The Information Commissioner’s Office (ICO) has issued reprimands to two Scottish councils for failing to respond to requests for personal information on time.
It has criticised Glasgow City Council and City of Edinburgh Council for repeatedly failing to respond to subject access requests (SARs) within the legal timeframe, leading to a significant backlog of requests.
It had launched investigations into their performance after it did not see any tangible improvements over 12 months. Glasgow responded to only 45% of incoming SARs within the statutory timeframe of one month, while for Edinburgh the figure was 60%.
The ICO’s recent compulsory audit of Glasgow Council found that the council has good policies and procedures in place to handle SARs. However, lack of resource and budget remains an issue, with the council still unable to respond to many SARs within the legal timeframe.
The regulator said the reprimands follow its proactive engagement with all 32 local authorities in Scotland after it became aware of delays in responses to SARs, amounting to years in some cases.
Increase in requests
Many local authorities have seen an increase in SARs received, many in relation to the Redress Scotland scheme where people who suffered abuse while in care can apply for redress using supporting documents such as their care records.
On a more positive note, the ICO said that despite a 67% overall increase in the total number of SARs to local authorities in Scotland between 2021 and 2024, 75% improved their SAR compliance, with 13 local authorities reporting a compliance rate of 90% in 2023-24.
Jenny Brotchie, acting head of Scottish affairs at the ICO, said: “Those who were let down in the past are being let down again, this time by poor SAR compliance. We have heard how undue delays and lack of communication from local authorities can cause further distress for people, including those with care experience and those trying to claim redress in Scotland.
“Local authorities must get this right despite the rising numbers of requests, which is why we have been offering support and monitoring those with poor compliance until we are satisfied that improvements have been made.”
The ICO added that it has committed to improving the support it provides to both people who grew up in the care system across the UK and the organisations that hold their information. It has been gathering evidence of the challenges facing both people and organisations when it comes to accessing care records and will share its findings and next steps over the coming months.
