Privacy and data protection

A single phone can hold years of messages, photos, locations and health data, much of it about people who have nothing to do with the case. Examiners often handle more personal information than anyone else in an investigation, and how they treat it matters legally and ethically. This lesson covers what counts as personal and sensitive data, the data protection principles that apply across legal systems, how legally privileged material is handled, and practical techniques that reduce intrusion without weakening the evidence. How evidence is stored and retained day to day is covered in Module 5.

Personal data on every device

Personal data is any information that relates to an identified or identifiable person: a name, a phone number, an IP address, a photo, a location history, a device identifier linked to its user. In digital forensics, almost everything is personal data.

• Sensitive or special categories of data receive stronger protection in most regimes. They typically include health, sex life or sexual orientation, racial or ethnic origin, religious or political beliefs, trade union membership, and genetic and biometric data. Financial data and data about children also call for extra care.
• Third-party data is information about people other than the subject of the examination: the other side of every chat, contacts, people in photos, colleagues in shared folders. They have agreed to nothing and are usually suspected of nothing.
• Mixed data is the normal case. A mailbox that holds the relevant messages also holds medical appointments, family matters and private conversations.

The goal is not to avoid personal data, which is impossible, but to process only what the case needs and to protect it while it is held.

Principles that hold everywhere

Data protection laws differ in detail, but they share a core set of principles. Each one translates into a concrete practice for the examiner.

Minimization has a limit that examiners must respect: collecting too little can make evidence insufficient (Module 1) or leave exculpatory material behind. The aim is the right data, not the smallest possible amount.

From all data to relevant data

In practice, privacy is protected by narrowing, step by step, what a person actually reads.

The forensic image may still contain everything, because a complete, verified copy is often needed for integrity and to test other explanations. Minimization then applies above all to what is extracted, reviewed and disclosed.

Techniques that reduce intrusion

• Targeted collection: when a full image is not required, acquire only the relevant accounts, folders or periods, for example an export of one mailbox from a server instead of an image of every disk (Module 4).
• Date and keyword filtering: limit review to the time window and the agreed search terms, and record the exact terms used and the number of hits.
• Data type filtering: review only the categories in scope, such as email and documents, and leave photos or health apps untouched.
• Redaction: mask irrelevant personal data, such as third parties' names or phone numbers, in exhibits and reports, while keeping an unredacted version under control.
• Need-to-know access: only the people working on the case can open the evidence, and access is logged.
• Encryption of evidence copies: images and exports are stored and transported encrypted, with keys kept separately from the media.
• Secure deletion: at the end of the retention period, copies are destroyed with a method suited to the media. NIST SP 800-88, Guidelines for Media Sanitization, describes three levels: clear, purge and destroy. On solid-state drives a simple overwrite is not reliable, so built-in sanitize commands, cryptographic erasure or physical destruction are preferred.

Privileged material

Some communications are protected by legal professional privilege, called attorney-client privilege in some countries: confidential communications between a person and their lawyer for the purpose of legal advice and, in many systems, material prepared for litigation. A device may hold such material next to the evidence. Reading it can breach the person's rights and, in some systems, disqualify the investigators who saw it. The general practice is to filter it out and review it separately:

1. Identify likely privileged items early, using lawyers' names, email addresses, law firm domains and phrases such as "legal advice".
2. Set those items aside before the investigation team sees them.
3. Have them reviewed by a separate person or team, often a lawyer independent of the investigation, sometimes called a filter team.
4. Release to investigators only what the reviewer clears, and document every decision.

The examiner's role is technical: run the agreed filters, keep the separated material secure and record what was done. Whether a document is privileged is a legal judgment, not a forensic one.

Examples of data protection regimes

Many jurisdictions have general data protection laws built on these principles: the European Union's General Data Protection Regulation (GDPR) is one example, and Brazil's Lei Geral de Proteção de Dados (LGPD) is another. Such laws often place criminal investigations by public authorities under separate rules, but necessity, proportionality and minimization apply in some form almost everywhere.

A worked example

A fictional retailer, Calder Home, investigates whether a store manager, Ana, deleted sales records over three months to hide cash shortages. Her company laptop and company phone are in scope.

• The examiner images the laptop in full to preserve its integrity, but limits review to the sales export folders, email and system logs for the three-month window.
• On the phone, only the work email and the company's sales app are reviewed. Personal photos, a health app and a family chat group are not opened.
• A keyword hit reveals messages between Ana and an employment lawyer. They are set aside unread for separate review.
• Customer names in the sales records are redacted in the exhibits, because they are not needed to show the deletions.
• The image is stored encrypted, access is limited to two named examiners, and the case file records when the copies are due for review and secure deletion.

None of these steps weakens the evidence. Each one makes the examination easier to defend, because every intrusion has a reason that can be explained.

Exam focus: Know what personal data, sensitive or special category data and third-party data are, and why almost all device data is personal. Match each principle (necessity, proportionality, data minimization, purpose limitation, storage limitation, security, confidentiality) to a practice, and remember that minimization must not make evidence insufficient. Expect scenario questions on date and keyword filtering, redaction, need-to-know access, encryption of copies and secure deletion at the end of retention, and on handling legally privileged material through separate review rather than by the examiner reading it.