Summary: We will not investigate Ms X’s complaint about a data breach by the Council. This is because complaints about data matters such as this are best considered and decided by the Information Commissioner’s Office.

The complaint

1. Ms X complains the Council committed a data breach when it shared her personal information with a third party without her knowledge or consent. She also complains about its handling of her complaint.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse effect on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start an investigation if we decide the tests set out in our Assessment Code are not met. (Local Government Act 1974, section 24A(6), as amended)
3. We do not start an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

5. I considered information provided by the complainant.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. Ms X complained to the Council that it committed a data breach in sharing her personal information with a third party without her knowledge or consent and about the impact of this.
8. The Council investigated. It agreed there had been a data breach. It apologised to Ms X for this and for any upset this caused and signposted Ms X to the Information Commissioner’s Office (ICO).
9. We will not investigate Ms X’s complaint. This is because it is about data matters which are best considered and decided by the ICO. It is the body set up to consider complaints about data matters such as this. We will not also investigate.
10. Ms X also raised complaint handling issues. We do not consider complaint handling issues in isolation where we are not also investigating the substantive matter. This is because it is not a good use of our limited public resources to do so.

Back to top

Final decision

11. We will not investigate Ms X’s complaint because it is about data matters the ICO is best placed to consider and decide rather than this office.

Back to top

Investigator's decision on behalf of the Ombudsman