Police Scotland is under investigation by the UK’s data protection watchdog after revelations in the Sunday Herald about the force accessing data on the phones of innocent people.

Using newly acquired technology, the force can also trawl the phones of suspects for data without warrant.

The probe was launched after privacy campaigners complained to the Information Commissioner that officers’ use of 'cyber kiosks' – which can view everything on a mobile phone when connected to the device – breaches the Data Protection Act.

The legislation covers the whole of the UK and is enforced by the Information Commissioner. It requires organisations to ensure they comply with eight enforceable principles, including stipulations that data retained is “relevant and not excessive”.

The Sunday Herald revealed last month that trials of the new technology by officers in Stirling and Edinburgh saw 375 phones and 262 sim cards accessed. This newspaper also revealed last month that after the trial police spent £370,000 on 41 cyber kiosks which will be distributed throughout Scotland.

Millie Wood, a lawyer with Privacy International, made the complaint to the Information Commissioner on Friday. She also called for a public consultation on the use of cyber kiosks in a letter to justice minister Michael Matheson.

Wood said: “Scottish police must clarify what is taking place and seek the views of the public, civil society, industry and government authorities as to the extent to which it is necessary and proportionate to utilise this technology.”

Scottish Liberal Democrat justice spokesman Liam McArthur MSP said ministers and senior officers must now “consider what oversight and safeguards are necessary to ensure that technology does not run ahead of the ability to ensure that it is utilised in a lawful and proportionate fashion”.

He added: “With the use of these kiosks moving beyond the trial stage, it is time we knew what guidance, guarantees and protections against misuse are in place.”

The Scottish Parliament’s Justice Sub-Committee on Policing will meet on Thursday to discuss Police Scotland’s use of cyber kiosks.

Scottish Green MSP John Finnie, who is convenor of the sub-committee and a former police officer, said “consequences for the human rights and privacy of suspects” will be under scrutiny.

He added: “This session is a chance for members to question the Scottish Police Authority's oversight of the proposed introduction of cyber kiosks, and whether Police Scotland’s policies are sufficiently robust to safeguard the rights of the public.”

Last week, the justice minister answered parliamentary questions from Pauline McNeill MSP about the legality of Police Scotland’s use of cyber kiosks.

Matheson said: “When the police seize a phone or another electronic device under the authority of a judicial warrant, statutory power or following a suspect’s arrest, it is lawful for them to examine that device for evidence. A person may also voluntarily provide their electronic device in the knowledge that it will be examined for evidence in relation to the particular crime under investigation.”

A spokeswoman for the Information Commissioner said: “We have received a formal complaint from Privacy International and will be making enquiries.”

Last night a Scottish Government spokeswoman told the Sunday Herald there will be a consultation before cyber kiosks are widely used in Scotland.

She said: “The implementation of cyber kiosks is not imminent and will be subject to consultation with stakeholders ahead of any roll out.”

Assistant Chief Constable Steve Johnson defended the use of cyber kiosks, insisting they “enhance the efficiency and overall phone examination process and release cybercrime staff for more complex analysis of other cases”. He said they are already in use by other UK police forces.

Johnson said cyber kiosks are used by specially trained police officers to access mobile phones, but the devices do not retain data. If evidence is found the phone is sent to be “forensically examined”.

He added that Police Scotland is “in the early stages of developing robust governance” around the use of cyber kiosks “in consultation with a range of key stakeholders”.