Summary: We will not investigate this complaint about the Council breaching Ms X’s personal data by sharing it with a third party. This is because there is no worthwhile outcome achievable by us investigating.

The complaint

1. Ms X said the Council breached her personal data under the general data protection regulation (GDPR) when it sent information about her, to another organisation, when it should not have. Ms X also said the Council did not properly deal with this data breach in line with policy.
2. Mrs X said she wants the Council to pay her compensation because of the impact on her mental health and discipline the relevant staff.

Back to top

The Ombudsman’s role and powers

3. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service but must use public money carefully. We do not start or continue an investigation if we decide we cannot achieve the outcome someone wants, and where there is no worthwhile outcome achievable by our investigation.(Local Government Act 1974, section 24A(6), as amended, section 34(B))
4. The law says we cannot normally investigate a complaint when someone could take the matter to court. However, we may decide to investigate if we consider it would be unreasonable to expect the person to go to court. (Local Government Act 1974, section 26(6)(c), as amended)

Back to top

How I considered this complaint

5. I considered information provided by the complainant and I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

6. Ms X complained to the Information Commissioner’s Office (ICO) about her concerns and a subsequent ICO investigation decided her case. The ICO also wrote to the Council about their information rights and practices and required the Council to take steps in response to Ms X’s complaint. Ms X also complained to the Council and in that complaint, she asked the Council to provide her a large sum of compensation and to discipline relevant staff. She also wanted an apology.
7. We will not investigate Ms X’s complaint. This is because there is no worthwhile outcome achievable by us investigating. Ms X’s complaint is about how the Council (mis)handled her private information and then responded to the resultant data breach. The ICO are a statutory body created by parliament to oversee an individual’s data protection rights and who have extensive powers to address the GDPR. Given they have already investigated and required the Council to take remedial steps, and have the power to monitor this, there is nothing further we could achieve beyond that.
8. Additionally, we cannot achieve the outcome Ms X is seeking. We cannot award compensation and where Ms X believes the Council are liable for damages to the extent she has stated, it would be reasonable for her to pursue this claim through the courts. The Council have apologised to Ms X and in any case, we cannot direct it to take disciplinary action against its staff.

Back to top

Final decision

9. We will not investigate Ms X’s complaint because there is no worthwhile outcome achievable by us investigating.

Back to top

Investigator's decision on behalf of the Ombudsman