Our business

1. Overview

The purpose of this policy is to describe the records management procedures for the Police Investigations & Review Commissioner (PIRC)

It is a working document which reflects the practices in place within the organisation. As such, it will be regularly updated and reviewed as improved practices are identified.

It is designed to be a practical reference guide, and includes:

• a general commentary
• an overview of key business processes
• references to relevant polices
• underpinning frameworks

2. Introduction

The PIRC holds various records which may be case related or non-case related.

Records provide a verifiable audit of activity which can be used to assess performance, inform future decisions and ensure the accountability of the organisation.

Records management ensures information can be accessed easily, can be destroyed routinely when no longer needed, and enables organisations not only to function on a day to day basis but also to fulfil legal and financial requirements.

The purpose of this Policy is to set out the arrangements for the management, retention and destruction of all data obtained, produced and held by PIRC throughout the course of its business.

UK General Data Protection Regulation (UK GDPR) and Freedom of Information (Scotland) Act 2002 (FOISA)

FOISA provides a general legal right of access for anyone to the information held by all public authorities, subject to certain exclusions.

UK GDPR provides access for data subjects to their personal information held by organisations.

The PIRC has developed this Policy having regard to the UK GDPR and FOISA. Both Acts have provisions entitling individuals to request information that is held by the PIRC.

UK GDPR requires that personal data is held for no longer than is necessary to satisfy the purpose for which it was obtained.

Should information be requested under FOISA or UK GDPR and is withheld by the PIRC, the information requested must not be destroyed until the time allowed for the requestor to ask for a review and/or an appeal has lapsed, irrespective of the fact that the information may become due for destruction during that time.

The Data Protection Officer for the PIRC is the Information Officer, who will ensure that UK GDPR and this Policy is applied to all data held by PIRC, and in particular that personal data processed for any purpose or purposes shall not be kept longer than is necessary for that purpose or those purposes. In the absence of prescriptive legislation and regulations, the overriding determinant is what suits the business requirements of the organisation.

3. Scope

All information received or generated by the PIRC will be subject to the conditions contained within this policy. For the purposes of this policy, data is classified as either case related or non-case related data.

4. Policy Statement

Having accurate and relevant information is vital to the efficient management of the PIRC and we value records and information as corporate assets. We need to balance our statutory obligations (for example providing the public with information) and our desire to be open and responsive with our duties of confidentiality for personal and sensitive records. We will create and manage all records efficiently, make them accessible when needed, but protect and store them securely and dispose of them safely at the appropriate time.

We review our policies regularly to ensure they continue to be relevant.

The PIRC collects personal data from a number of sources as part of our core functions of complaint handling review and investigations processes.

Section 46(1) of the Police, Public Order and Criminal Justice (Scotland) Act 2006 as amended (“the 2006 Act”) gives the PIRC power to disclose information to any public body or office holder as specified therein.

5. Case Related Material: Reviews

Case related information is held by the PIRC for the following purposes:

• Conducting (CHRs) under section 35 of the 2006 Act
• Assisting the PIRC in fulfilling its other obligations under the 2006 Act
• Defending any proceedings for judicial review of decisions made by the PIRC in CHRs
• Research/training
• Public relations

The PIRC holds an electronic record in the Centurion database for each complaint handling review (CHR) case. Previously, the PIRC also held a paper record for each case. However, this practice has been phased out and only cases that pre-date August 2020 (with some limited exceptions) have an associated paper file – which is held in a secure file room.

Creating and maintaining review case related files – general rules

Electronic files

• On receipt of an enquiry, a member of the Admin Team will create a new electronic file on Centurion. The record number will be allocated by Centurion.
• All documentation (letters, emails) will be saved to the Centurion record.
• All documents within the Centurion record should be saved in the format: Surname, Title, First initial ,– yymmdd – description of document.
• It is important that when new documents are created, new versions are named correctly. CHRs should be labelled:
  • First Draft
  • Tracked Version
  • Untracked Version
  • Report

Draft documents must be deleted from Centurion on completion of the final CHR Report

Paper files

Paper files are no longer created. Any paper correspondence is scanned onto Centurion and the original is destroyed. In a small number of cases, we may require to store hard copy materials. These are appropriately labelled and stored in the secure file room.

Retention Periods : Reviews

Paper files

The majority of information received by the PIRC is held in electronic format. Any documents received in hard copy are scanned onto Centurion and the originals are shredded (aside from hard copy CCTV footage, original police investigation files or intel records). The PIRC no longer creates paper files for review applications or police case papers, and although some older case files still exist on paper, the PIRC aims to progress these onto electronic records only.

