Summary: Miss X and Mr Y complain about the Council’s response to a data breach. We do not find fault in the way the Council reported the breach. However, we find it failed to adequately follow up Miss X and Mr Y’s concerns. The Council should apologise for the avoidable distress caused to Miss X and Mr Y and review whether any further action is necessary to support them. It should also make a symbolic payment of £250 to Miss X and Mr Y in recognition of the injustice caused and refund the costs of a security doorbell installed by Miss X.

The complaint

1. Miss X complains on behalf of herself and her partner (Mr Y) about a Council data breach of Miss X’s home address to Mr Y’s ex-partner (Ms Z).
2. Miss X says the date breach put the family’s safety at risk as Ms Z sent unwanted parcels to their address. Miss X says they remained anxious about Ms Z attending their home and misusing their personal details.
3. Miss Y wants the Council to assist the family to move to a new address and apply for a non-molestation order against Ms Z.

Back to top

The Ombudsman’s role and powers

4. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word fault to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. If there has been fault which has caused significant injustice, or that could cause injustice to others in future we may suggest a remedy. (Local Government Act 1974, sections 26(1) and 26A(1), as amended)
5. If we are satisfied with an organisation’s actions or proposed actions, we can complete our investigation and issue a decision statement. (Local Government Act 1974, section 30(1B) and 34H(i), as amended)

Back to top

How I considered this complaint

6. I considered information provided by Miss X and spoke to her about the complaint. I also considered information provided by the Council.
7. Miss X and the Council had an opportunity to comment on my draft decision. I considered their comments before reaching a final decision.

Back to top

What I found

8. Mr Y was in court proceedings with Ms Z about their child (‘Child N’). Miss X offered her home address as a safe place for Mr Y and Child N. Miss X’s child also lives at the property.
9. The available evidence says a Council officer shared a copy of Child N’s family assessment with Ms Z, without redacting Miss X’s address, which was supposed to remain confidential.
10. Miss X said she and Mr Y remained very anxious after the breach. They believed Ms Z would attend their home, harm Mr Y, and misuse their personal details.
11. On 17 April 2023, Miss X complained to the Council about the issues she has raised with us.
12. On 21 April, the Council called Miss X to better understand her concerns. It sent a written response on the same date, in which it advised:
• Miss X of the cause of the data breach. It also said it would provide the officer involved with a reminder to prevent recurrence.
• Mr Y could report any on-going concerns to the police. It also sign-posted Miss X to domestic abuse support charities.
• Mr Y could apply for a non-molestation order as part of the substantive court proceedings and consider using safeguarding applications and alarm devices.
• It would be willing to provide Mr Y with supporting evidence if he registered for social housing.
13. Miss X explained they did not pursue the complaint further or apply for compensation because the Council had referred them to third party agencies.
14. The available evidence indicates the Council reported the data breach to the Information Commissioners office (‘ICO’) on 5 May.
15. The ICO’s investigation outcome dated 16 May, confirms no further action was taken against the Council as the data breach was an isolated incident. However, it recommended the Council:
• Continue to support those affected by the data breach with suitable advice, guidance, signposting and assist with any financial, legal, or professional burdens caused by the incident.
• Continuing to monitor the situation to determine whether any safeguarding or law enforcement bodies need to be informed of the incident to protect the affected individuals from any bodily, emotional, or financial harm.
16. Miss X said she only received one telephone call from the Council after the complaint response. She said an officer advised her to seek financial help from a domestic abuse charity and nothing further.
17. Unhappy with the Council’s response, Miss X approached the Ombudsman.
18. Miss X said Ms Z has subsequently:
• Sent parcels containing gifts for Child N to her home address. She explained the parcels were delivered late at night and caused the family distress.
• Contacted Child N’s GP and changed her contact and home address details.
19. Miss X said she had to install a ring-doorbell as an additional security measure, but she and Mr Y remain distressed about their situation.
20. The Council has explained it supported Miss X and Mr Y by providing access to online conflict resolution services. It said their alleged fear of harassment by Ms Z, was also explored as part of a child protection investigation but found to be unsubstantiated. However, it accepted the data breach would have continued to cause Miss X and Mr Y anxiety, despite these findings.

Back to top

Analysis

21. The evidence shows the Council promptly responded to Miss X’s complaint about the data breach. It telephoned Miss X to discuss the situation and apologised for the error. It subsequently confirmed its advice in writing as set out at paragraph 12 (above). The available evidence shows the Council also referred itself to the ICO after Miss X’s complaint. The ICO confirmed it was satisfied with the Council’s initial response and closed its investigation. I do not find fault in the Council’s reporting of the data breach and response up to this point.
22. However, the ICO also recommended the Council continue supporting Miss X and Mr Y (paragraph 15). The Council has confirmed its further action at paragraph 20 (above). However, Miss X and Mr Y were not reassured by these measures and still had concerns about their personal safety. In my view, the Council should have followed up their concerns in more detail and maintained better communication. The Council’s failure to do so, is fault and inconsistent with the spirit of the ICO’s recommendations. Miss X and Mr Y therefore felt they could not approach the Council for help and experienced avoidable distress and uncertainty when Ms Z took the further action mentioned at paragraph 18 (above). Miss X also went to personal expense to purchase and install a ring-door bell for additional security.

Back to top

Agreed action

23. Within a month of our final decision statement, the Council should:
1. Write to Miss X and Mr Y and apologise for its failure to monitor the continued impact of the data breach on them and their family and any distress caused.
2. Review whether any further action is necessary to support to Miss X and Mr Y to address the on-going impact of the data breach on their personal circumstances.
3. Make a symbolic payment of £250 to Miss X and Mr Y for the avoidable distress caused.
4. Refund Miss X’s costs of purchasing and installing the ring-door bell.
24. The Council should provide us with evidence it has complied with the above actions.

Back to top

Final decision

25. I find fault which caused injustice. I have made recommendations to address the injustice.
26. I have completed my investigation.

Back to top

Investigator's decision on behalf of the Ombudsman