Decision Notice 026/2024: Data Impact Assessments – failure to respond
Applicant: The Applicant
Authority: Queens Cross Housing Association Ltd
Case Ref: 202400157
Summary
The Applicant asked the Authority for the number of data impact assessments that had been carried out in relation
to the installation of security cameras. This decision finds that the Authority failed to respond to the
Applicant’s requirement for review within the timescale allowed by the Freedom of Information (Scotland) Act 2002
(FOISA).
Background
1. The Applicant made an information request to the Authority on 4 December 2023.
2. The Authority responded to the information request on 18 December 2023.
3. On 18 December 2023, the Applicant wrote to the Authority requiring a review of its decision.
4. The Applicant did not receive a response to his requirement for review.
5. The Applicant wrote to the Commissioner on 5 February 2024, stating that he was dissatisfied with the
Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the
power to carry out an investigation.
Investigation
7. Section 49(3)(a) of FOISA requires the Commissioner to notify public authorities of an application and to
give them an opportunity to comment. The Commissioner did this on 6 February 2024.
8. The Commissioner received submissions from the Authority on 16 February 2024. These submissions are
considered below.
9. The Authority accepted that it had failed to respond to the Applicant’s requirement for review with the
timescale allowed by FOISA.
10. The Authority explained that the correct procedure had not been followed when the initial response had
been issued. It noted that all responses sent to requesters by email must be sent via the dedicated “data
protection” email address; in order that all requests can be tracked and monitored by more than one member of
staff, rather than replying from a personal mailbox.
11. The Authority explained that this case the officer responded using their own mailbox. The Applicant
replied directly to the officer to ask for a review, but the officer was on leave and unable to reply and did not
action this on their return. The Authority submitted that the matter has been raised with the officer concerned.
The Authority also commented that it recently purchased new software which will improve its ability to log and
track Subject Access Requests and Freedom of Information requests. It noted that all staff members dealing with
requests will receive training on the new software and they have been reminded that all responses should be sent
to/from its dedicated data protection email address to ensure that more than one person can check, and respond to,
the requests it receives.
12. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date
of receipt of the requirement to comply with a requirement for review. This is subject to qualifications which
are not relevant in this case.
13. It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for
review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.
14. The Authority responded to the Applicant’s requirement for review on 16 February 2024, so the Commissioner
does not require it to take any further action in relation to the Applicant’s application.
15. The Commissioner notes that the Authority has apologised to the Applicant for its failure to comply.
Decision
The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland)
Act 2002 (FOISA) in dealing with the information request made by the Applicant. In particular, the Authority
failed to respond to the Applicant’s requirement for review within the timescales laid down by section 21(1) of
FOISA. Given that the Authority has now responded to the Applicant’s requirement for review, he does not require
the Authority to take any action.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal
to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of
intimation of this decision.
Jennifer Ross
(Acting) Deputy Head of Enforcement
27 February 2024