Sanction RGPD Information Commissioner (ICO) — Chief Constable of the Police Service of Scotland : 76 k€ (2025)
- Autorité de contrôle
- Information Commissioner (ICO)
- Pays
- Royaume-Uni
- Entreprise / secteur
- Chief Constable of the Police Service of Scotland
- Montant de l'amende
- 76 k€
- Date de la décision
- 12 décembre 2025
- Fondement juridique
- Art. 5 (1) c), f), Art. 25 (1), (2), Art. 32 (1), Art. 33
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The UK DPA has imposed a fine of £66,000 (EUR 75,700) on the Chief Constable of the Police Service of Scotland. The processor executed a mass download from the mobile telephone of a private individual during the course of a police investigation, thereby contravening regional data protection legislation. After the investigation concluded, the data was forwarded to another investigative entity for a misconduct investigation into a third party, who was provided with the entire download from the data subject's phone. The controller failed to implement adequate technical and organisational measures to prevent the disclosure of personal data to unauthorised third parties. Additionally, the controller failed to comply with the principles of data minimisation. Furthermore, the controller failed to inform the DPA of the data breach.