ICO raps two Scottish councils for “repeated” failures to respond to subject access requests within legal timeframe

The Information Commissioner's Office (ICO) has issued reprimands to Glasgow City Council and the City of Edinburgh Council for failing to respond to requests for personal information within the legal timeframe, leading to a “significant backlog” of requests.

The reprimands follow the watchdog’s engagement with all 32 local authorities in Scotland after it became aware of delays in responses to Subject Access Requests (SARs), amounting to years in some cases.

Following the ICO’s support to put action plans in place, it noted that many local authorities had significantly reduced their backlog of requests and improved their response times.  

Despite a 67% overall increase in the total number of SARs to local authorities in Scotland between 2021 and 2024, 75% of local authorities improved their SAR compliance, with 13 local authorities reporting a compliance rate of 90% in 2023/24. 

However, the ICO launched investigations into Glasgow City Council and City of Edinburgh Council, after it did not see any “tangible improvements” over 12 months.  

The ICO noted: “Our recent compulsory audit of Glasgow City Council found that the council has good policies and procedures in place to handle SARs. However, lack of resource and budget remains an issue, with the council still unable to respond to many SARs within the legal timeframe.”  

It revealed that following its reprimand, City of Edinburgh Council has now reported some improvement in its response times.  

Jenny Brotchie, Acting Head of Scottish Affairs at the ICO, said: “Those who were let down in the past are being let down again, this time by poor SAR compliance. We have heard how undue delays and lack of communication from local authorities can cause further distress for people, including those with care experience and those trying to claim redress in Scotland. Local authorities must get this right despite the rising numbers of requests, which is why we have been offering support and monitoring those with poor compliance until we are satisfied that improvements have been made.”

She added: “While I’m pleased to see significant improvements from most of the local authorities that we engaged with, SAR compliance in Scotland remains a concern and we must ensure people can exercise their information rights effectively and without further harm. We expect all local authorities to have sufficient resources in place to handle the volume and complexity of SARs, and to keep people updated on the progress of their request.  

“We are taking a proportionate approach to monitoring local authorities, but these reprimands show that we will not hesitate to take enforcement action where necessary.”

The ICO acknowledged that many local authorities have seen an increase in SARs received - many in relation to the Redress Scotland scheme where people who suffered abuse while in care can apply for redress using supporting documents such as their care records.

A Glasgow City Council spokesperson said: “Since the launch of the Scottish Government’s Redress scheme, the city has faced a 350% increase in Subject Access Requests. Many of these cases are extremely complex, requiring staff to locate and review files running to thousands of pages.

“Despite this, we are managing to respond within the statutory timescales to roughly half of the requests we receive each month.

“The council will continue to work with the Commissioner’s office to respond positively to these findings. This includes engaging with the Redress Scheme to try and streamline administrative processes; allowing the council to support applicants without the necessity of a formal Subject Access Request."

The spokesperson added: “Glasgow Health and Social Care Partnership has recruited additional staff to focus on the backlog of cases – and the council has also agreed to invest in technology to support and speed up the redaction process, which can be significant in these cases.”

Cllr Jane Meagher, City of Edinburgh Council Leader, said: “To give this some important context, the ongoing work of the Scottish Child Abuse Inquiry has led to a significant increase in subject access requests – almost doubling to 746 in 2024 when compared with 2020.

“The majority of these requests are from people seeking information about their time in care. Case files are extremely sensitive, complex and frequently run into thousands of pages."

She added: “[…] We’ve committed substantial time, money and effort into improving performance and response times, more than trebling the size of the team, revising our processes and investing in new redaction software. This has started to pay dividends, with compliance rates showing sustained improvement throughout 2024 and reaching 89% for cases due in January 2025. We’re confident of improving this still further.

“Of course, we mustn’t lose sight of the people at the heart of this work, and the horrific trauma they’ve endured; trauma that can be brought back to the surface through this process. That’s why we have two social workers dedicated to supporting abuse survivors and why we’re working with Social Work Scotland’s Historic Abuse Practice Network to develop a Gold Standard for dealing with requests as consistently and sensitively as possible.”

Lottie Winson