Kent County Council (21 012 987)
Category : Other Categories > Other
Decision : Closed after initial enquiries
Decision date : 01 Dec 2021
The Ombudsman's final decision:
Summary: Mrs X complains about a serious data breach by the Council resulting in personal data and medical info being sent to the wrong address. We will not investigate this complaint. This is because it is reasonable for Mr X to complain to the Information Commissioner’s Office as the specialist body to deal with data protection issues.
The complaint
- Mrs X complains about a serious data breach by the Council resulting in personal data and medical info being sent to the wrong address. Mrs X says this may be linked to a third party committing a possible offence using the lost information.
- Mrs X wants a full investigation in to how the data breach was allowed to happen.
The Ombudsman’s role and powers
- We investigate complaints about ‘maladministration’ and ‘service failure’. We provide a free service but must use public money carefully. We may decide not to start or continue with an investigation if we believe there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A (6), as amended)
How I considered this complaint
- I considered information provided by the complainant.
- I considered the Ombudsman’s Assessment Code.
My assessment
- We will not investigate this complaint. This is because it is reasonable for Mrs X to refer the matter to the Information Commissioner’s Office (ICO). The ICO is the body with specific powers and expertise to investigate the Council’s information handling practices and achieve Mrs X’s desired outcomes.
- The Information Commissioner’s Officer has powers - which the Ombudsman does not - to require compliance with the Freedom of Information Act, Environmental Information Regulations and the UK General Data Protection Regulations, tailored by the Data Protection Act 2018. It can consider whether the Council has responded in line with its information rights obligations.
Final decision
- I will not investigate this complaint. It is reasonable for Mrs X to complain to the office of the Information Commissioner which is the most suitable body to consider the breach of data.
Investigator's decision on behalf of the Ombudsman