Summary: We will not investigate Ms X’s complaint about a data breach. This is because the Information Commissioner’s Office is better placed than us to investigate her complaint, and we have seen no good reason why we should investigate it instead.

The complaint

1. Ms X complained the Council wrongly disclosed sensitive information about her daughter to a third party. She said this information was then shared with her daughter’s friends.
2. She said the data breach caused distress to her daughter and it ruined their trust in professionals. Ms X said the Council should explain what happened and ensure the data breach does not happen again.

Back to top

The Ombudsman’s role and powers

3. The Local Government Act 1974 sets out our powers but also imposes restrictions on what we can investigate.
4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

5. I considered information provided by Ms X and the Council.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. We will not investigate Ms X’s complaint because the Information Commissioner’s Office (ICO) is better placed than us to investigate the data breach. We have also seen no good reason why we should investigate instead of the ICO.
8. We note the Council told Ms X it has referred her case to the ICO. The ICO can take enforcement action against the Council as a data controller.

Back to top

Final decision

9. We will not investigate Ms X’s complaint because the ICO is better placed than us to investigate her complaint, and we have seen no good reason why we should investigate instead.

Back to top

Investigator's decision on behalf of the Ombudsman