Summary: We will not investigate Mr X’s complaint about data protection issues. This is because the Information Commissioner’s Office is better placed to consider Mr X’s concerns.

The complaint

1. The complainant, whom I shall refer to as Mr X, complained the Council wrongly shared his personal information with a third party. Mr X also complained the Council sent him confidential information using an unsecure method.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start or continue an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
3. We normally expect someone to refer the matter to the Information Commissioner’s Office (ICO) if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered information provided by the complainant.
5. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

6. We will not start an investigation.
7. The issues at the heart of Mr X’s complaint relate to data protection and the Council’s handling of personal information. Such matters are best considered by the ICO. It is the UK’s independent authority set up to uphold information rights. It promotes openness by public bodies and protects the privacy of individuals. It deals with complaints about public authorities’ failures to comply with data protection legislation. This includes disclosing information in error and issues with data handling.
8. There is no charge for making a complaint to the ICO, and its complaints procedure is relatively easy to use. Where someone has a complaint about data protection, the Ombudsman usually expects them to bring the matter to the attention of the ICO. This is because the ICO is in a better position than the Ombudsman to consider such complaints. The ICO can decide if a Council has failed in its duties as a data controller and can impose a range of sanctions. The Ombudsman has no such powers. Mr X should therefore approach the ICO about his concerns.

Back to top

Final decision

9. We will not investigate because the ICO is the appropriate body to consider Mr X’s complaint.

Back to top

Investigator's decision on behalf of the Ombudsman