Summary: We will not investigate this complaint about the way the Council handled Miss X’s personal information, alleged data breaches and failure to deal with Subject Access Requests (SARs). This is because there is not enough evidence of fault by the Council and further investigation would not lead to a different outcome. The Information Commissioner’s Office is better placed to consider her data protection concerns. Part of Miss X’s complaint is also late.

The complaint

1. Miss X has submitted two complaints to the Ombudsman about the Council's handling of her personal information, alleged data breaches, and its response to her Subject Access Requests (SAR).

Complaint 1

2. Miss X complains a Council Officer did not follow the Council’s complaints procedure when dealing with her complaint about its actions. She says the Council Officer did not deal properly with her Subject Access Requests. She wants the Council to investigate the matter, apologise and provide a financial remedy for the inconvenience she says this caused.

Complaint 2

3. Miss X complains the Council shared her personal information with other agencies without her consent, which she believes resulted in data breaches under the General Data Protection Regulations (GDPR).

Back to top

The Ombudsman’s role and powers

4. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start or continue an investigation if we decide:

• there is not enough evidence of fault to justify investigating, or
• further investigation would not lead to a different outcome, or
• there is another body better placed to consider this complaint

(Local Government Act 1974, section 24A(6), as amended, section 34(B))

5. We cannot investigate late complaints unless we decide there are good reasons. Late complaints are when someone takes more than 12 months to complain to us about something a council has done. (Local Government Act 1974, sections 26B and 34D, as amended).
6. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

7. I considered information provided by Miss X and the Council.
8. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

Complaint 1

9. Miss X complains the Council Officer:

• failed to follow the Council’s complaints procedure when handling her complaint;
• did not properly deal with two SARs she submitted.

10. Miss X says the Officer failed to record her initial complaint about the Council’s actions as a formal complaint. She further says the Officer only partially responded to one SAR and did not process the other.
11. The Council accepts it omitted some information from the documents it provided in response to Miss X’s first SAR. It redacted some information relating to third parties. The Council asked Miss X to identify any information she believes is still missing from the documents provided. However, it says Miss X has not done so. The Council cannot take any further action to resolve the matter without this information.
12. The Council says the Officer was correct to refuse Miss X’s second SAR as manifestly unfounded. The Council says the Officer reached this decision after obtaining legal advice and the Council found the Officer acted reasonably and proportionately in their handling of this matter.
13. We will not investigate because it would be reasonable for Miss X to complain to the Information Commissioner's Office (ICO). The ICO is the independent authority that protects personal data privacy and information and is therefore better placed to consider Miss X’s concerns about the Council’s handling of her SARs.

Complaint 2

14. Miss X complains the Council shared her personal information with other agencies without her consent, which she believes resulted in breaches of GDPR.
15. The Council told Miss X it had not ignored her instructions about sharing her personal information. However, it had made safeguarding referrals when it considered this necessary to protect Miss X’s welfare. It explained in some circumstances the law allowed it to share information without a person’s consent. Because councils have a duty to highlight concerns about a person’s wellbeing with other relevant agencies we are unlikely to find enough evidence of fault with the Council’s action here to justify further investigation.
16. Miss X alleges the Council’s disclosure to her GP Practice led to it removing her as a patient. We are unlikely to find evidence the Council was directly responsible for this action. Miss X would need to raise any such concerns directly with her GP Practice and/or the NHS.
17. Miss X’s complaint the Council disclosed information to her housing provider relates to events from 2024. This part of the complaint is therefore late. We will not investigate this issue because I have seen no good reason why Miss X could not have brought this complaint to us sooner.
18. We will not investigate this part of Miss X’s complaint. This is because, as with complaint 1, the ICO is better placed to consider these matters.
19. The Council is entitled to decline to respond to further complaints about the same issue where it is satisfied it has already considered and responded to the matters raised. We are unlikely to find fault with the Council’s decision simply because Miss X disagrees with the conclusions it reached.
20. Miss X has previously made complaints about matters raised in this decision, which both the Council and Ombudsman have considered. In these circumstances, we are unlikely to investigate any future complaints that relate to, or are closely connected with, the same matters, as they have already been considered and determined.

Back to top

Final decision

21. We will not investigate Miss X’s complaints because;

• we cannot find enough evidence of fault by the Council,
• further investigation would not lead to a different outcome,
• there is another body better placed to consider the substantive issues, and
• part of Miss X’s complaint is late.

Investigator’s decision on behalf of the Ombudsman

Back to top

Investigator's decision on behalf of the Ombudsman