Decision : Closed after initial enquiries
Decision date : 20 Mar 2019
The Ombudsman's final decision:
Summary: Mr X complains on behalf of his granddaughter, Z, that the Council breached data protection regulations by sending her Child in Need plan to the wrong family member. He says this caused Z injustice because it breached her personal data. He also complains that the Council handled his complaint about the data breach poorly, and that he has spent time and trouble dealing with this. The Ombudsman will not investigate Mr X’s complaint because he has already complained to the Information Commissioner’s Office, which is better placed to deal with complaints of this nature. It is not a good use of public money to investigate complaint handling where we do not investigate the main issue complained about.
- The complainant, who I refer to here as Mr X, complains on behalf of his granddaughter, Z (a child). He says that:
- the Council breached data protection regulations by sending Z’s Child in Need plan to a different family member (not a parent);
- the Council failed to meet its legal obligations because it did not report the breach to the Information Commissioner’s Office (ICO), then filed an inaccurate report to the ICO, and refused to correct it;
- the Council failed to recognise Z as a victim, did not contact her parents to notify them of the breach, and did not apologise to Z; and,
- the Council handled the complaint poorly.
The Ombudsman’s role and powers
- We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended)
- We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
- We may investigate complaints made on behalf of someone else if they have given their consent. (Local Government Act 1974, section 26A(1), as amended)
How I considered this complaint
- Z’s father gave written consent for Mr X to represent Z’s complaint on her behalf.
- I considered the information and documents provided by Mr X and the Council. I have also considered the Information Commissioner’s Office’s response to the Council about the data breach.
- Mr X and the Council had an opportunity to comment on an earlier draft of this statement. I considered all comments before I reached a final decision.
What I found
- Mr X’s granddaughter, Z, was made subject to a Child in Need plan. In February 2018, the Council sent a copy of Z’s Child in Need plan to her cousin, C (also a child). C’s mother, Ms B, opened the envelope and saw the Child in Need plan.
- The next day, family members called Z’s social worker and reported the data breach.
- In April, Mr X complained to the Council. This went through the Council’s three stage complaints procedure. The Council upheld his complaint. Mr X told the Council he had made a formal complaint to the Information Commissioner’s Office.
- In September, the Information Commissioner’s Office (ICO) sent the Council its response to the data breach. The ICO said there was no further action necessary. It was satisfied with the Council’s actions at the time and since the breach. The ICO said it considered the matter closed.
- In November, Mr X contacted the ICO about his ongoing complaint.
- I will not investigate parts a, b and c of Mr X’s complaint, about the Council’s handling of the data breach. This is because it has already been considered by the appropriate body, the ICO. The ICO’s role is to not only look at why a data breach happened but also how a council handled it and about councils’ policies about data breaches.
- The ICO has already dealt with the data breach from the Council’s side. Mr X has complained to the ICO about this matter, and his complaint with the ICO is ongoing.
- I will not investigate part d of Mr X’s complaint, about complaint handling. It is not a good use of public resources to investigate complaints about complaint procedures if we are unable to deal with the substantive issue.
- I have closed this investigation for the reasons given above (paragraphs 14 to 16).
Investigator's decision on behalf of the Ombudsman