Item 4: Assurance Reporting

4.1 ICO AUDIT OF POLICE SCOTLAND – RECOMMENDATION ACTION TRACKER
Members considered the report which provided a summary of current work undertaken within the Police Scotland Change Portfolio progress update of activity undertaken in respect of ICO Audit Recommendation Action plan for Governance and Accountability and Personal Data Breach audit strands. DCCSpeirs introduced the report and Kerry Harvey (KHarvey) thereafter highlighted a number of key points within the report.

In discussion the following matters were raised:
• Members were assured ICO were content with the actions and timelines proposed, and in March they would review progress and evidence in addressing the high risks.
• Members were assured that all recommendations should be concluded by September, however if there was any change, both ICO and SPA would be provided with advance notification.
• Members sought detail on the role of the Resource Maximisation Group and heard it was a newly formed People Board which studies resource movement within the organisation.

The Committee RESOLVED to:
• NOTE the report.

4.2 ICO AUDIT OF POLICE SCOTLAND – MOBILE PHONE DATA EXTRACTION PROJECT – REVIEW REPORT
Members considered the report which provided an initial update following a review of Police Scotland’s mobile phone data extraction processing activities. DCCSpeirs introduced the report and KHarvey highlighted a number of key points within the report.

In discussion the following matters were raised:
• Members questioned why the Terms of Reference for the project had been kept confidential, and heard the review was at the request of the National Police Chief’s Council and participants would remain anonymous. However, Police Scotland took the view there was nothing contentious so were happy to be open and transparent about their participation.
• Members were assured Police Scotland were confident that recommendations could be delivered within the timescales. Progress is reviewed monthly and escalated if necessary.
• KHarvey agreed to keep the Committee abreast of progress.

The Committee RESOLVED to:
• NOTE the report.
• AGREE the following action:
Committee to receive briefing over progress to deliver recommendations. 20240206-AUD-002

4.3 HMICS INSPECTION – SPA VALIDATED SELF-ASSESSMENT UPDATE
Members considered the report which provided an update on the SPA Validated Self-Assessment being conducted by HMICS. The Chief Executive highlighted a number of key points within the report.

The Committee RESOLVED to:
• NOTE the report.