Summary: We will not investigate Miss X’s complaint about an alleged data breach. This is because complaints about data matters such as this are best considered and decided by the Information Commissioner’s Office.

The complaint

1. Miss X complains the Council committed a data breach when it shared her confidential personal data about her mental health with third parties without her consent during a child protection meeting. Miss X says this has caused her distress and embarrassment and it has worsened her anxiety. She also complains the Council delayed in responding to her complaint.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse effect on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start an investigation if we decide the tests set out in our Assessment Code are not met. (Local Government Act 1974, section 24A(6), as amended)
3. We do not start or continue an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

5. I considered information provided by the complainant and the Council.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. Miss X complained to the Council that it committed a data breach when it shared her confidential personal data during a child protection team meeting with third parties without her consent.
8. The Council apologised to Miss X for its delay in responding to her complaint. It reviewed its records and spoke to the team involved. It confirmed that no information relating to her mental health was shared or recorded in its records. It found no evidence that Miss X’s personal data was shared or documented other than noting that she is a sibling to the person the meeting related to and that she provides support to the family. It explained Miss X could request a review and if she remains dissatisfied once she has completed the Council’s process then she can make a complaint to the Information Commissioner’s Office (ICO).
9. We will not investigate Miss X’s complaint. This is because this is a complaint about a data matter which is best considered and decided by the ICO. The ICO is the body set up to consider and decide data matters such as this and it is best placed to consider it. We will not also investigate it.

Back to top

Final decision

10. We will not investigate Miss X’s complaint because it is about a data matter best considered and decided by ICO.

Back to top

Investigator's decision on behalf of the Ombudsman