Summary: We will not investigate Ms X's complaint about how the Council dealt with an alleged data breach. The Information Commissioner's Office is best placed to consider such matters.

The complaint

1. Ms X complains the Council included highly sensitive and inaccurate information in her child's EHCP, including information relating to domestic abuse, safeguarding matters and a third party. She says this caused significant distress to both her and her child. She remains concerned about how her personal data is accessed and protected. She would also like financial remedy.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start or continue an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
3. We normally expect someone to refer the matter to the Information Commissioner’s Office (ICO) if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended.)

Back to top

How I considered this complaint

4. I considered information provided by the complainant and the Council.
5. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

6. The Council has already considered Ms X's complaint through its complaints process. The Council accepted fault in including incorrect personal data in the EHCP, apologised, explained how the error occurred, referred the matter to its Information Governance Team and described action taken to reduce the risk of recurrence.
7. Ms X also raises concerns about the Council's handling of her other sensitive personal information and who has access to that information within the Council. Ms X also seeks financial compensation. We will not investigate this complaint. These issues concern compliance with data protection legislation. The Information Commissioner's Office is the specialist body established to consider such matters and has broad powers in relation to data protection complaints and the remedies available for any identified failings.

Back to top

Final decision

8. We will not investigate Ms X’s complaint about how the Council dealt with the data breach because the Information Commissioner’s Office is best placed to address this.

Back to top

Investigator's decision on behalf of the Ombudsman