The UK’s data protection regulator has issued formal reprimands to councils of Scottish major cities over unacceptable backlogs in response times for citizens’ requests for copies of their personal information
Local authorities representing Scotland’s two largest cities councils have repeatedly failed to comply with personal information requests within the legal timeframe, the Information Commissioner’s Office has said.
Glasgow City Council and City of Edinburgh Council have been reprimanded for “poor” compliance with subject access requests, with some people waiting years for a response, according to the regulator.
Currently, under data protection law, people are entitled to ask organisations for any personal information they hold on them and receive a copy within a month, unless an exception is granted. Over the last five years, local authorities have seen a significant increase in SARs, with volumes rising by 67% between 2021 and 2024. It is claimed the surge is related to the Redress Scotland scheme. Launched in 2021, the initiative offers financial compensation to those who were abused while in care before December 2004, and applicants require supporting documents to complete their application.
“Those who were let down in the past are being let down again, this time by poor SAR compliance”, Jenny Brotchie, head of Scottish Affairs at the ICO said.
While a majority of councils improved their SAR compliance after being prompted by the ICO more than a year ago, Glasgow and Edinburgh continued to fail to fix the issue, leading to a “significant backlog of requests”. Consequently, the data regulator launched an investigation into both councils.
Brotchie added: “We have heard how undue delays and lack of communication from local authorities can cause further distress for people, including those with care experience and those trying to claim redress in Scotland. Local authorities must get this right despite the rising numbers of requests, which is why we have been offering support and monitoring those with poor compliance until we are satisfied that improvements have been made.”
The ICO’s recent audit of Glasgow City Council revealed budget and resource pressures were preventing the local authority from complying with requests within the legal timeline.
Meanwhile, the City of Edinburgh Council has reported some improvements in its response times following the reprimand, the ICO said.
Related content
A Glasgow City Council spokesman said the Glasgow Health and Social Care Partnership had recruited additional staff” to deal with the backlog. The council will also invest in technology “to support and speed up the redaction process”.
They added: “Since the launch of the Scottish Government’s redress scheme, the city has faced a 350% increase in Subject Access Requests. Many of these cases are extremely complex, requiring staff to locate and review files running to thousands of pages. Despite this, we are managing to respond within the statutory timescales to roughly half of the requests we receive each month. The council will continue to work with the commissioner’s office to respond positively to these findings. This includes engaging with the redress scheme to try and streamline administrative processes; allowing the council to support applicants without the necessity of a formal Subject Access Request.”
Edinburgh City Council leader Jane Meagher said: “To give this some important context, the ongoing work of the Scottish Child Abuse Inquiry has led to a significant increase in subject access requests – almost doubling to 746 in 2024 when compared with 2020. The majority of these requests are from people seeking information about their time in care. Case files are extremely sensitive, complex and frequently run into thousands of pages. To give an example, one 8,000-page request took one member of staff six months to process.”
She added: “We’ve committed substantial time, money and effort into improving performance and response times, more than trebling the size of the team, revising our processes and investing in new redaction software. This has started to pay dividends, with compliance rates showing sustained improvement throughout 2024 and reaching 89% for cases due in January 2025. We’re confident of improving this still further. Of course, we mustn’t lose sight of the people at the heart of this work, and the horrific trauma they’ve endured; trauma that can be brought back to the surface through this process. That’s why we have two social workers dedicated to supporting abuse survivors and why we’re working with Social Work Scotland’s Historic Abuse Practice Network to develop a Gold Standard for dealing with requests as consistently and sensitively as possible.”
A version of this story originally appeared on PublicTechnology sister publication Holyrood
