Summary: The Ombudsman will not investigate Mr X’s complaint about an alleged data breach by the Council. This is because the Information Commissioner’s Office is the appropriate body to consider Mr X’s concerns if he is unhappy with the outcome of the Council’s investigation.

The complaint

1. The complainant, whom I shall call Mr X, complains the Council wrongly shared his personal information with a debt recovery company.

Back to top

The Ombudsman’s role and powers

2. The Ombudsman investigates complaints when we are satisfied the Council has had notice of the complaint and a reasonable opportunity to investigate. (Local Government Act 1974, section 26(5)
3. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider the complaint. (Local Government Act 1974, section 24A(6), as amended)
4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

5. I considered Mr X’s complaint to the Ombudsman and his correspondence with the Council. I gave Mr X the opportunity to comment on my draft decision and considered his responses.

Back to top

What I found

6. Mr X complains the Council wrongly shared his personal information with a debt recovery company. The Council instructed the firm to recover a council tax debt from Mr X.
7. The law says that before investigating a complaint, we must be satisfied the Council has had an opportunity to investigate and reply. I do not believe that to be the case here. The Council has said it will respond to Mr X’s complaint and has written to him to confirm this.
8. The Data Protection Act 1998 (DPA) sets out data handling principles. It sets out the circumstances in which public bodies can share personal information. The Information Commissioner’s Office (ICO) has been given a specific remit to investigate complaints about alleged breaches of the DPA. It has powers to take enforcement action if a breach is found. There is no charge for making a complaint to the ICO, and its complaints procedure is relatively easy to use. Where someone has a complaint about data protection, the Ombudsman usually expects them to bring the matter to the attention of the ICO.
9. If Mr X is unhappy with the Council’s response to his complaint, I consider the ICO to be in a better position than the Ombudsman to deal with his concerns. This is because it can decide if the Council has complied with its duties as a data controller. It can decide if the Council has disclosed information it should not have done. If it finds there has been a breach of the DPA, it can take action against the Council. The Ombudsman has no such powers.

Back to top

Final decision

10. The Ombudsman will not investigate Mr X’s complaint. This is because the ICO is the appropriate body to consider his concerns if he is unhappy with the Council’s response to his complaint.

Back to top

Investigator's decision on behalf of the Ombudsman