Our business

1. Overview

The purpose of this policy is to describe the records management procedures for the Police Investigations & Review Commissioner (PIRC)

It is a working document which reflects the practices in place within the organisation. As such, it will be regularly updated and reviewed as improved practices are identified.

It is designed to be a practical reference guide, and includes:

• a general commentary
• an overview of key business processes
• references to relevant polices
• underpinning frameworks

2. Introduction

The PIRC holds various records which may be case related or non-case related.

Records provide a verifiable audit of activity which can be used to assess performance, inform future decisions and ensure the accountability of the organisation.

Records management ensures information can be accessed easily, can be destroyed routinely when no longer needed, and enables organisations not only to function on a day to day basis but also to fulfil legal and financial requirements.

The purpose of this Policy is to set out the arrangements for the management, retention and destruction of all data obtained, produced and held by PIRC throughout the course of its business.

UK General Data Protection Regulation (UK GDPR) and Freedom of Information (Scotland) Act 2002 (FOISA)

FOISA provides a general legal right of access for anyone to the information held by all public authorities, subject to certain exclusions.

UK GDPR provides access for data subjects to their personal information held by organisations.

The PIRC has developed this Policy having regard to the UK GDPR and FOISA. Both Acts have provisions entitling individuals to request information that is held by the PIRC.

UK GDPR requires that personal data is held for no longer than is necessary to satisfy the purpose for which it was obtained.

Should information be requested under FOISA or UK GDPR and is withheld by the PIRC, the information requested must not be destroyed until the time allowed for the requestor to ask for a review and/or an appeal has lapsed, irrespective of the fact that the information may become due for destruction during that time.

The Data Protection Officer for the PIRC is the Information Officer, who will ensure that UK GDPR and this Policy is applied to all data held by PIRC, and in particular that personal data processed for any purpose or purposes shall not be kept longer than is necessary for that purpose or those purposes. In the absence of prescriptive legislation and regulations, the overriding determinant is what suits the business requirements of the organisation.

Scottish Biometrics Commissioner Act 2020

The Commissioner’s general function is to support and promote the adoption of lawful, effective, and ethical practices in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes by Police Scotland, the Scottish Police Authority (SPA), and the Police Investigations and Review Commissioner (PIRC). Therefore as a named authority within the act, the PIRC must comply with the Commissioner’s Code of Practice when recording, storing, processing and destroying biometrics information in relation to our role within the criminal justice field..

3. Scope

All information received or generated by the PIRC will be subject to the conditions contained within this policy. For the purposes of this policy, data is classified as either case related or non-case related data.

4. Policy Statement

Having accurate and relevant information is vital to the efficient management of the PIRC and we value records and information as corporate assets. We need to balance our statutory obligations (for example providing the public with information) and our desire to be open and responsive with our duties of confidentiality for personal and sensitive records. We will create and manage all records efficiently, make them accessible when needed, but protect and store them securely and dispose of them safely at the appropriate time.

We review our policies regularly to ensure they continue to be relevant.

The PIRC collects personal data from a number of sources as part of our core functions of complaint handling review and investigations processes.

Section 46(1) of the Police, Public Order and Criminal Justice (Scotland) Act 2006 as amended (“the 2006 Act”) gives the PIRC power to disclose information to any public body or office holder as specified therein.

5. Case Related Material: Reviews

Case related information is held by the PIRC for the following purposes:

• Conducting (CHRs) under section 35 of the 2006 Act
• Assisting the PIRC in fulfilling its other obligations under the 2006 Act
• Defending any proceedings for judicial review of decisions made by the PIRC in CHRs
• Research/training
• Public relations

The PIRC holds an electronic record in the Centurion database for each complaint handling review (CHR) case. Previously, the PIRC also held a paper record for each case. However, this practice has been phased out and only cases that pre-date August 2020 (with some limited exceptions) have an associated paper file – which is held in a secure file room.