The PIRC retains any paper or other hard copy records for a period of 12 months from the date that the CHR recommendations/reconsideration directions are implemented. Provisions are in place to allow staff to flag up any sensitive records such as intelligence files that require to be weeded before the standard 12 month period.

Electronic files

After the conclusion of a CHR, the PIRC will retain the electronic file for a period of 3 years from the date the CHR is issued or the recommendations/reconsideration directions are implemented/completed (whichever is later), and no less than 12 months from the date of the last action, correspondence or contact on the file. The Head of Reviews and Policy will ensure that there are no outstanding matters before the file is weeded.

Up until Dec 2020 the process was for the Records Management Officer to instruct a monthly report on Centurion to be extracted to ascertain which files were due for destruction. The Head of Reviews and Policy would then authorise the list of files for destruction and ensure an accurate record of all files destroyed is maintained.

However, due to a number of factors, a new system is currently being implemented which will make better use of the Centurion database to manage files to be destroyed or retained, and will introduce a more efficient system for records that are retained for a longer period to be recorded and automatically reviewed after a set period of time. While this system is being developed, there will be a delay in our records relating to the Review Team being destroyed according to the timescales indicated in the retention schedule attached to this policy.

Retention of files of interest

In certain cases, electronic files (including the police file) may be retained in full at the PIRC’s discretion, for example for training or research purposes, where the case has set a precedent or any case of public interest. The decision to keep a full electronic file will be noted on the Centurion record by the Review Officer/Senior Review Officer/Head of Reviews and Policy. Such cases will be reviewed annually to determine whether retention of the file remains necessary.

Reports

CHR reports will be kept indefinitely in electronic form as anonymised reports, together with reference number and the name of the applicant. Reports on the PIRC website will be removed after 2 years from the date of publication. Individual reports may remain on the website where the PIRC considers it is in the public interest to do so.

Archiving

The PIRC no longer archives paper records. Any paper records that require to be held beyond the timescales identified above will be scanned and stored on Centurion electronically.

Disposal

Secure arrangements for the disposal of material are in place. The following processes will be involved:

• Monthly identification of eligible records to be disposed of according to the PIRC’s Records Management policy, will be carried out by Admin Officer. The lists are drawn directly from the Centurion system.
• The list of files identified for destruction/weeding will be circulated to the Review Officers/Senior Review Officers for a decision on each case. This decision will be signed off by the Head of Reviews and Policy. If a case is to be retained, the reasons for retention will be recorded by the Review Officer/ Senior Review Officer on the relevant Centurion record and a review date set.
• Where the review applicant or the police have submitted original documentation (such as photos, certificates, investigation files) the Review Officer will arrange for these items to be returned to the owner.
• Secure disposal of any paper materials will then take place. For electronic records, all electronic documents and personal data will be deleted from Centurion by the admin officer. Only the PIRC reference number, name of the policing body concerned, the heads of complaint reviewed and their outcomes together with the anonymised CHR report and anonymised heads of complaint letter (in limited cases) will remain to allow future statistical analysis.
• Records Management Spreadsheets will be stored in a secure location on the G Drive.

Cases Not Proceeding to CHR

The same timescales apply to cases not proceeding (see above). Records must be identified on a monthly basis to determine which can be deleted, and the list must be approved by the Head of Reviews and Policy, prior to deletion. An anonymised copy of the final outcome letter and any related file note will be retained on Centurion.

6. Case Related Materials: Investigations

The PIRC holds files relating to the various investigation areas of business

• Criminal Enquiries
• Fatal Accident Enquiries
• Conduct investigations
• Investigation into incidents referred by Police Scotland or other policing bodies
• Assessments
• Public Interest Investigations

The files are stored in two formats , paper and electronic. The electronic files are stored in the Investigations ‘G’ Drive and the databases CLUE 2 and 3.

The information is retained by the PIRC for the following purposes:

• Conducting investigations and assisting PIRC to fulfil its obligations under sections 33A, 41A, 41B & 41C of the 2006 Act
• To inform any legal proceedings involving PIRC
• Management Information
• Research/Training
• Public relations

Retention Periods : Investigations

Both paper and electronic files relating to the respective investigations area of business will be retained in accordance with the following identified periods:

A. Criminal Enquiries

For cases where the officer is prosecuted by summary proceedings, the hard copy papers including productions should be retained for 2 years or until the conclusion of associated criminal proceedings for the complainer. The electronic record of such cases should continue to be held for 5 years.

