Summary: Mrs B complained the Council failed to ensure her information, and that of her foster children, was kept confidential. It shared her address with the birth mother who was not allowed contact with the children. This has caused significant distress to the family whose human rights have been affected. The Council has agreed to make a payment for the family to move house and to change its procedures to ensure such data breaches are prevented in the future. It has also agreed to disseminate the learning from this complaint.

The complaint

1. The complainant, whom I will call Mrs B, complains the Council failed to ensure her information and that of her foster children was kept confidential from the children’s birth family. The Council also failed to provide sufficient support after it shared her address with her foster child’s birth family putting them at risk of harm.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word fault to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. If there has been fault which has caused an injustice, we may suggest a remedy. (Local Government Act 1974, sections 26(1) and 26A(1), as amended)
3. We investigate complaints about councils and certain other bodies. Where an individual, organisation or private company is providing services on behalf of a council, we can investigate complaints about the actions of these providers. (Local Government Act 1974, section 25(7), as amended)
4. Under the information sharing agreement between the Local Government and Social Care Ombudsman and the Office for Standards in Education, Children’s Services and Skills (Ofsted), we will share this decision with Ofsted.
5. If we are satisfied with a council’s actions or proposed actions, we can complete our investigation and issue a decision statement. (Local Government Act 1974, section 30(1B) and 34H(i), as amended)

Back to top

How I considered this complaint

6. I considered the information submitted by Mrs B with her complaint and spoke to her on the telephone. I also made enquiries with the Council and assessed its responses. I sent Mrs B and the Council a copy of my draft decision and took the comments they made into account before issuing a decision.

Back to top

What I found

Legislation

The Human Rights Act

7. The Human Rights Act 1998 brought the rights in the European Convention on Human Rights into UK law. Public bodies, including councils, must act in a way to respect and protect human rights. It is unlawful for a public body to act in a way which is incompatible with a human right. ‘Act’ includes a failure to act. (Human Rights Act 1998, section 6) 
8. It is not the Ombudsman’s role to decide whether a person’s human rights have been breached or to say whether a council has acted lawfully. Those decisions are for the courts. Our role is to decide whether there has been fault causing injustice. Where relevant, we consider whether a council has acted in line with its legal obligations in section 6 of the Human Rights Act and we may find fault where the council cannot evidence it has had regard to a person’s human rights or if it cannot justify an interference with a qualified right. 
9. Article 8 of the European Convention on Human Rights says everyone has a right to respect for the private and family life, home and correspondence.

Disabled Facilities Grants

10. The primary legislation is in Part 1 of the Housing Grants, Construction and Regeneration Act 1996 and the Children Act 1989 also applies.
11. A Disabled Facilities Grant (DFG) is awarded by the housing authority to make adaptations to a home which are ‘necessary and appropriate’ to meet the disabled occupant’s needs, where it is ‘reasonable and practicable’ to carry out such adaptations.
12. In the Council, this process was managed by the DFG Team, which was also responsible for identifying a contractor to carry out the work and ensuring the contractor had the necessary information about what was to be done and where the work needed to be carried out.

Background

13. Mrs B has two birth children and two foster children, C and D. C and D were removed from their birth family primarily because of neglect. They have no contact with their birth parents. C has a range of complex needs. The judge, at the time the Care Order was made, commended Mrs B for her commitment to C and D. Some of C’s needs appear to relate to the trauma C experienced when living with the birth family.
14. C’s and D’s birth father has committed criminal offences and is wanted by the police. Critically, he has also stated he is prepared to remove C and D (and his other children who are in care at other locations) from their carers by force. He has removed, or helped to remove, one of C and D’s cousins from care. He is still in a relationship with the children’s birth mother.
15. The threat posed by him was considered so significant that neither he nor the birth mother were given the name or address of Mrs B in court and did not meet Mrs B at any time. While going through court, Mrs B’s house was fitted with a panic button by the police in case he came to their address.
16. C and D are settled in long term foster care with Mrs B having lived with her for a number of years.
17. The complaint arose because Mrs B’s house needed work to make it safe for C given C’s complex needs. The Council engaged a contractor to carry out the necessary work under a Disabled Facilities Grant (DFG).
18. The information the contractor received from the Council gave C’s birth mother as the contact rather than Mrs B. In trying to arrange the work, the contractor said it telephoned C’s birth mother and disclosed Mrs B’s address to her on two occasions.

