Last week, the Information Commissioner’s Office (ICO) reported on their website that it had issued reprimands to Glasgow City Council and City of Edinburgh Council for failures to respond promptly to individuals who requested personal data (commonly known as ‘data subject access requests’, or ‘DSAR’/’SAR’).
This forms part of the regulator’s actions to tackle significant delays for people trying to access copies of their personal information held by local authorities across Scotland, in particular individuals who were in care and those applying for redress after suffering abuse while in care.
The ICO first began to crackdown on DSARs non-compliance back in 2022, issuing 7 reprimands to UK organisations with backlogs. This pattern of issuing reprimands (but not fines) has continued, with formal action focusing on large scale systemic DSAR failings, mainly in the public sector.
This latest report mentions having proactively engaged with all 32 local authorities in Scotland because of their delays in responding to DSAR/SAR. Back in February 2024, the ICO published a blog article to highlight concerns about Scottish local authorities, and how it had asked them to disclose “statistics about their response times to SARs, including how many were responded to within the legal timeframe, and the age of requests that had not yet received any response”.
In the case of Glasgow City Council and City of Edinburgh Council, the most recent report explains how investigations were launched into those two local authorities because, after its initial proactive engagement, the regulator did not see any tangible improvements over 12 months.
The ICO continues urging people with experience of the care system in any part of the UK to come forward and share experiences both requesting their records and having their personal information handled in the care system. It plans to make available updated resources for all UK organisations, clarifying how they can improve processes when handling requests for care records and protect the personal information of people with care experience. Likely these resources will be relevant and applicable not only to public sector organisations, but also to any organisation delivering personal care, encompassing private and third sector organisations also.
This recent ICO news report gives insight into the kind of records which it requests from organisations as part of an initial investigation. The UK GDPR introduced the ‘accountability’ principle requiring organisations to maintain evidence of their compliance, but for the most organisations determine for themselves what records are needed.
To date, the ICO has not published or reported any formal enforcement actions taken in relation to any complaints about the handling of individual DSARs in private and third sector organisations. It appears to see resolution as largely a matter for private action between the organisation and the individual. Typically it offers guidance to the organisation about what needs to be actioned in such cases.
UK organisations in the health or care sector, which routinely handle ‘special category’ personal data such as health data, should take note of the approach currently adopted by the regulator.