Cases dealt with under solemn proceedings - all material including productions (electronic and hard copy) will be retained for  10 years from disposal of case.

Reported to the Procurator Fiscal where there has been a notification of ‘No Proceedings’ – any hard copy papers including productions will be retained for  5 years from the date ‘No Proceedings’ is intimated or until the conclusion of associated criminal proceedings for the complainer. (This takes account of Moorov considerations)

For cases marked no proceedings, where the charges relate to a sexual offence, the papers, including productions (electronic and hard copy) should be retained for 10 years from the date ‘No Proceedings’ is intimated 

Police referred papers should be retained for 3 years.

B. Fatal accident investigations

All material will be retained for 3 years following the conclusion of the fatal accident inquiry unless exceptions highlighted below apply.

Exemptions: where any of the following apply, the retention date for files is twelve months following completion of the relevant action

• Receipt of a complaint against the PIRC
• Legal proceedings involving the PIRC
• Intimation by victims of compensation claims against Police Scotland other policing bodies
• Receipt of a subject access request
• Receipt of a Freedom of Information request
• Notice from the Scottish Criminal Case Review Commission

C. Conduct investigations

Pre-submission of conduct reports to the Scottish Police Authority - all drafts of the report will be deleted

Post-submission of reports - all material will be retained for 3 years following the SPA reaching its determination on the matter (unless any of the exemptions at B apply). If a misconduct investigation of an officer comes to an end due to the officer retiring or for some other reason prior to the case being reported to the SPA by the PIRC, all of the documentation obtained during the investigation should be returned immediately to the SPA or to the original holders of the records/productions.

D. Investigations into incidents referred by Police Scotland or other policing bodies

Pre-publication – all draft reports will be deleted

Post-publication - all material will be retained for 3 years (unless any of the exemptions at B apply)

E. Assessments

All material will be retained for 3 years (unless any of the exemptions at B apply).

F. Public Interest Investigations

All material will be retained for 3 years (unless any of the exemptions at B apply).

G. Electronic Logs

All documents linked to electronic logs will be retained in line with the above stated retention periods relative to category of investigation or assessment, all management information will be retained indefinitely.

Archiving

Investigation paper files will be weeded and only original statements/documents will be retained and moved to the archiving area to be stored until their destruction.

Disposal Process

The PIRC will advise Police Scotland or other policing bodies as applicable, of the date on which the PIRC intends to dispose of all statements/documents obtained by the PIRC and documents supplied by Police Scotland or other policing bodies. Should Police Scotland or other policing bodies request that the PIRC retain statements/documents for a longer period, the Head of Investigations will consider such requests on a case-by-case basis.

The PIRC will:

• return to Police Scotland or other policing bodies any original documents supplied;
• on the instructions of a Senior / Deputy Senior Investigator request a CLUE administrator to delete all documents held on CLUE 2 and 3; and
• on the instructions of a Senior / Deputy Senior Investigator request admin staff to delete all documents held on the G-drive and destroy paper copy documents.

Secure arrangements for the disposal of materials are in place and an electronic record will be kept logging the details of destruction date.

Productions

Refer to the PIRC Productions/Articles Standard Operating procedures for handling, retention and destruction of productions and digital media cards.

Reports

Reports on our website will be removed after two years from publication. Individual reports may remain on our website where the PIRC considers it is in the public interest to do so. The PIRC will retain all Investigations Reports indefinitely following the submission to the relevant authority.

Day Books

Some investigators routinely make use of a ‘day book’ to record contemporaneous notes of enquiries and matters relevant to their day-to-day duties in PIRC. While PIRC is not averse to this practice, it is essential that disclosure obligations apply to such documents as ‘relevant material’, in the context of criminal proceedings, fatal accident inquiries or public inquiries, as the entries in day books may be ‘disclosable’ relevant material in terms of Part 6 of the Criminal Justice and Licensing (Scotland) Act 2010 and other enactments.

While recognising that information recorded at an early stage of an investigation may later be found to be inaccurate, due to changing circumstances or as more evidence and information is gathered, if it has been recorded and relates to a specific investigation then it may require to be revealed to the Crown for the purposes of disclosure, dependent upon the disposal decisions. Consequently, to comply with our disclosure obligations, it is essential that we continually review data recorded during and at the conclusion of each investigation.

