Summary: The Ombudsman will not investigate Mr B’s complaint about disclosure of personal data. This is because the Information Commissioner is better placed to consider the matter.

The complaint

1. The complainant, whom I shall call Mr B, complained that the Council wrongly disclosed his and his partner’s personal data to a third party who has used it. Mr B told us this has caused stress, anxiety and inconvenience.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe:

• we cannot achieve the outcome someone wants, or
• there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended)

3. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I have considered the information Mr B provided and given him an opportunity to comment on my draft decision.

Back to top

What I found

5. The Council has apologised to Mr B for its data breach. It told him it has addressed it and taken steps to stop a similar incident occurring. It says it is confident there has been no further data breach.
6. Mr B says the Council has failed to explain how it will address the breach to ensure the third party no longer has any information about him. Also, he says the Council has failed to explain how the third party obtained his partner’s email address.
7. If Mr B considers the Council has failed to fully address his concerns about its handling of his personal data, it is reasonable to expect him to refer the matter to the Information Commissioner (ICO). That is because the ICO is the body with the specific powers and expertise to deal with data protection issues. The ICO can work with people to address their concerns and help organisations to get things right. It is better placed to consider the matter.

Back to top

Final decision

8. The Ombudsman will not investigate this complaint. This is because the Information Commissioner is better placed to consider the matter.

Investigator’s final decision on behalf of the Ombudsman

Back to top

Investigator's decision on behalf of the Ombudsman