What happened

19. From the records I have seen, the contractor first revealed C’s and D’s address to their birth mother on 16 October 2019. I have not been provided with any details of the second disclosure.
20. According to the Council, Mrs B was told her address had been disclosed when she chased the contractor for information ‘a few days later’ having not heard anything about arrangements for beginning the work.
21. The contractor reported the disclosure to the Council on 1 November. When the contractor reported what had happened, it said Mrs B had told them she would contact the social worker and the police. The Council has told me the social worker made a referral to the police and the children’s schools on 1 November although, from the evidence, this was because of Mrs B’s contact with the social work team rather than in response to the report by the contractor.
22. Mrs B telephoned the DFG Team at the Council on 6 November requesting a formal complaint be made. A risk assessment was also undertaken on that day. The risk assessment says:
1. No member of the family should open the front door without checking who was there and the front doors should be kept locked;
2. Closed Circuit Television (CCTV) cameras should be considered for protection (these have since been installed);
3. A police marker should be put on their address, in conjunction with the panic alarm, in case birth father came to their address;
4. All members of the family should tell Mrs B if anyone was ‘hanging around the house’ and the local Neighbourhood Watch should be informed;
5. The family should vary their routes to school and to and from other activities; and,
6. They should use a taxi to take D to school rather than walk.
23. The school said D had to be collected separately at home time from the school office instead of leaving with friends. D also had to be accompanied by Mrs B on school trips or was not allowed to go (because Mrs B knew what birth father looked like but the school did not).
24. Mrs B says subsequent advice has included altering any regular routines and to stay away from the city centre where the birth family have been seen (which means they cannot go into the city as a family). She says, although this is not on the risk assessment, that if birth family come to the address the Council has said C and D will be removed from their care.
25. Mrs B telephoned the Council again on 8 November requesting a call back. A Council officer from the DFG Team called her back to say a complaint had been made on 6 November as she had requested.
26. Mrs B says she did not hear anything from the complaints team before 20 November.
27. A data breach form was filled in on 4 December. The Council concluded the incident did not meet the referral criteria for the Information Commissioner as it was a breach with no material effect. The form says the Council had not told any other organisations because it had been informed, by the contractor, Mrs B would be reporting the data breach to the police and social services.
28. The Council responded at Stage One of the complaints process on 3 January 2020. It said:
1. It was ‘correct practice’ for birth mother’s details to be on C’s care records;
2. The contractor only had access to System 1 (which contained the above information) and no access to System 2, where the contact information could have been cross-checked. System 2 was more up-to-date;
3. The DFG Team did not contact Mrs B until 8 November although it knew about the breach on 1 November;
4. Once the complaints team received the complaint (on 6 December) it took until 20 December to identify which department the complaint was about. The complaints team decided it was for Adult Social Care; and,
5. There was a ‘need to amend work practice’ and a ‘need for the directorate to offer a sincere apology’.
29. On 11 February there is a further response from the Council in relation to the data breach saying no further action was necessary.
30. Her Disclosure and Barring (DBS) record shows Mrs B’s address as ‘unsafe’ given birth father is aware of it. This means the family cannot care for any other children. Mrs B says they were due to look after another foster child for a week’s respite but could not do this.

What should have happened?

31. The Council should have checked the information to be shared with the contractor. If it had done so, the disclosure of confidential information would not have taken place.
32. The Council should have given its providers access to System 2, given it was more up-to-date, and it should have provided training to use this well before it did on 14 January 2020. Internal communications I have seen suggest the Council gave contractors the manuals for System 2 rather than commissioning training.
33. The contractor should have alerted the Council to the data breach as soon as possible after the event. It is unclear when it first became aware and when it then told the Council.
34. Once the Council first knew about the data breach – on 1 November – it would have been appropriate for it to contact Mrs B immediately to tell her it was aware and of the action it was going to take. It would also have been appropriate to check police and social care had been informed. The Council initially relied on the contractor’s comment that Mrs B said she would contact the police and social worker rather than check she had done so. It would have been reassuring to Mrs B for the Council to work together rather than, as she saw it, its response being fragmented.
35. It would have been appropriate to fill in the required data breach form on 1 November rather than wait until 4 December even though the breach did not meet the criteria for referral to the Information Commissioner.
36. From the evidence I have, the Council took advice from the police once it became aware of the potential impact of the breach on Mrs B and C and D. This was appropriate given the risks posed by the birth family.
37. Once a formal complaint was made, Mrs B should have been contacted. It is not clear why it took two weeks before her formal complaint was acknowledged by the complaints team. It is also unclear why it was decided the complaint was against Adult Social Care as the person benefitting from the work was C, who is a child.
38. The Council has accepted that the family has been put at risk because of its fault. It has apologised. There is evidence it has considered the human rights implications to them although this does not have the effect of putting them back in the position they would have been but for the fault. This is why Mrs B says she has not been given enough support.

