Former police officer convicted for data protection breaches

A former Royal Gibraltar Police officer has been convicted at the Supreme Court for offences under the Data Protection Act 2004, receiving a £1,000 fine for unlawfully retaining and disclosing personal data.

The 38-year-old defendant, identified as A.B., was found guilty on two counts relating to sensitive police information he received in November 2022. A third charge of unlawfully retaining personal data was withdrawn by the Crown yesterday.

The case originated when A.B., who had previously served as a Police Constable with the Royal Gibraltar Police, received two photographs containing sensitive police information through a mobile messaging application. The images were sent by R.M., a serving Royal Gibraltar Police officer who unlawfully accessed police systems to photograph and share the confidential data.

Both men were charged in November 2024 and appeared before the Magistrates' Court. While R.M. pleaded guilty to two counts of unlawful obtaining of personal data and was fined, A.B. pleaded not guilty and elected trial by Supreme Court. The trial concluded this week with his conviction.

Commissioner Owain Richards emphasised the severity of the breach, stating: "Police officers and staff routinely have access to personal and sensitive information, and it is both a public expectation and a legal requirement that such information will be treated in the strictest confidence."

He warned that accessing confidential police information without legitimate purpose constitutes "an abuse of position," adding: "Trust and confidence in police officers and staff is essential, therefore, any member of staff who fails to uphold the high values and standards we expect in policing will be dealt with robustly."

The Commissioner said the convictions send "a clear message from the judiciary about the expectations it has about the accessing and handling of personal and sensitive data, particularly information held within police systems."