⚠️ FOI: Implementation of s.164A Data Protection Act 2018 - Complaints by Data Subjects
Request to the Highland Council.
Sent: 25 January 2026
Due: 23 February 2026
Review Sent: 23 February 2026
Review Due: 24 March 2026
SICO App Sent: 3 April 2026
SICO Ref: 202600652
SICO Decision # : 114/2026
SICO Decision Date: 15 May 2026
SICO Deadline: 29 June 2026
FS-Case-790349092
15 May 2026
Decision Notice 114/2026
Policy documents – failure to respond
Applicant: [redacted]
Authority: Highland Council
Case Ref: 202600652
Summary
The Applicant asked the Authority for information about policy documents and correspondence in relation to section 103 of Data (Use and Access) Act 2025. This decision finds that the Authority failed to respond to the request within the timescale allowed by the Freedom of Information (Scotland) Act 2002 (FOISA). The decision also finds that the Authority failed to comply with the Applicant’s requirement for review within the timescale set down by FOISA.
Background
1. The Applicant made an information request to the Authority on 25 January 2026.
2. The Authority did not respond to the information request.
3. On 23 February 2026, the Applicant wrote to the Authority requiring a review of its decision/in respect of its failure to respond.
4. The Applicant did not receive a response to her requirement for review.
5. On 3 April 2026, the Applicant wrote to the Commissioner, stating that she was dissatisfied with the Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
Investigation
7. Section 49(3)(a) of FOISA requires the Commissioner to notify public authorities of an application and to give them an opportunity to comment. The Commissioner did this on 28 April 2026.
8. The Authority did not provide the Commissioner with any submissions.
9. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case.
10. It is a matter of fact that the Authority did not provide a response to the Applicant’s request for information within 20 working days, so the Commissioner finds that it failed to comply with section 10(1) of FOISA.
11. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. Again, this is subject to qualifications which are not relevant in this case.
12. It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.
13. The remainder of section 21 sets out the requirements to be followed by a Scottish public authority in carrying out a review. As no review has been carried out in this case, the Commissioner finds that the Authority failed to discharge these requirements: he now requires a review to be carried out in accordance with section 21.
14. The Commissioner recommends that the Authority considers whether it would be appropriate to apologise to the Applicant for its failure to comply.
Decision
The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in dealing with the information request made by the Applicant. In particular, the Authority failed to respond to the Applicant’s request for information and requirement for review within the timescales laid down by sections 10(1) and 21(1) of FOISA. The Commissioner requires the Authority to provide a review response, by 29 June 2026.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
Jill Walker
Deputy Head of Enforcement
15 May 2026
23 February 2026
Dear Miles,
The following FOI are now overdue. If you could review these at your earliest opportunity I shall be grateful.
1. FS-Case-790475639 - Information Asset Register. Target date: 23 FEB 2026
2. FS-Case-790379184 - IDOX Event Logs for Planning Officer Wilson & Dent. Target Date: 23 FEB 2026
3. FS-Case-790349092 - s.164A implementation of GDPR Requests Complaints Procedure. Target Date: 23 FEB 2026.
4. FS-Case-790357348 - Datasets transferred from the Highland Council to the Assessor & Electoral Registration Officer of the Highland & Western Isles Valuation Joint Board. Target Date: 23 FEB 2026
Thank you for your time & attention.
Kind regards.
25 January 2026
Please provide the following information:
1. Any policies or information held regarding the Council's implementation of the requirements of s.103 of the Data (Use and Access) Act 2025 which amended the Data Protection Act 2018 at s.164A that came into force on 19 June 2025.
2. Any policies, reports or correspondence between relevant staff and/or the Data Protection Officer concerning how complaints under s.164A DPA 2018 will be handled by the Council.
2. The electronic application form or email address or other means by which data subjects may make a complaint to the Council under s.164A of the Data Protection Act 2018.
Thank you for your time and attention.
Kind regards.