Summary: We will not investigate this complaint about the way the Council responded to Miss X's complaint concerning an alleged General Data Protection Regulation (GDPR) breach. This is because further investigation would not lead to a different outcome and there is another body better placed to consider the substantive issue.

The complaint

1. Miss X complains that when she raised a complaint with the Council about an alleged GDPR breach, the Council did not follow its complaints procedure, failing to escalate her complaint when she requested this and failing to respond within its published timescales. Leaving her feeling unheard and concerned about the Council's handling of complaints. She would like the Council to acknowledge its failings, apologise, and review her complaint.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start or continue an investigation if we decide:

• we could not add to any previous investigation by the organisation, or
• further investigation would not lead to a different outcome, or
• there is no worthwhile outcome achievable by our investigation. (Local Government Act 1974, section 24A(6), as amended, section 34(B))

3. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered information provided by the complainant and the Council.
5. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

6. Miss X complained to the Council about an alleged GDPR breach. She was unhappy with the Council's response and asked it to escalate her complaint. The Council did not escalate the complaint in line with its complaint’s procedure. Miss X challenged this and the Council then escalated the complaint and considered the issues raised. Deciding there was insufficient evidence to support the allegation a GDPR breach had occurred.
7. The Council accepted fault in its complaint handling and apologised for failing to escalate Miss X's complaint when she requested this. However, it did not uphold the substantive complaint about the alleged GDPR breach.
8. We will not investigate Miss X's complaint. The Council has now considered the substantive issues through its complaints procedure and has acknowledged and apologised for the complaint-handling fault and identified service improvements. Further investigation would not lead to a different outcome. In addition, it is not a good use of public resources to investigate complaint handling in isolation when we are not investigating the substantive issue.
9. If Miss X remains dissatisfied with the Council's decision that no breach of GDPR occurred, it would be reasonable for her to complain to the Information Commissioner's Office (ICO), which is the specialist regulator responsible for considering complaints about data protection matters.

Back to top

Final decision

10. We will not investigate Miss X’s complaint. This is because further investigation would not lead to a different outcome and there is another body better placed to consider the substantive issue.

Back to top

Investigator's decision on behalf of the Ombudsman