FM complaints over pensions scandal led to privacy law breach
The Information Commissioner’s Office (ICO) has upheld the privacy complaint from retired police superintendent Martin Gallagher, finding that the Scottish Government failed to comply with UK data protection law after wrongly identifying him as the lead campaigner behind the long-running fight over the McCloud pensions scandal and sharing his identity with other complainants.
The ruling comes amid continuing anger over the pensions fiasco, revealed by The Herald, which left tens of thousands of retired and serving public sector workers waiting years for compensation after an age discrimination ruling that ministers have admitted will not be fully resolved until at least 2027.
Pensioners sent multiple complaints to the First Minister about the handling of the scandal, with one threatening legal action if heads do not roll at the Scottish Government’s pensions agency over the failures to deal properly with the debacle.
But while Mr Swinney was accused of ignoring their concerns by failing to respond to the scandal directly, those delegated to act as a result ended up sharing the details of Martin Gallagher with others, who heads the Job’s Forgotten group seeking police pension remedies. Mr Gallagher says it was an unlawful breach of privacy and the data protection act.
In a decision issued after a formal investigation, the ICO concluded that the Scottish Government had unlawfully processed Mr Gallagher’s personal information when handling correspondence sent to First Minister John Swinney about the pensions crisis.
The regulator said: “Having reviewed the information provided by the Scottish Government, we are satisfied that your personal data was not processed fairly and transparently in this instance. The Scottish Government accepts that you were incorrectly identified as a lead campaigner and that your name was shared with other correspondents without first confirming that this was appropriate.”
It added: “We therefore consider that the Scottish Government did not comply with the requirements of the UK GDPR Data Protection Regulation] when it shared your personal data in this way.”
The ICO investigated after Mr Gallagher complained that people who had independently written to the First Minister about the pensions scandal had instead received responses directing them towards him, despite him never agreeing for his identity to be shared.
Although the watchdog found the handling of his data breached UK GDPR requirements, it decided no further regulatory action was necessary because the Scottish Government had changed its procedures.
The ICO said: “We have also considered the steps the Scottish Government has taken in response to your complaint. It has updated its internal guidance and advised that, in future, it would contact any individual believed to be a lead campaigner before sharing their identity with others.”
It added: “Given the specific circumstances of the case and the action already taken, we do not require the Scottish Government to take any further steps. We have therefore concluded our investigation and will take no further regulatory action.”
The ruling follows an earlier internal Scottish Government investigation which had already partially upheld Mr Gallagher’s complaint and triggered a review of how ministers deal with organised campaigns.
That investigation accepted changes were needed to improve transparency when sharing the identity of private individuals with others writing about the same issue.
A Scottish Government data protection officer said at the time: “The Scottish Government has a lawful basis to process your information by sharing your name with people who write to us at the same time about the same issue. However, I believe we could be more transparent with people in this respect especially if the campaign is led by a private individual.”
The officer also confirmed officials had begun “a data protection review of the process for handling campaigns” to “improve the transparency for people who write to us around the sharing of the name of a lead campaigner”
.Read More:
The Government further said it would “review and update the privacy information” published on its website.
Mr Gallagher had complained after pensioners who contacted the First Minister over the McCloud pension delays received replies referring them to him and stating that Finance Secretary Ivan McKee had already written to him with further information.
One standard response said: “Mr Gallagher has been asked to share the response with retired police colleagues.”
Mr Gallagher argued he had never agreed to become a point of contact for members of the public and said his personal details had been disclosed without his knowledge or consent.
He said in the wake of the ICO ruling: “My experience throughout this sorry business has been awful and is mirrored by hundreds of others. When is someone in a position of authority going to take action?
“The Scottish Government shared my details with individuals without any consultation with me, effectively labelling me as their unpaid post box. “They quite obviously did not want to deal with the genuine grievances of police retirees, and the elected members trying to help them. Their actions were maladministration writ large, and they have been rightly castigated for it.”
The privacy ruling comes against the backdrop of one of the biggest pension correction exercises ever undertaken in Scotland.
The scandal stems from the landmark McCloud judgment handed down in 2018, when judges ruled that changes made to public sector pension schemes in 2015 unlawfully discriminated against younger workers.
The reforms had allowed older staff to remain in more generous legacy pension schemes while forcing many younger workers into new arrangements with different benefits. Judges found the transitional protections amounted to unlawful age discrimination.
As a result, every affected public sector pension scheme across Scotland — including those covering NHS staff, teachers, police officers, firefighters and local government workers — has had to recalculate pensions and provide remedy statements setting out compensation or revised benefits.
The Scottish Public Pensions Agency has responsibility for administering much of that work.
However, the agency has repeatedly failed to meet legal deadlines for issuing remedy statements.
Official figures previously released by the Scottish Government showed that, of around 215,000 people due to receive remedy statements, only about 59,000 had been issued by the statutory deadline of March 31.
The delays have left many pensioners unable to make retirement decisions or receive money they believe they are owed, while compensation costs continue to rise because interest accrues on outstanding payments.
The Scottish Government has previously estimated the overall cost of correcting the discrimination across Scotland’s public sector pension schemes at around £1.7 billion.
The handling of those delays is already the subject of separate complaints being examined by the Pensions Ombudsman.
During First Minister’s Questions last October, Mr Swinney acknowledged the scale of the work still outstanding and confirmed the exercise would not be completed before 2027.