Creating and maintaining review case related files – general rules

Electronic files

• On receipt of an enquiry, a member of the Admin Team will create a new electronic file on Centurion. The record number will be allocated by Centurion.
• Applicants who create an online account to submit their complaint will store their personal data, in some cases including uploaded documents on the PIRC website
• All documentation (letters, emails) will be saved to the Centurion record.
• All documents within the Centurion record should be saved in the format: Surname, Title, First initial ,– yymmdd – description of document.
• It is important that when new documents are created, new versions are named correctly. CHRs should be labelled:
  • First Draft
  • Tracked Version
  • Untracked Version
  • Report

Draft documents must be deleted from Centurion on completion of the final CHR Report

Paper files

Paper files are no longer created. Any paper correspondence is scanned onto Centurion and the original is destroyed. In a small number of cases, we may require to store hard copy materials. These are appropriately labelled and stored in the secure file room.

Retention Periods : Reviews

Paper files

The majority of information received by the PIRC is held in electronic format. Any documents received in hard copy are scanned onto Centurion and the originals are shredded (aside from hard copy CCTV footage, original police investigation files or intel records). The PIRC no longer creates paper files for review applications or police case papers, and although some older case files still exist on paper, the PIRC aims to progress these onto electronic records only.

The PIRC retains any paper or other hard copy records for a period of 12 months from the date that the CHR recommendations / reconsideration directions are implemented. Provisions are in place to allow staff to flag up any sensitive records such as intelligence files that require to be weeded before the standard 12 month period.

Electronic files on PIRC Shared Drives

After the conclusion of a CHR, the PIRC will retain the electronic file for a period of 3 years from the date the CHR is issued or the recommendations/reconsideration directions are implemented/completed (whichever is later), and no less than 12 months from the date of the last action, correspondence or contact on the file. The Head of Reviews and Policy will ensure that there are no outstanding matters before the file is weeded.

Biometric Information

Any information considered to be biometric in nature must be securely stored and access restricted to key staff. Where this information is included in a CHR file, it must be held in accordance with the retention schedule within the appendices of this document.

‘Biometric data’ means information about an individual’s physical, biological, physiological or behavioural characteristics which is capable of being used, on its own or in combination with other information (whether or not biometric data), to establish the identity of an individual.

Electronic files on PIRC Shared Drives

Applicants are able to create a personal account on the PIRC website and submit their police complaint, including uploaded files which are retained on the website in accordance with the retention schedule.

Electronic Information on Emails

We hold in the mailboxes information that has come to us by applicants via the public mailbox and the new website mailbox, from the police through the secure mailbox and the Admin Secure mailbox which includes police case files only.

As an organisation we will also hold information in the Investigations, Information Request, Comms and HR mailboxes.

Retention of files of interest

In certain cases, electronic files (including the police file) may be retained in full at the PIRC’s discretion, for example for training or research purposes, where the case has set a precedent or any case of public interest. The decision to keep a full electronic file will be noted on the Centurion record by the Review Officer/Senior Review Officer/Head of Reviews and Policy. Such cases will be reviewed annually to determine whether retention of the file remains necessary.

Reports

CHR reports will be kept indefinitely in electronic form as anonymised reports, together with reference number and the name of the applicant. Reports on the PIRC website will be removed after 2 years from the date of publication. Individual reports may remain on the website where the PIRC considers it is in the public interest to do so. These will be kept under regular review and will be removed when no longer relevant or in the public interest.

Archiving

The PIRC no longer archives paper records. Any paper records that require to be held beyond the timescales identified above will be scanned and stored on Centurion electronically.

