![](https://emergencyservicestimes.com/wp-content/uploads/2025/05/ESS-Button-resized.png")
Police Scotland has invested heavily in creating a ethical framework to govern the way it uses data in its work and this is now shaping the way it considers and implements technology across the force. I spoke to Corinne Russell, Data Ethics Lead for Police Scotland for a recent episode of the For Every Response podcast to find out how the force has moved an abstract concept into the mainstream of its business.
Corinne started work as a criminal intelligence analyst, mainly in the major investigations teams and says she learned a lot about the value of data in policing and how it contributes to operational decision making.
“I love working in data ethics. I find it so interesting and rewarding.”
That grounding, combined with later experience in cyber and information security, put her in the right place when Police Scotland created a dedicated data ethics function in 2020.
I ask her to explain what data ethics means. I suggest it might be something that means different things to different people. At its core, she responds, “data ethics is about our ethical and moral obligations around our use of data.” In Police Scotland, this is tightly connected to technology. Her team’s role is “to assess any new data-driven technology that Police Scotland wants to use,” using a framework and triage process that has been running since 2021 and is now, in her words, “quite a mature state.”
Data ethics framework
A key facet of that framework is structured risk assessment. Every new data-driven tool is put through an 11-question triage to identify low, medium, or high ethical risk. Those questions probe the nature of the data being used, the potential impacts on different groups, and the wider consequences of deploying a system in real-world policing. The aim is not simply to say yes or no, but to understand where risks lie and how they can be mitigated so that technology can be used responsibly.
She shares an example of how this process is working by talking about the introduction of object recognition technology from software provider Briefcam. She explains: “It uses algorithms to identify objects within a frame, and the purpose around it is really just to cut down that manual review of hours and hours of CCTV footage. You can put in filters if you know what that person was last seen wearing. For example, if they were wearing a blue jacket and carrying a bag, Briefcam will then provide you with results of anyone matching that description. This means our officers can then review and verify this; it helps us to cut down that the time-consuming process.”
With any new data-driven tool, like the example from Briefcam, Corinne says she and her team will take it through their data ethics triage process which comprises 11 questions to determine if the algorithm represents a high, medium, or low risk in terms of data ethics.
When higher risks are identified, a distinctive feature of Police Scotland’s approach comes into play: a rights-based pathway for further scrutiny. This can involve public engagement, stakeholder engagement and internal oversight, ensuring that decisions are not taken in isolation. Corinne describes how they have used public surveys and internal scrutiny groups to bring in “that wider perspective on something, and how we can use new technology responsibly.” Her role, and that of her team, is to provide senior decision makers with informed advice rather than to act as a barrier.
Fairness and bias sit at the heart of these discussions. The triage explicitly asks “whether there’s the potential that certain groups of people might be affected more than others,” a question that has become especially pressing in the context of artificial intelligence and live facial recognition. Police Scotland has not introduced live facial recognition technology yet but has been consulting the public about it and is watching the deployment across England and Wales with interest.
For Police Scotland data ethics is not treated as a one-off box-ticking exercise at the start of a project. The framework includes post-implementation review “to assess whether there’s been any unintended consequences of the use of a tool following actual use of it in a live environment,” recognising that risks and impacts can evolve over time. For Corinne, that ongoing scrutiny is part of what it means to act fairly and responsibly.
Data ethics and AI
This mindset becomes even more important with AI. She says Police Scotland is still quite early in its journey to introduce AI but the data ethics framework has been designed with AI in mind. The force is now looking at wider AI governance to ensure overall accountability and ownership throughout the entire lifecycle of using any tool. She cautions that even a well-assessed AI system could just become less effective over time and there is a need for regular review and monitoring to reduce the risk of complacency.
Perhaps the most important reason data ethics matters is cultural. In Police Scotland has a strategic ambition “to become an organisation driven by effective and efficient use of data in an ethical way,” says Corinne. She reflects on the reason why the force originally set up a data ethics function after the controversial adoption of cyber-kiosk devices without sufficient transparency. The cyber-kiosks where digital forensics analysis devices that could triage a mobile phone to find data that could have ‘evidential value.’
“I think that the main issue around the introduction of cyber-kiosks wasn’t about the technology itself, it was because we hadn’t carried out adequate governance before we introduced them. We didn’t have data ethics back then and we hadn’t done the level of engagement that we definitely would do now. So, I think that was the main part of the controversy about the cyber-kiosk technology, and that’s how we kind of overcame it by establishing the really robust process that we have now.”
As a result of this experience, the force now has an independent advisory group on emerging technologies in policing as part of today’s more rigorous processes. “We learned from our mistakes,” Corinne reflects, and the result is a shift away from a purely risk-averse stance towards responsible innovation.
Today, she believes data ethics “has become absolutely intrinsic to any conversations that we have about innovation.” For Corinne, the future lies in treating data ethics and AI risk as long-term organisational responsibility rather than just a one-off assessment at the start. It is fundamental to building trust and confidence with the public.
To hear more conversations like this one, be sure to come to The Emergency Tech Show at the NEC in Birmingham on 16 and 17 September. Register to attend here.
