Summary: The Ombudsman will not investigate Mrs X’s complaint about an alleged data breach by the Council. This is because the Information Commissioner’s Office is the appropriate body to consider her concerns.

The complaint

1. The complainant, whom I shall call Mrs X, complains the Council wrongly disclosed her email address to other members of the public when it sent an email.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider the complaint. (Local Government Act 1974, section 24A(6), as amended)
3. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered Mrs X’s complaint to the Ombudsman and her correspondence with the Council. I gave Mrs X the opportunity to comment on my draft decision and considered her response.

Back to top

What I found

5. In February 2018, the Council sent an email to five members of the public, including Mrs X, who subscribe to its green waste service. Because of the way the Council sent the message, it was possible to see the email addresses of the people the Council had emailed. Mrs X complained to the Council and it accepted its mistake. It apologised and said it would be pursuing the matter with the team responsible for the email. Unhappy with the Council’s response, Mrs X complained to the Ombudsman.
6. The Information Commissioner’s Office (ICO) has been given a specific remit to investigate complaints about alleged breaches of the Data Protection Act (‘the DPA’). It has powers to take enforcement action if a breach is found. There is no charge for making a complaint to the ICO, and its complaints procedure is relatively easy to use. Parliament set up the ICO to oversee the DPA. Where someone has a complaint about these issues, the Ombudsman usually expects them to bring the matter to the attention of the ICO.
7. The Ombudsman does have discretion to consider Mrs X’s complaint, but I will not exercise that discretion. This is because the ICO is in the best position to consider her complaint. It can decide if the Council has complied with its duties as a data controller. It can take action against the Council if considered appropriate – this includes issuing a fine. The Ombudsman has no such powers.

Back to top

Final decision

8. The Ombudsman will not investigate Mrs X’s complaint. This is because the Information Commissioner’s Office is the appropriate body to consider her concerns.

Back to top

Investigator's decision on behalf of the Ombudsman