Disposal

Secure arrangements for the disposal of material are in place. The following processes will be involved:

• Monthly identification of eligible records to be disposed of according to the PIRC’s Records Management policy, will be carried out by Admin Officer. The lists are drawn directly from the Centurion system.
• The list of files identified for destruction/weeding will be circulated to the Review Officers/Senior Review Officers for a decision on each case. This decision will be signed off by the Head of Reviews and Policy. If a case is to be retained, the reasons for retention will be recorded by the Review Officer/ Senior Review Officer on the relevant Centurion record and a review date set.
• Where the review applicant or the police have submitted original documentation (such as photos, certificates, investigation files) the Review Officer will arrange for these items to be returned to the owner.
• Secure disposal of any paper materials will then take place. For electronic records, all electronic documents and personal data will be deleted from Centurion by the admin officer. Only the PIRC reference number, name of the policing body concerned, the heads of complaint reviewed and their outcomes together with the anonymised CHR report and anonymised heads of complaint letter (in limited cases) will remain to allow future statistical analysis.
• Records Management Spreadsheets will be stored in a secure location on the G Drive.

Cases Not Proceeding to CHR

The same timescales apply to cases not proceeding (see above). Records must be identified on a monthly basis to determine which can be deleted, and the list must be approved by the Head of Reviews and Policy, prior to deletion. An anonymised copy of the final outcome letter and any related file note will be retained on Centurion.

6. Case Related Materials: Investigations

The PIRC holds files relating to the various investigation areas of business

• Criminal Enquiries
• Fatal Accident Inquiries
• Crown Instructed Death Investigations
• Conduct investigations
• Investigation into incidents referred by Police Scotland or other policing bodies
• Assessments
• Public Interest Investigations

The files are stored in two formats, paper and electronic. The electronic files are stored in the Investigations ‘G’ Drive and the databases CLUE 2 and 3 and standalone data transfer and storage systems, Egress and Sonology. In addition, some of the information obtained and processed may be biometric in nature, and this information must be held in compliance with the Scottish Biometrics Commissioner’s Code of Practice. The retention of this information will be outlined in the appendices of this policy.

The information is retained by the PIRC for the following purposes:

• Conducting investigations and assisting PIRC to fulfil its obligations under sections 33A, 41A, 41B & 41C of the 2006 Act
• To inform any legal proceedings involving PIRC
• Management Information
• Research/Training
• Public relations

Retention Periods : Investigations

Both paper and electronic files relating to the respective investigations area of business will be retained in accordance with the following identified periods:

A. Criminal Enquiries

For cases where the officer is prosecuted by summary proceedings, the hard copy papers including productions should be retained for 2 years or until the conclusion of associated criminal proceedings for the complainer. The electronic record of such cases should continue to be held for 5 years.

Cases dealt with under solemn proceedings - all material including productions (electronic and hard copy) will be retained for 10 years from disposal of case.

Reported to the Procurator Fiscal where there has been a notification of ‘No Proceedings’ – any hard copy papers including productions will be retained for 5 years from the date ‘No Proceedings’ is intimated or until the conclusion of associated criminal proceedings for the complainer. (This takes account of Moorov considerations)

For cases marked no proceedings, where the charges relate to a sexual offence, the papers, including productions (electronic and hard copy) should be retained for 10 years from the date ‘No Proceedings’ is intimated.

Article 3 and 5 Assessments

Where an Article 3 or 5 Assessment is disposed of as no further action, after consideration by the PIRC without referral to the Procurator Fiscal , the hard copy/electronic material should be retained for a period of 5 years from the no further action decision.

For Article 3 referrals where the complaint relates to a sexual offence hard copy/electronic material should be retained for a period of 10 years from the no further action decision.

B. Fatal accident investigations

All material will be retained for 3 years following the conclusion of the fatal accident inquiry unless exceptions highlighted below apply.

Exemptions: where any of the following apply, the retention date for files is twelve months following completion of the relevant action

• Receipt of a complaint against the PIRC
• Legal proceedings involving the PIRC
• Intimation by victims of compensation claims against Police Scotland other policing bodies
• Receipt of a subject access request
• Receipt of a Freedom of Information request
• Notice from the Scottish Criminal Case Review Commission

C. Conduct investigations

Pre-submission of conduct reports to the Scottish Police Authority - all drafts of the report will be deleted.

Post-submission of reports - all material will be retained for 3 years following the SPA reaching its determination on the matter (unless any of the exemptions at B apply). If a misconduct investigation of an officer comes to an end due to the officer retiring or for some other reason prior to the case being reported to the SPA by the PIRC, all of the documentation obtained during the investigation should be returned immediately to the SPA or to the original holders of the records/productions.

