Former police officer has complaint upheld against Scottish Police Authority

A former police officer who claims that colleagues tried to smear her reputation has had a complaint upheld by the Information Commissioner’s Office.

The ICO ruled that the Scottish Police Authority (SPA) did not comply with data protection laws after Karen Harper requested information they held about her on file.

The former police officer, who retired last year after 22 years unblemished service, had submitted a Subject Access Request (SAR) to the SPA, which allows individuals to obtain details held on them by public bodies.

Last July Harper complained to the ICO that the SPA had not complied with regulations as documents had been withheld.

She also complained that the SPA shared a letter with a number of individuals despite instructions it should be kept confidential.

In response, police officials told the Information Commissioner’s Office they did not hand over what was in her file as they believed Harper already had the data.

Chief Constable faces probe over claims he gave MSPs false details

But the ICO ruled that the SPA did not comply with its data protection obligations.

The ICO said: “I have considered the information available in relation to this complaint and I am of the view that SPA has not complied with its data protection obligations.

“This is because it failed to provide you with all information to which you are entitled in response to your SAR. Specifically, SPA has informed the ICO that it withheld documents it believed you would already be in possession of.

“Under data protection legislation, organisations must provide data subjects with all information to which they are entitled, regardless of whether they believe the subject already has the information, or would have had been in possession of the information previously.

“Further, SPA failed to inform you of any delays encountered when responding to your request. Under GDPR, organisations must be transparent with data subjects and this includes keeping them informed of timescales to respond to requests.

“Organisations must also provide the reasons as to why a response has been delayed.”

Regarding Harper’s complaint over the letter, the ICO ruled that the SPA had complied with its data protection obligations.

The ICO said: “This is because SPA has stated that the CEO receives a wide variety of correspondence and not all of which fall within her remit. Therefore, SPA’s process is to identify the relevant sections to manage each correspondence.

“In this case, SPA has stated that due to the nature of your correspondence and to ensure that your request was managed appropriately, your letter was passed to the relevant specialists to deal with.

“It is our view that it would be within an individual’s reasonable expectation that correspondence sent to a person in high position within an organisation may not be directly read by that person.

“It is therefore up to each organisation as to who is best to handle correspondence.”

Harper, aged 51, was allegedly bullied by fellow police officers in Dumfries after she requested flexible working hours following the death of her mother in 2014.

She transferred from Lanarkshire to Dumfries to shorten her daily commute but a request for flexible working hours was met with resistance by management and she alleges they started bullying  her.

In May 2016 her lawyer submitted allegations of criminality and misconduct against 10 officers involved in the alleged “black op”.


After her police career ended last year Harper condemned politicians and regulators for failing to hold Police Scotland to account.

Harper said: “I’m pleased the Commissioner has found in my favour however it shouldn’t be this difficult to get information from a publicly funded body.

“The SPA have weathered a lot of controversy around their reluctance to share information but new leadership was supposed to herald a new culture of openness and transparency. I would suggest my experience indicates otherwise.

A spokesperson for the Scottish Police Authority said:”The Authority is committed to fulfilling it’s obligations when a request such as this is made. On this occasion we fell short of full compliance in our response by not including some information we assessed the requester already had.

“We accept the Commissioner’s finding in that regard and have provided the relevant information. We will ensure that learning is reflected in our approach in the future.”

This article appeared in The Sunday Mail on January 20.

1 comment
  1. I would trust that those who were culpable are personally held to account for their actions. It is not sufficient for SP to say “…We will ensure that learning is reflected in our approach in the future.” Individuals make organisations, and hiding behind organisation structures by senior officers in order to absolve themselves from accountability is totally unsatisfactory. It leads to complacence by the org and contributes to a poor public perception with regard to the org. In this case, the org is Police Scotland which is too important to the future of Scotland for complacency to occur. Complacency should be eradicated from senior officers regard as to the daily running/practices/procedures of the Police Scotland. Failure to do so merely results in a poorly run and managed Policing organisation, and that is unacceptable.

Leave a Reply

Your email address will not be published. Required fields are marked *

Hi! To read more you need to login.
Not a member yet? Join our co-operative now to get unlimited access.
You can join using Direct Debit, payment card or Paypal. Cancel at any time. If you are on a low-income you may be eligible for a free sponsored membership. Having trouble logging in? Try here.
Hi! To read more you need to login.
Not a member yet?
Hi! You can login using the form below.
Not registered yet?
Having trouble logging in? Try here.
Back our next investigation
Can you help us find out who really runs Scotland?