Fault

39. The Council is at fault for failing to ensure information given to a contractor was accurate. The Council’s records gave the contact details for C as C’s birth mother. As a result, the contractor contacted birth mother and disclosed their address, which should have been confidential.
40. The Council is at fault for not telling contractors what action to take if there is a data breach. It should give any necessary training and information to contractors in relation to telling the Council about data breaches in as timely a way as possible.
41. The Council is at fault for failing to ensure the contractor had access to the correct information held in System 2 and the relevant training to enable them to use it.
42. The Council is at fault for failing to alert Mrs B to the data breach as soon as it was aware and in failing to fill in the data breach form in a timely way. It should have been clear it was working holistically for the family’s benefit.
43. The Council is at fault for failing to contact Mrs B once it knew of her formal complaint. It should also have explained to her why it considered the complaint was against Adult Social Care. I understand it was because information about the complaint came from the Adult DFG Team.
44. The Council is at fault for failing to consider the effects on the family’s human rights, specifically Article 8, as a result of its fault. Specifically, how it could put them back to the position they would have been but for the fault.

Injustice

45. Mrs B and her family’s Article 8 Rights were engaged and the Council did not give these due regard; in particular how to put the family back to the position they would have been but for the fault. This has had a significant impact on the family and has caused them distress.
46. Mrs B’s address is identified by the police as being ‘unsafe’ and they cannot be out in the city centre (including as a family), D cannot be walked to or from school or go on school trips without Mrs B. The family is, on the basis of the evidence I have seen, living in fear. Further, if the birth father did come to their address, having to move C, who is already suffering trauma, to new foster carers could not possibly meet C’s emotional needs. To put them back in the situation they would have been but for the fault, the Council should pay a lump sum for expenses that would be incurred by them moving house and offer any practical assistance to facilitate this. It should ensure a bedroom in the new house is altered to meet D’s needs. It should also acknowledge the family’s distress.

Agreed action

47. For the Council to make a payment of £7,000 (based on 2020 figures from Which?, which is a well-known, authoritative and fact-based consumer magazine) to enable the family to move house (this covers moving fees, estate agent fees, basic survey fees, insurance and mail redirection). The Council should make this available to the family within three months of the date of my decision. The Council will also arrange for the works done on D’s existing bedroom to be done in her new bedroom as soon as practicable after the family moves house. It should tell me how it will ensure money can be allocated to facilitate this within three months of the date of my decision.
48. For the Council to make a payment of £500 to acknowledge the family’s significant distress over this time. This is higher than our guidance suggests but the effects were so significant I consider this is justified. This payment should be made within three months of the date of my decision.
49. For the Council to use the learning from this complaint (in relation to contacting people when data breaches are made and promptly reporting those breaches) are disseminated to contractors and officers – through training and education - and to tell me how it will do this within three months of the date of my decision.
50. I asked the Council to tell me how it will keep complainants informed of formal complaints once it receives them. The Council says it will issue acknowledgements to complaints immediately. It should provide me a copy of the relevant internal guidance within a month of my decision.
51. I asked the Council to ensure information that should not be disclosed (the names of parents who do not have contact with children, for example) is clearly marked in the current System 2. It says System 2 is able to have a flag put on records about specific addresses and whether they are disclosable. It should send me the relevant entry for Mrs B’s current address as an example within a month of my decision.
52. I asked the Council to consider human rights implications of its fault and to let me know what action it will take to ensure it has due regard for complainants Human Rights in the future. It should tell me what action it will take within six months of the date of my decision.

Back to top

Final decision

53. Evidence of fault leading to injustice and a remedy has been agreed.

Back to top

Investigator's decision on behalf of the Ombudsman