D. Investigations into incidents referred by Police Scotland or other policing bodies

Pre-publication – all draft reports will be deleted

Post-publication - all material will be retained for 3 years (unless any of the exemptions at B apply)

E. Assessments

All material will be retained for 3 years (unless any of the exemptions at B apply).

F. Public Interest Investigations

All material will be retained for 3 years (unless any of the exemptions at B apply).

G. Electronic Logs

All documents linked to electronic logs will be retained in line with the above stated retention periods relative to category of investigation or assessment, all management information will be retained indefinitely.

Archiving

Investigation paper files will be weeded and only original statements/documents will be retained and moved to the archiving area to be stored until their destruction.

Disposal Process

The PIRC will advise Police Scotland or other policing bodies as applicable, of the date on which the PIRC intends to dispose of all statements/documents obtained by the PIRC and documents supplied by Police Scotland or other policing bodies. Should Police Scotland or other policing bodies request that the PIRC retain statements/documents for a longer period, the Head of Investigations will consider such requests on a case-by-case basis.

The PIRC will:

• return to Police Scotland or other policing bodies any original documents supplied;
• on the instructions of a Senior / Deputy Senior Investigator request a CLUE administrator to delete all documents held on CLUE 2 and 3 and standalone data transfer and storage systems, Egress and Sonology; and
• on the instructions of a Senior / Deputy Senior Investigator request admin staff to delete all documents held on the G-drive and destroy paper copy documents.

Secure arrangements for the disposal of materials are in place and an electronic record will be kept logging the details of destruction date.

Productions

Refer to the PIRC Productions/Articles Standard Operating procedures for handling, retention and destruction of productions and digital media cards.

Reports

Reports on our website will be removed after two years from publication. Individual reports may remain on our website where the PIRC considers it is in the public interest to do so. These will be kept under regular review and will be removed when no longer relevant or in the public interest. The PIRC will retain all Investigations Reports indefinitely following the submission to the relevant authority.

Day Books

Some investigators routinely make use of a ‘day book’ to record contemporaneous notes of enquiries and matters relevant to their day-to-day duties in PIRC. While PIRC is not averse to this practice, it is essential that disclosure obligations apply to such documents as ‘relevant material’, in the context of criminal proceedings, fatal accident inquiries or public inquiries, as the entries in day books may be ‘disclosable’ relevant material in terms of Part 6 of the Criminal Justice and Licensing (Scotland) Act 2010 and other enactments.

While recognising that information recorded at an early stage of an investigation may later be found to be inaccurate, due to changing circumstances or as more evidence and information is gathered, if it has been recorded and relates to a specific investigation then it may require to be revealed to the Crown for the purposes of disclosure, dependent upon the disposal decisions. Consequently, to comply with our disclosure obligations, it is essential that we continually review data recorded during and at the conclusion of each investigation.

The practice of recording information in day books pertaining to a particular PIRC investigation is acceptable as long as, at the conclusion of the investigation, all relevant information in the day book is transferred into Clue 3, either through scanning the day book entries or through an entry that contains that information. In some circumstances, you may need to add some context to provide reasons why a particular matter was never pursued, e.g. new or changing information.

If there is information that is not relevant or accurate at the conclusion of the investigation, it requires to be destroyed. Thus, at the conclusion of an investigation, nothing should remain in a day book pertaining to the investigation. It should either be held within Clue or destroyed.

It is the responsibility of each investigator to undertake this exercise at the end of each investigation and provide assurance to managers that this has occurred.

Convention on the Rights of the Child

On July 16 2024, the United Nation Convention on the Rights of Children (UNCRC) (Incorporation)(Scotland) Act 2024 made Scotland the first country in the UK to directly incorporate the UNCRC into domestic law.

This Act ensures that children’s rights are central to policy and decision-making, and that their needs are met by public service complaints procedures in Scotland.

