ICO Opens Investigation into Police Scotland Over Subject Access Request Handling Compliance

Key Takeaways

• The UK Information Commissioner's Office (ICO) has confirmed a live investigation into whether Police Scotland is meeting its legal obligations when handling subject access requests (SARs), including statutory response timescales.
• Although the matter concerns a law enforcement body, it signals continued regulatory focus on SAR compliance that financial institutions should treat as a prompt to review their own processes.

Deep Dive

The UK Information Commissioner's Office (ICO) has confirmed a live investigation into whether Police Scotland is meeting its legal obligations when handling subject access requests (SARs), including statutory response timescales. Although the matter concerns a law enforcement body, it signals continued regulatory focus on SAR compliance that financial institutions should treat as a prompt to review their own processes.

The ICO is examining whether Police Scotland has failed, or is failing, to comply with Articles 12 and 15 of the UK GDPR and Section 45 of the Data Protection Act 2018. Articles 12 and 15 set out the right of access and the transparency and timing requirements for responses. Section 45 is the right of access under the law enforcement processing regime in Part 3 of the DPA. The ICO specifically cites responding within the statutory timescale, which is generally one month under the UK GDPR, extendable in limited circumstances. The ICO has stated that opening an investigation does not imply any conclusion about a breach, and it has declined further comment while the investigation is live.

For compliance teams at financial institutions, the direct legal exposure is limited because Police Scotland is a competent authority under Part 3 of the DPA. However, the underlying obligations under Articles 12 and 15 apply equally to banks, insurers, and asset managers. The statement is a reminder that the ICO treats SARs as a fundamental right and is willing to open formal investigations into timeliness and handling failures. Firms with high SAR volumes, such as retail banks and lenders, are particularly exposed to complaint-driven regulatory attention. Note that no new requirements or deadlines have been introduced, and no outcome has been reached.

The ICO also set out its enforcement toolkit: advice, assessment notices, warnings, reprimands, enforcement notices, and fines of up to GBP £17.5 Million or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. The ICO will issue preliminary decisions before any final fine, enforcement notice, or reprimand, giving the organization a chance to respond. This procedural point is useful for incident and regulatory response planning. For public bodies, fines have historically been used sparingly, with reprimands more common, but private sector firms face a different enforcement risk profile, particularly at the higher penalty tier.

Recommended actions include:
- Test SAR intake, logging, and tracking processes to confirm the statutory clock starts and is monitored from receipt.
- Review capacity and backlog levels, especially for requests involving multiple systems, unstructured data, or third-party processors.
- Verify that any extension or refusal decisions are documented, justified, and communicated within the first month.
- Confirm that response content meets Article 15 requirements, including purposes, recipients, retention periods, and source of data.
- Escalate SAR performance metrics (volumes, on-time rate, complaints) to the data protection officer and relevant governance forums.
- Prepare a response protocol in case of an ICO inquiry or assessment notice.

Overall risk impact for financial institutions is moderate and indirect. The main exposure is reputational and regulatory if SAR backlogs exist, along with potential complaint escalation. Teams should monitor the investigation for any findings that clarify the ICO's expectations on timeliness, resourcing, and backlog management.

Source: Information Commissioner's Office