Summary: We will not investigate this complaint about a data breach. This is because there is insufficient evidence of injustice. In addition, the Council has provided a fair response.

The complaint

1. The complainant, whom I refer to as Mrs X, wants compensation because the Council lost her documents.

Back to top

The Ombudsman’s role and powers

2. The Ombudsman investigates complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start an investigation if we decide:

• any fault has not caused injustice to the person who complained, or
• any injustice is not significant enough to justify our involvement, or
• the Council has provided a fair response.

(Local Government Act 1974, section 24A(6))

Back to top

How I considered this complaint

3. I considered information provided by Mrs X and the Council. I also considered our Assessment Code and comments Mrs X made in reply to a draft of this decision.

Back to top

My assessment

4. In November 2020 Mrs X handed in documents at the library to support her Blue Badge application. This included her name, address, National Insurance number, driving licence and utility bill. The Council says it photocopied the documents and handed the originals back to Mrs X. It sent the copies to the Mobility Team via the internal post. The Mobility Team did not receive the documents. Mrs X says the Council did not return the documents to her.
5. Mrs X resubmitted her application in January and the Council awarded the badge in mid-January.
6. Mrs X complained. The Council apologised and accepted there had been a data breach. It said the risk associated with the breach was low because only Council staff would have had access to the documents. It said it did not know what had happened to the documents. The Council changed its procedures so that documents are now sent electronically.
7. Mrs X complained to the Information Commissioner (ICO). The ICO found the Council had not complied with its data obligations because it misplaced some personal data. The ICO said the data would not have been disclosed to anyone outside the Council and it was satisfied with the steps the Council had taken to stop the problem happening again. The ICO did not require the Council to take any further action but criticised the Council for a delay in reporting the data breach.
8. Mrs X says the Council should have awarded compensation to reflect her time and trouble in having to resubmit her application, and because the data breach caused distress, anxiety and upset. She says she had no access to free parking and had to pay the congestion charge while waiting for the badge.
9. I will not start an investigation because there is insufficient evidence of injustice. I appreciate the data breach would have caused some upset and inconvenience. However, more than two years have past and Mrs X has not indicated there have been any negative consequences flowing from data breach. The ICO is satisfied with the corrective action the Council took.
10. I appreciate Mrs X was put to time some and trouble in having to resubmit her application but this is not a level of injustice requiring an investigation. And, even if we started an investigation, it is unlikely we could resolve Mrs X’s dispute that the Council did not return the documents to her. But, if the documents were not returned, the cost of a replacement driving licence is not sufficient to warrant an investigation.
11. I considered Mrs X’s point that she was without access to free parking while her application was being considered. The Council told me that, at that point, it was taking nine to ten weeks to process applications. It is likely Mrs X would not have received her badge until mid-January even if the data breach had not occurred so, again, there is insufficient evidence of injustice.
12. I also will not investigate the complaint because the Council has already taken appropriate action by changing its procedures.

Back to top

Final decision

13. We will not investigate this complaint because there is insufficient evidence of injustice and because the Council has provided a fair response.

Back to top

Investigator's decision on behalf of the Ombudsman