These principles affect the retention of records as follows:

• Records are stored in a way that they will not be accessed by anyone other than those who have received the permission of the child.
• Criminal history / conviction data for children under the age of 18.

7. Non-Case Related Material

The PIRC retains non-case related materials in line with conventional statutory retention periods and best practice, under the following key headings:

• Agreements & Related Correspondence
• Property
• Statutory Audits conducted by PIRC
• Accounts & Finance
• MOUs
• Employee Records
• Health & Safety
• Insurance
• General

A full list of non-case related retention materials is set out in Appendix 1 along with the current retention periods.

The Head of Corporate Services/Accountable Officer is responsible for ensuring compliance with the Records Management Policy in respect of non-case related data and will request the Information Officer undertake regular reviews of information retained by the PIRC.

Compliance with the Records Management Policy and with statutory data retention periods is independently examined on an ongoing basis by the PIRC’s internal auditors.

Secure arrangements for the disposal of materials are in place. The following processes will be involved:

• identification of list of eligible records to be disposed according to the PIRC’s archiving policy, ensuring precedents and other material for longer term retention are removed for secure storage
• secure disposal of material in accordance with agreement with contractor
• updating and secure storage of disposal file log by the Admin Team

8. Audit

The Records Management Officer is responsible for conducting regular audit of all records held by the PIRC. These audits will be conducted regularly and the PIRC will use the audits as an opportunity to learn and improve our records management policy and procedures.

9. Responsibilities

The Senior Management Team are responsible for approving and promoting compliance with Records Management policies and procedures and supporting the implementation of a Records Management programme throughout the organisation. The main contact is Head of Corporate Services.

The Records Management Officer is responsible for delivering the operational activities of a Records Management programme and for the development and implementation of related procedures and guidance. The Records Management Officer is responsible for monitoring compliance through regular audits.

The Information Officer is the designated Records Management Officer and oversees compliance with this policy in relation to maintaining accurate records. The Information Officer will check the disposal of data which has reached its maximum retention period.

The Records Management Officer also reviews retention periods on a regular basis. This review is undertaken in order to ensure that data is only being held by PIRC for recognised purposes and retained in accordance with Data Protection legislation.

Individual members of staff are responsible for creating and maintaining records in accordance with company policies and best practice.

10. Online File Sharing

Across all teams, the introduction of file sharing online is becoming more prevalent. Examples of this is when the Internal Auditors use several applications to share documents and reports before and after an audit takes place.

Instead of taking up large amounts of physical office space, facing barriers when email files are too large or managing security issues, an online file sharing platform can remove limitations and enable the PIRC to be much more agile, accessible and safe in the digital world, especially when staff spend more of their time working from home.

A number of considerations must be taken to ensure that the use of these applications are safe and secure when transferring information both from and to another organisation, for example

• Only share information which is relevant for the purpose
• Limit information access to key staff only
• Consider how long information should be retained on these platforms

11. Administration of the Policy

This policy is supported by detailed data retention and destruction procedures, which set out in detail how this policy is applied in practice.

12. Non Compliance

Employees who do not believe that the principles set out in this records management policy have been correctly applied may appeal directly to the Head of Corporate Services who will investigate and respond in writing within 21 days.

13. Communication & Contacts

This policy will be shared with all employees within PIRC and will be published for public access on our web site.

Queries should be addressed to:

Head of Corporate Services
Phone: 01698 542900
Email: enquiries@pirc.gov.scot

14. Benchmarks Used in Policy Formulation

• Previous PIRC version
• Scottish Information Commissioner
• National Archives of Scotland
• Scottish Public Services Ombudsman

This Policy is a formal PIRC policy and will be reviewed by the Information Governance Group, with amendments approved by the PIRC Heads of Department Group represented therein on an annual basis.

Version control data

Title: Records Management Policy
Version Number: Version 7
Publish Internet/Pulse: Both
Summary of last modification: Added retention for CHRs on the application portal
Date of Approval: August 2024
Next review date: August 2025

Please view PDF version for appendices.