Summary: We will not investigate Ms X’s complaint about an alleged data breach. This is because the matter is best dealt with by the Information Commissioner’s Office.

The complaint

1. The complainant, whom I shall call Ms X, complains about an unredacted document she received which contained her personal information. The Council denies having sent the document.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended)
3. We normally expect someone to refer the matter to the Information Commissioner’s Office (ICO) if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended
4. The law says we cannot normally investigate a complaint when someone could take the matter to court. However, we may decide to investigate if we consider it would be unreasonable to expect the person to go to court. (Local Government Act 1974, section 26(6)(c), as amended)

Back to top

How I considered this complaint

5. I considered Ms X’s complaint to the Ombudsman and the information she provided. I also gave Ms X the opportunity to comment on a draft statement before reaching a final decision on her complaint.

Back to top

What I found

6. Ms X says she received an unredacted copy of a document containing her personal information. The Council says it did not send Ms X the document. Ms X is therefore worried the Council has wrongly shared her information with third parties. Because of the nature of the information the document contained, Ms X says she has had to install CCTV as she is worried the document was sent maliciously. Ms X wants the Council to say who was provided with copies of the unredacted document and take steps to make sure the same thing cannot happen again. Ms X also wants compensation for distress and the cost of installing CCTV.
7. The ICO is the UK’s independent authority set up to uphold information rights. It promotes openness by public bodies and protects the privacy of individuals. It deals with complaints about public authorities’ failures to comply with data protection legislation. This includes disclosing information in error.
8. There is no charge for making a complaint to the ICO, and its complaints procedure is relatively easy to use. Where someone has a complaint about data protection, the Ombudsman usually expects them to bring the matter to the attention of the ICO. This is because the ICO is in a better position than the Ombudsman to consider such complaints. It has much wider powers than the Ombudsman to take action if it finds a council has failed in its duties as a data controller. Ms X should therefore approach the ICO about her concerns.
9. Also, we cannot determine if compensation should be awarded to Ms X because of the alleged data breach. Only the courts can do this. There is a procedure open to anyone to make a claim in the courts, and it is reasonable to expect Ms X to do this for the compensation she seeks.

Back to top

Final decision

10. We will not investigate Ms X’s complaint. This is because the matter is best dealt with by the Information Commissioner’s Office.

Back to top

Investigator's decision on behalf of the Ombudsman