Summary: We will not investigate Ms X’s complaint about a data breach by the Council because the Information Commissioner’s Office is better placed to deal with that complaint. We will not investigate the complaint about the steps the Council took after the data breach was identified because we could not add to the Council’s investigation.

The complaint

1. Ms X complained about a data breach by the Council, which wrongly shared her personal information with the perpetrator of domestic abuse. Ms X said this put her and her son at increased risk of abuse. Ms X says the steps the Council took after the data breach was identified, are not sufficient to guarantee her safety. She is seeking significant compensation.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service but must use public money carefully. We do not start or continue an investigation if we decide:

• we could not add to any previous investigation by the organisation, or
• we cannot achieve the outcome someone wants, or
• there is another body better placed to consider this complaint.

(Local Government Act 1974, section 24A(6), as amended, section 34(B))

Back to top

How I considered this complaint

3. I considered information provided by Ms X.
4. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

5. The Council accepted it shared Ms X’s personal information inappropriately and acknowledged the risks to her and her child. The Council apologised and offered Ms X £1,000 for the injustice caused. It took a number of steps to address the increased risk, including ensuring a police panic alarm and flag were in place, allocating a social worker to carry out an assessment of the risks, recommending she seeks independent legal advice and referring her to another organisation that could support her. It also explained the action it was taking to prevent further data breaches in future.

Data breach

6. We will not investigate the complaint about the data breach. The Information Commissioner's Office considers complaints about data protection. This is because the Information Commissioner’s Office (ICO) is better placed to consider that complaint.
7. Since the ICO cannot award compensation for data breaches, we cannot recommend a council makes a payment where a data breach occurs, nor comment on the payment the Council has offered in this case. It was appropriate for the Council to recommend Ms X seek independent legal advice about the legal options open to her.

Actions taken by the Council following the data breach

8. In its complaint response, the Council set out the steps it was taking to address the risks, including carrying out an assessment of the risks for Ms X and her child. It has also set out the steps it has taken to prevent a recurrence of the data breach. The Council has taken the action we would expect following the data breach; further investigation by us would not lead to a different outcome. Therefore, we will not consider this part of the complaint further.

Back to top

Final decision

9. We will not investigate Ms X’s complaint about the data breach because the Information Commissioner’s Office is better placed to address that. We will not investigate the actions the Council took after the data breach was identified because it is unlikely further investigation would lead to a different outcome.

Back to top

Investigator's decision on behalf of the Ombudsman