Follow up: Police Scotland admit to misuse of “victim” data – even when there was no victim

I’ve been working with investigative journalist Mark Howarth on a follow-up to the blog post I wrote about Police Scotland and Victim Support Scotland’s systematic misuse of my personal data. You may recall that I was classified as a crime victim by the police and then repeatedly contacted by the victim support charity – which is currently the subject of a government investigation into mismanagement – despite not ever having been the victim of crime.

Mark’s investigation exposed far more than either of us were expecting. Police Scotland confirmed that they have been passing data en masse to Victim Support Scotland regardless of whether or not that data involved criminal offences. As Mark’s ensuing piece which ran in today’s Daily Mail noted, this included personal information about the witnesses to actual criminal offences. Police Scotland have held their hands up and admitted they have been misusing personal data and will take immediate steps to change their procedures.

That alone would be incredible. But wait, there’s more!

Scan of the article in the Scottish Daily Mail, 5 October 2015
Obligatory scowl-for-the-tabloids face

At the heart of Mark’s investigation was the issue of consent. Police officers, according to Police Scotland, are supposed to ask the person’s consent to have their details passed on for victim support. At no point was I ever asked for my consent. Why is that? Because no serving police officer would have stood in front of the bashed up close window in question and said “Do you need victim support”? with a straight face. It was, and only ever was, everyday stupid community vandalism, which I only have to report to the police on the non-emergency number to jump through the adversarial and aggressive hoops that East Renfrewshire Council requires. Not a life-changing criminal offence by any means.

That is where Mark’s investigation began to leave us both gobsmacked. Victim Support Scotland initially stonewalled, and then cited their statutory right to not only contact anyone whose data the Police gave them, regardless of the lack of consent, but to reclassify non-victims of crime as victims for their purposes.

I’ve heard of a smoking gun, but this is the first time I’ve ever seen a smoking cannon.

So he got onto ICO, and laid the situation out to the Deputy Information Commissioner. And the Deputy Information Commissioner agreed with Victim Support Scotland and said that consent is not necessary. After all, it’s the public sector dealing with critical information about victims of crime, right? He then put it all in writing in a document which, both Mark and I agreed, not only made no sense but was not about the actual data protection violation. Incredibly, while we were getting to grips with that, the European Court of Justice struck down automated data sharing between public bodies (.pdf, 108kb). So we had Police Scotland holding their hands up and saying “we were wrong”, the ECJ saying “nope, you can’t do that anymore,” and ICO saying it’s not a problem.

Let me be clear here: this is not about the frontline police officers who do an amazing job in my troubled community, or volunteers who just want to help. This is about administrators in back offices who have now been caught red-handed fudging both crime and victim figures to suit their own ends. Police Scotland are under fire for enough issues that could fill a book, and Victim Support Scotland is looking suspiciously like Scotland’s equivalent of Kids Company. Both organisations are desperate to prove they are doing something. That mutual desperation converged in my close.

As you can see in Mark’s article above, both parties are still sticking to their insistence that this is all about helping victims of crime. I have said “I am not, and never was, the victim of crime” until I went blue in the face. It’s as if that does not even matter. If they decide you were the victim of crime, if they want you to be a victim of crime, if it serves their purposes for you to be a victim of crime, then neither your consent nor your opinion nor the facts of the case matter.

And there we have it.

I’d like to thank Mark, who was thoroughly professional and communicative throughout, Pol Clementsmith of Open Rights Group Scotland for helping us double-check the legals, Steve the photographer, and the WordPress Freshly Pressed team for sending my original post viral.

And to think all of this started because of some bawbag kicking in a one meter tall, 1.5 meter wide pane pane of perspex plastic at my close entrance in the middle of the night.

About the author
Heather Burns is a digital law specialist in Glasgow, Scotland. She researches, writes, publishes, consults, and speaks extensively on internet laws and policies which affect the crafts of web design and development. She has been designing and developing web sites since 1997 and has been a professional web site designer since 2007. She holds a postgraduate certification in internet law and policy from the University of Strathclyde. Learn about hiring Heather to write, speak, or consult.

2 thoughts on “Follow up: Police Scotland admit to misuse of “victim” data – even when there was no victim

  1. One suspects there is a financial incentive to classify you as a victim of crime. By putting that label on you – they are processing the data for their own purposes, based on their own ‘algorithm’. They also continued to label you as a victim after you told them to stop. This is almost certainly unfair processing – which the ICO can treat as a separate issue from the passing of data over without consent.

  2. As I said in the original post, after the initial contact I told them I was not a victim of crime and did not want to be contacted. Both parties ignored that the second time.

    Also, you have to remember this is Glasgow; so every time I said “I am not a victim of crime!” the charity’s response was “Of course you’re not, hen.” (In other words they think I’m keeping my mouth shut.)

Comments are closed.