Summary: The Ombudsman will not investigate Mr X and Miss X’s complaint about alleged data breaches involving information about their family. This is because the Information Commissioner’s Office is the appropriate body to consider their concerns.

The complaint

1. The complainants, whom I shall call Mr X and Miss X, complain the Council wrongly shared information about their family on two separate occasions.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended)
3. We normally expect someone to refer the matter to the Information Commissioner’s Office (ICO) if they have a complaint about data protection, including disclosing information in error, and the accuracy of information held. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered Mr X and Miss X’s complaint to the Ombudsman and the information they provided. I also gave them the opportunity to comment on a draft statement before reaching a final decision on their complaint

Back to top

What I found

5. Mr X and Miss X complain the Council wrongly disclosed information about their family on two separate occasions. The evidence I have seen shows the Council has accepted there have been two data breaches. Mr X and Miss X are also concerned about the accuracy of information held by the Council. They say the Council’s records do not show all its contact with their family.
6. The issue at the heart of this complaint is data protection. The ICO is the UK’s independent authority set up to uphold information rights. It promotes openness by public bodies and protects the privacy of individuals. It deals with complaints about public authorities’ failures to comply with data protection legislation. This includes disclosing information in error.
7. Where someone has a complaint about data breaches involving their personal information, the Ombudsman usually expects them to bring the matter to the attention of the ICO. This is because the ICO is in a better position than the Ombudsman to consider such complaints. The ICO has far wider powers than the Ombudsman if it finds a council has failed in its duties as a data controller. It can issue enforcement notices and fines. The Ombudsman has no such powers. The ICO is an expert, independent body, set up by Parliament to consider complaints like this. Mr X and Miss X should therefore contact the ICO because it is the appropriate body to deal with their concerns.
8. If Mr X and Miss X are concerned the Council hold’s inaccurate information about their family, they can ask the Council to amend its records. If they are unhappy with the Council’s response, then as above, they should contact the ICO.

Back to top

Final decision

9. The Ombudsman will not investigate Mr X and Miss X’s complaint. This is because the Information Commissioner’s Office is the appropriate body to consider their concerns.

Back to top

Investigator's decision on behalf of the Ombudsman