Summary: We will not investigate Miss X’s complaint about a data breach by the Council which has impacted on Miss X’s mental health. This is because the Information Commissioner’s Office is best placed to deal with this complaint and we cannot achieve the outcome Miss X seeks.

The complaint

1. Miss X complains the Council wrongly shared her personal information with a third party. Miss X says her mental health has been impacted by this.

Back to top

The Ombudsman’s role and powers

2. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
3. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word ‘fault’ to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. We provide a free service, but must use public money carefully. We may decide not to start or continue with an investigation if we believe we cannot achieve the outcome someone wants (Local Government Act 1974, section 24A(6), as amended)
4. The law says we cannot normally investigate a complaint when someone could take the matter to court. However, we may decide to investigate if we consider it would be unreasonable to expect the person to go to court. (Local Government Act 1974, section 26(6)(c), as amended)

Back to top

How I considered this complaint

5. I have considered what Miss X said in her complaint and I have considered the comments she made in response to my draft decision on it.

Back to top

What I found

6. Miss X complains the Council wrongly shared her personal information with a third party. Miss X is unhappy as she does not feel the Council has taken this seriously enough. Miss X feels the Council’s recording and communication processes are not adequate enough and a similar incident may happen again.
7. Miss X wants disciplinary action to be taken against the member of staff responsible for the breach and compensation for the impact this has had on her mental health.

Analysis

8. The Information Commissioner’s Office (ICO) is the UK’s independent authority which deals with data protection issues. It is best placed to deal with the concerns Miss X raises and to ensure the Council has put the correct measures in place.
9. We are not able to become involved in staff discipline at the Council. Nor can we award compensation for damages caused by data breaches as this is a matter for the courts.
10. For these reasons, we will not investigate.

Back to top

Final decision

11. My decision is we will not investigate this complaint. This is because the ICO is best placed to deal with the concerns Miss X raises and we cannot achieve the outcome Miss X seeks.

Back to top

Investigator's decision on behalf of the Ombudsman