimes the best way. ‘Cos there doesn’t really seem to be any, there’s not any of that for the suspect, let’s just say. So I think, you know, we need to have some sort of, some form of protection for the complainant as well.” (Police Officer 11)
“I could talk all day about third-party material, and it is the real bone of contention. It’s one of the things that has given me sleepless nights over the years, you know. It has… And I had a rape team investigator say to me on one occasion, or a former rape team investigator, say to me, ‘I had to like leave the rape team because of what I was being asked to do, in relation to victims, I couldn’t do it’. And I think, you know, that, for me just spoke volumes. And lots of people were expressing their concerns, including me, but when that officer said that to me, I kind of thought, d’you know what, there’s something sadly wrong here.” (Police Manager 1)
“I have had conversations with people in that sort of they are, they don’t want to give up their phone and that sort of thing. And I know that that’s been a bit of a barrier [to reporting].” (Support Worker 1)
“I would have to hand my phone over to the police. I had minimal contact with my abuser – maybe 2 texts – but I was promiscuous with others and knew that I would probably be questioned about that and judged for it.” (did not report)
“The first responders were good, however after that the whole process really stressed me out (having my medical records accessed and phone gone through), this had a negative impact on my mental health and felt like a massive intrusion… The impact on my mental health and being signed off work – I almost lost my job… The criminal justice process caused me more harm than good.” (reported 2019, withdrew)
The new guidance is an opportunity to re-balance this situation by ensuring victims’ Article 8 rights are considered and upheld. This will go a long way to minimising the re-traumatisation many experience in the system and restoring confidence in the police.
This new guidance has been drafted in part in response to the ICO report on digital disclosure and does, make attempts to address some of the concerns raised in that report. However, I remain concerned there are/have been various pieces of work in this area again triggered by that report and that without a more joined up approach, those on the ground may be at best confused or at worst operating in a contradictory manner. This is of particular concern as it applies to cross-agency working, with the recently consulted upon CPS RASSO guidance, the Attorney General’s guidance and this guidance not always well aligned. This should be addressed with urgency.
I understand the issue of ‘consent’ in data protection law as raised by the ICO report, and whilst we are less concerned about how it is named it is vital that a complainant’s digital devices and the ‘specific’ sought material within are only accessed when that complainant has given free informed agreement. Where that complainant does not have capacity to agree and thus someone else is asked to agree on their behalf (a parent/ carer etc.) their views are sought and recorded. The NPCC has requested a statutory power which deals with the issues arising from the ICO report with the common law gateway of consent and I anticipate this guidance will form a stop-gap because once that is in place the guidance will need to be re-written.
I am concerned to see mention of warrants being used in the guidance and would argue that such a coercive power should never be used on a victim/ complainant. In fact, the NPCC has been clear that the power in section 19 of PACE should never be used with victims precisely because it is coercive. As mentioned above, the new statutory power should help overcome some of the confusion and provide a clear power upon which the guidance can build.
I believe the steps outlined below would be in accordance with case law and will satisfy the ICO report. They also reflect a draft statutory provision currently being considered for inclusion in the Protection of the Police and Public, Courts and Sentencing Bill:
- 1. A police officer can if certain conditions are met extract information stored on an electronic device if the user has voluntarily provided the device and agreed to specified information being extracted from it.
- 2. The conditions are as follows:
- i) The above (1) can only be exercised for preventing, detecting, investigating or prosecuting an offence, locating a missing person or protection of a child or ‘at risk’ adult from harm.
- ii) The above (1) can only be exercised if the police officer believes that the information stored is relevant (relevant to a reasonable line of enquiry) to one of the above purposes (i) and it is strictly necessary and proportionate to achieve that purpose.
- iii) Where there is a risk that ‘other’ information i.e. not that information necessary for one of the purposes above (i) the police officer must in order to demonstrate what they are doing is strictly necessary and proportionate and be satisfied that there are no other less intrusive means available.
When I say “consent” or “agreement” in relation to the extraction of information from a user’s device I mean a freely given, specific, informed and unambiguous indication of the individual’s wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the extraction of information from the device which has been specifically identified in the request made to them by an authorised person. Agreement remains freely given in this context if the user is properly advised as to the potential implications of any refusal for a criminal investigation or prosecution if it has implications for compliance with an individual’s right to a fair trial.
This is broadly what is set out in your introductory paragraphs to the document:
“The powers to acquire a device are different to those that apply to device. Acquisition of the device would be under common law consent. In most investigative circumstances, officers or staff will be intending to take the device for the purposes of extracting data. Investigators should be considering and explaining the power to acquire the device and the power to acquire the data at the same time, therefore officers and staff should apply both the common law consent to the physical device and DPA 2018 requirements for the data.
Consequently officers and staff will:
- seek consent for the acquisition of the device, and
- believe acquisition of the data to be strictly necessary to satisfy a reasonable line of enquiry, and
- consider all other less intrusive means and decide that they are not able to provide the evidence in a way that will support the investigation of a reasonable line of enquiry, and
- seek informed, freely given permission to acquire the data
However, I have concerns that the process is not clear, the different powers and legal basis are confused, and the guidance is at times too contradictory and so it is entirely possible officers will stray from this stepped approach and this may lead to regional variation and some bad practice.
I am also concerned this guidance alone will not change the culture which currently sees routine disproportionate downloads. So, whilst it is good to see the ‘safety net’ of an inspector authorising a download, this is unlikely to bring about the needed culture change. Instead, good practice guidance should ensure that a paper record of the thought process of the officer seeking the data is recorded, so that at each stage of the above conditions the reasoning is recorded and can be scrutinised at a later point.
Finally, I have been unable to view the PSED assessment for this consultation but submit this guidance is likely to disproportionately impact certain groups with protected characteristics under the Equality Act. I would like to see discussion of this in the guidance and mitigating actions.