Decision Notice 026/2024: Data Impact Assessments – failure to respond

Applicant: The Applicant 
Authority: Queens Cross Housing Association Ltd
Case Ref: 202400157

Summary

The Applicant asked the Authority for the number of data impact assessments that had been carried out in relation

to the installation of security cameras.  This decision finds that the Authority failed to respond to the

Applicant’s requirement for review within the timescale allowed by the Freedom of Information (Scotland) Act 2002

(FOISA).  

Background

1.    The Applicant made an information request to the Authority on 4 December 2023.

2.    The Authority responded to the information request on 18 December 2023.

3.    On 18 December 2023, the Applicant wrote to the Authority requiring a review of its decision.

4.    The Applicant did not receive a response to his requirement for review.

5.    The Applicant wrote to the Commissioner on 5 February 2024, stating that he was dissatisfied with the

Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.  

6.    The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the

power to carry out an investigation.

Investigation

7.    Section 49(3)(a) of FOISA requires the Commissioner to notify public authorities of an application and to

give them an opportunity to comment. The Commissioner did this on 6 February 2024.

8.    The Commissioner received submissions from the Authority on 16 February 2024.  These submissions are

considered below.

9.    The Authority accepted that it had failed to respond to the Applicant’s requirement for review with the

timescale allowed by FOISA.

10.    The Authority explained that the correct procedure had not been followed when the initial response had

been issued.  It noted that all responses sent to requesters by email must be sent via the dedicated “data

protection” email address; in order that all requests can be tracked and monitored by more than one member of

staff, rather than replying from a personal mailbox.  

11.    The Authority explained that this case the officer responded using their own mailbox.  The Applicant

replied directly to the officer to ask for a review, but the officer was on leave and unable to reply and did not

action this on their return.  The Authority submitted that the matter has been raised with the officer concerned.  

The Authority also commented that it recently purchased new software which will improve its ability to log and

track Subject Access Requests and Freedom of Information requests.   It noted that all staff members dealing with

requests will receive training on the new software and they have been reminded that all responses should be sent

to/from its dedicated data protection email address to ensure that more than one person can check, and respond to,

the requests it receives.

12.    Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date

of receipt of the requirement to comply with a requirement for review.  This is subject to qualifications which

are not relevant in this case.  

13.    It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for

review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.

14.    The Authority responded to the Applicant’s requirement for review on 16 February 2024, so the Commissioner

does not require it to take any further action in relation to the Applicant’s application.

15.    The Commissioner notes that the Authority has apologised to the Applicant for its failure to comply.

Decision

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland)

Act 2002 (FOISA) in dealing with the information request made by the Applicant.  In particular, the Authority

failed to respond to the Applicant’s requirement for review within the timescales laid down by section 21(1) of

FOISA.  Given that the Authority has now responded to the Applicant’s requirement for review, he does not require

the Authority to take any action.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal

to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of

intimation of this decision.

Jennifer Ross
(Acting) Deputy Head of Enforcement

27 February 2024