Complaint Handling Reviews

The Complaints

The complaint in this case arose after the applicant reported a data protection breach in relation to her medical records, by an NHS employee, namely that: 

1. the applicant reported a data breach and believes that there has been insufficient investigation made by the police; and
2. the applicant did not receive updates after she reported a data breach to police.

Police Scotland's decision

Police Scotland did not uphold either of the applicant’s complaints. 

Our Findings

We have found that Police Scotland did not handle either of the applicant’s complaints to a reasonable standard.  

We have made two recommendations and identified two learning points to address  shortcomings in Police Scotland’s handling of the complaints.  

Our learning points should be implemented by Police Scotland within two months of the date of this report.

Outcome

Police Scotland implemented two recommendations and two learning points in this case. In doing so, Police Scotland carried out further enquiries into the applicant’s complaints and provided her with a well-reasoned further response which clearly explained why the complaints were now upheld. As a result of this, individual learning was identified for the officer subject of the complaint. This was in addition to the learning points identified in our report. All learning identified as a result of these complaints was circulated and acknowledged appropriately.

Police Bodies: Police Scotland