Summary: I have discontinued my investigation into a data breach by the Council to a school. The Council has investigated, found fault, apologised and made service improvements to prevent a recurrence. There is no further worthwhile outcome the Ombudsman can achieve.

The complaint

1. Mr X complains the Council shared information he sent it about a school, with the school concerned, without his permission.
2. Mr X says the data breach adversely affected a complaint meeting with the Governors, that happened after the data breach, and his relationship with the school.

Back to top

The Ombudsman’s role and powers

3. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word fault to refer to these. We provide a free service but must use public money carefully. We may decide not to start or continue with an investigation if we decide:

• any fault has not caused injustice to the person who complained; or
• we could not add to any previous investigation by the organisation; or
• further investigation would not lead to a different outcome; or
• there is another body better placed to consider this complaint; or
• there is no worthwhile outcome achievable by our investigation.
  (Local Government Act 1974, section 24A(6), as amended, section 34(B))

4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

5. I considered evidence provided by Mr X and the Council as well as relevant law, policy and guidance.
6. Mr X and the Council have an opportunity to comment on my draft decision. I considered any comments before making a final decision.

Back to top

What I found

7. Mr X sent a timeline of events about a school his child had attended to the Council, this included information about a member of school staff. The Council shared this information with the school concerned.
8. Mr X says he only found out the information had been shared when he made a subject access request to the school. Mr X then complained to the Council. Mr X says the timing of the data breach coincided with a change in the school’s attitude to him and his family. He also says it meant the school had notice of information before a stage two complaints meeting with Governors which he had intended to keep private.
9. The Council has investigated Mr X’s complaint and upheld it did commit a data breach.
10. The Council has apologised. It says it followed procedures when a data breach is identified. I have seen that an information security form was completed once Mr X alerted the Council to the breach. The Council said the matter was discussed within the team to emphasise the risks and seriousness of such breaches and to refresh staff training.

Back to top

Decision

11. I have discontinued my investigation. The actions of an apology and refresher training are the same outcomes we would have recommended. There is no further worthwhile outcome we can achieve.

Back to top

Investigator's decision on behalf of the Ombudsman