The UK’s communications regulator has issued a warning to both the Glasgow City and City of Edinburgh Councils for failing to respond to personal information requests on time.

Under data protection law, people have the right to ask an organisation if it holds their personal information and receive a copy of any personal information held within a month, unless an extension is applied. These are known as subject access requests (SARs).

People who have issued a SAR to the Glasgow City and City of Edinburgh Councils have faced significant dealys, resulting in a reprimand from the Information Commissioner’s Office (ICO).

The repeated offence has lead to a significant backlog of requests, just as Scotland faces a surge in SARs in rleation to the Redress Scotland scheme where people who suffered abuse in care can apply for redress using supporting documents which may be held by their Councils.

The repirmands follow the ICO’s proactive enagement with all 32 local authorities in Scotland after it because aware of delays in responses to SARs, amounting to years in some cases.

“Those who were let down in the past are being let down again, this time by poor SAR compliance,” Jenny Brotchie, acting head of Scottish Affiars, said.

“We have heard how undue delays and lack of communication from local authorities can cause further distress for people, including those with care experience and those trying to claim redress in Scotland.

“Local authorities must get this right despite the rising numbers of requests, which is why we have been offering support and monitoring those with poor compliance until we are satisfied that improvements have been made.”

Following the ICO’s scrutiny and support to put actions in place, many local authorities have significantly reduced their backlog of requests and improved their response times.

Despite approximately a 68% overall increase in the total number of SARs to local authorities in Scotland between 2021 and 2024, 75% of local authorities improved their SAR compliance with 13 local authorities reporting a compliance rate of at least 90% in 2023/24.

However, the ICO has launched investigations into both Glasgow’s and Edinburgh’s city councils, and did not see any tangible improvements over 12 months.

Its recent compulsory audit of Glasgow City Council found that the council has good policies and procedures in place to handle SARs.

Yet, a lack of resources and budget constraints remains an issue, with the council still unable to respond to many SARs within the legal timeframe.

Recommended reading

• UK Gov to Reform Old Public Sector Tech and Save People “Billions”
• New Records Show UK Councils Using AI to Support Citizens
• UK Government Faces Tech Talent Crisis Without Pay Reform

The City of Edinburgh Council has now reported some improvement in its response times following its reprimand.

“While I’m pleased to see significant improvements from most of the local authorities that we engaged with, SAR compliance in Scotland remains a concern and we must ensure people can exercise their information rights effectively and without further harm,” Brotchie added.

“We expect all local authorities to have sufficient resources in place to handle the volume and complexity of SARs, and to keep people updated on the progress of their request.

“We are taking a proportionate approach to monitoring local authorities, but these reprimands show that we will not hesitate to take enforcement action where necessary.”