Summary: We uphold Mrs Y’s complaint, as the Council breached data protection obligations about Mrs Y’s child. The Council has agreed to pay £200 to Mrs Y to recognise the emotional impact of the fault.

The complaint

1. Mrs Y complains the Council sent an unauthorised third party a supplementary bundle containing sensitive information about her child, including medical records in July 2021.
2. Mrs Y says this caused her significant distress given the highly sensitive information contained within the documentation. She also says it was distressing that the information had been sent to a former advocate for the family, who had been removed from acting for the family after a falling out over the representation for her child.

Back to top

The Ombudsman’s role and powers

3. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word fault to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. If there has been fault which has caused an injustice, we may suggest a remedy. (Local Government Act 1974, sections 26(1) and 26A(1), as amended)

Back to top

How I considered this complaint

4. I considered information provided by the complainant and the Council.
5. I considered the Ombudsman’s Assessment Code.
6. Mrs Y had an opportunity to comment on my draft decision. I considered any comments received before making a final decision.

Back to top

My assessment

What happened

7. The Council sent an unauthorised third party a supplementary bundle containing sensitive information about Mrs Y’s child, including medical records, in July 2021. The third party had previously acted as an advocate for the family, but Mrs Y had removed consent for information to be shared following a disagreement over the representation for her child.
8. The third party made Mrs Y aware of the Council’s email which had provided them with the information in July. Mrs Y emailed the Council the same day, expressing her upset and hurt in a complaint. She complained again to the Council in September 2021 and referred the complaint to the Information Commissioner’s Office (ICO).
9. The ICO investigated Mrs Y’s complaint and found the Council had failed to comply with its data protection obligations. It asked the Council to take steps to try to prevent a recurrence of the problem in its decision in December 2021.
10. While the ICO decision addressed the wider public interest issues arising from the complaint, it was not able to remedy the injustice caused to Mrs Y personally. The ICO suggested Mrs Y contact us or seek independent legal advice if she wanted to seek a remedy for the upset and worry, she had suffered. Mrs Y then approached us in January 2022.

Analysis

11. The ICO found the Council had failed to comply with its data protection obligations when it sent information about Mrs Y’s child to a third party. An investigation is likely to find the Council’s failure was fault.
12. Mrs Y is autistic and has a disabled child. Her child, who was the subject of the information, has a history of mental health difficulties, including suicidal ideation. This information was included in the documents supplied to the unauthorised third party and is highly sensitive in nature.
13. The Council’s fault therefore caused significant distress and worry to Mrs Y in particularly because of the nature of the information wrongly disclosed.

Back to top

Agreed action

14. The Council has agreed within one month of the date of my final decision to pay Mrs Y £200 to recognise the emotional impact caused by its breach of data protection obligations.

Back to top

Final decision

15. We found the Council at fault for breaching its data protection obligations and the Council has agreed to Mrs Y £200 to recognise the upset and worry caused as a result.

Back to top

Investigator's decision on behalf of the Ombudsman