ICO opens investigation into Police Scotland's handling of SARs

The Information Commissioner's Office (ICO) has launched an investigation into Police Scotland's handling of subject access requests (SARs). 

The investigation seeks to determine whether the force has failed, or continues to fail, to meet its legal obligations under Articles 12 and 15 of the UK General Data Protection Regulation (GDPR) and Section 45 of the Data Protection Act 2018, including whether it adhered to required statutory timescales when responding to applications.

The ICO reiterated that SARs are a fundamental legal right, enabling citizens to learn what personal records institutions retain and how they process them. The regulator clarified that launching the investigation does not indicate a final determination of wrongdoing or predetermine the outcome of its regulatory assessment.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.