Summary: The Ombudsman will not investigate Mr X’s complaint about an alleged data breach by the Council. This is because the Information Commissioner’s Office is the appropriate body to consider his concerns.

The complaint

1. The complainant, whom I shall call Mr X, complains about an alleged data breach by the Council.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider the complaint. (Local Government Act 1974, section 24A(6), as amended)
3. We normally expect someone to refer the matter to the Information Commissioner’s Office (ICO) if they have a complaint about data protection – this includes wrongly disclosing information. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered Mr X’s complaint to the Ombudsman and the information he provided. I also gave Mr X the opportunity to comment on a draft statement before reaching a final decision on his complaint.

Back to top

What I found

5. Mr X says he received an email from the Council containing his own personal data, as well as information about other people. Mr X reported the issue to the Council, but is not happy with its response.
6. The ICO is the UK’s independent authority set up to uphold information rights. It deals with complaints about public authorities’ failures to comply with data protection legislation. This includes wrongly disclosing personal information.
7. There is no charge for making a complaint to the ICO, and its complaints procedure is relatively easy to use. Where someone has a complaint about data protection, the Ombudsman usually expects them to bring the matter to the attention of the ICO. This is because the ICO is in a better position than the Ombudsman to consider such complaints. It has much wider powers than the Ombudsman to take action against Councils that breach data protection legislation. An investigation by the Ombudsman is not therefore appropriate. Mr X should instead raise his concerns with the ICO.

Back to top

Final decision

8. The Ombudsman will not investigate Mr X’s complaint. This is because the Information Commissioner’s Office is the appropriate body to consider his concerns.

Back to top

Investigator's decision on behalf of the Ombudsman