The practice of recording information in day books pertaining to a particular PIRC investigation is acceptable as long as, at the conclusion of the investigation, all relevant information in the day book is transferred into Clue 3, either through scanning the day book entries or through an entry that contains that information. In some circumstances, you may need to add some context to provide reasons why a particular matter was never pursued, e.g. new or changing information.

If there is information that is not relevant or accurate at the conclusion of the investigation, it requires to be destroyed. Thus, at the conclusion of an investigation, nothing should remain in a day book pertaining to the investigation. It should either be held within Clue or destroyed.

It is the responsibility of each investigator to undertake this exercise at the end of each investigation and provide assurance to managers that this has occurred.

7. Non-Case Related Material

The PIRC retains non-case related materials in line with conventional statutory retention periods and best practice, under the following key headings:

• Agreements & Related Correspondence
• Property
• Accounts & Finance
• MOUs
• Employee Records
• Health & Safety
• Insurance
• General

A full list of non-case related retention materials is set out in Appendix 1 along with the current retention periods.

The Head of Corporate Services/Accountable Officer is responsible for ensuring compliance with the Records Management Policy in respect of non-case related data and will request the Information Officer undertake regular reviews of information retained by the PIRC.

Compliance with the Records Management Policy and with statutory data retention periods is independently examined on an ongoing basis by the PIRC’s internal auditors.

Secure arrangements for the disposal of materials are in place. The following processes will be involved:

• identification of list of eligible records to be disposed according to the PIRC’s archiving policy, ensuring precedents and other material for longer term retention are removed for secure storage.
• secure disposal of material in accordance with agreement with contractor
• updating and secure storage of disposal file log by the Admin Team

8. Audit

The Records Management Officer is responsible for conducting regular audit of all records held by the PIRC. These audits will be conducted on a 6 monthly basis and the PIRC will use the audits as an opportunity to learn and improve our records management policy and procedures.

9. Responsibilities

The Senior Management Team are responsible for approving and promoting compliance with Records Management policies and procedures and supporting the implementation of a Records Management programme throughout the organisation. The main contact is Head of Corporate Services.

The Records Management Officer is responsible for delivering the operational activities of a Records Management programme and for the development and implementation of related procedures and guidance. The Records Management Officer is responsible for monitoring compliance through regular audits.

The Information Officer is the designated Records Management Officer and oversees compliance with this policy in relation to maintaining accurate records. The Information Officer will check the disposal of data which has reached its maximum retention period.

The Records Management Officer also reviews retention periods on a regular basis. This review is undertaken in order to ensure that data is only being held by PIRC for recognised purposes and retained in accordance with Data Protection legislation.

Individual members of staff are responsible for creating and maintaining records in accordance with company policies and best practice.

10. Online File Sharing

Across all teams, the introduction of file sharing online is becoming more prevalent. Examples of this is when the Internal Auditors use several applications to share documents and reports before and after an audit takes place.

Instead of taking up large amounts of physical office space, facing barriers when email files are too large or managing security issues, an online file sharing platform can remove limitations and enable the PIRC to be much more agile, accessible and safe in the digital world, especially when staff spend more of their time working from home.

A number of considerations must be taken to ensure that the use of these applications are safe and secure when transferring information both from and to another organisation, for example

• Only share information which is relevant for the purpose
• Limit information access to key staff only
• Consider how long information should be retained on these platforms

11. Administration of the Policy

This policy is supported by detailed data retention and destruction procedures, which set out in detail how this policy is applied in practice.

12. Non Compliance

Employees who do not believe that the principles set out in this records management policy have been correctly applied may appeal directly to the Head of Corporate Services who will investigate and respond in writing within 21 days.

13. Communication & Contacts

This policy will be shared with all employees within PIRC and will be published for public access on our web site.

Queries should be addressed to:

Head of Corporate Services 
Phone: 01698 542900 
Email: enquiries@pirc.gov.scot

14. Benchmarks Used in Policy Formulation

• Previous PIRC version
• Scottish Information Commissioner
• National Archives of Scotland
• Scottish Public Services Ombudsman

This Policy is a formal PIRC policy and will be reviewed by the Information Governance Group, with amendments approved by the PIRC Heads of Department Group represented therein on an annual basis.

Version control data 
Title: Records Management Policy 
Approver: Information Governance Steering Group/SMT 
Version Number: Version 7 
Publish Internet/Pulse: Both 
Summary of last modification: General updates including more digital and less paper records. 
Date of Approval: June 2023 
Next review date: June 2025

Please view PDF version for appendices.