Casework records are produced and maintained to enable the Local Government and Social Care Ombudsman to carry out statutory functions. The Ombudsman is responsible for casework records but, for the purposes of the UK General Data Protection Regulation (“GDPR”) and Data Protection Act 2018 (“DPA18”), the organisation is the designated data controller of these records. The majority of material held on casework files will constitute the personal data of the complainant.

Casework records must be maintained in accordance with the six data protection principles, in particular:

• they should be secure (see the Information security policy (principle 6)
• we should not keep irrelevant or excessive material we do not need (principle 3), and
• records should not be kept longer than necessary (principle 5) – by adhering to this policy.

This document covers records held both electronically and in paper-based storage systems. ECHO contains the primary records.

Staff should be familiar with the guidance in the Policy on access to information which covers dealing with requests under UK GDPR, DPA, the Freedom of Information Act (“FOIA”) and the Environmental Information Regulations (“EIR”), including requirements for storing on ECHO to facilitate request handling.

There are different retention periods for case file material, ECHO screens and final decisions. The reason for ‘processing’ complainants’ personal data changes once the complaint has been decided. Our justification for retention becomes less strong over time; it relates initially to dealing with post-decision reviews (PDRs)/legal action then moves on to any subsequent complaints from the individual that might be on the same subject or give useful background on the complainant. Five years is a reasonable retention period to provide useful information if the complainant should complain again, but beyond that period it becomes less likely the data will still be up-to-date. A separate complaint casework retention schedule sets out the retention times in detail.

The Information Asset Owner (“IAO”) for all ECHO records and hard copy casework material is the Director of Investigation, but responsibility is delegated to Assistant Ombudsmen and other senior staff at the different stages of complaint investigation. These delegated IAOs are indicated in the separate complaint casework retention schedule which summarises the retention requirements set out in this policy. 2.