Summary: We will not investigate this complaint about a data breach. The Information Commissioner is better placed to consider and decide data protection complaints. For the remainder, we could not add to the investigation the Council has already done.

The complaint

1. Mr X complained about a data breach, and the unacceptable delay in the Council responding to his complaint about the matter.
2. Mr X said this caused distress.
3. Mr X wants an explanation for the data breach and for the Council to offer him a symbolic financial remedy for his time and trouble.

Back to top

The Ombudsman’s role and powers

4. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start or continue an investigation if we decide:

• there is another body better placed to consider this complaint, or
• we could not add to any previous investigation by the organization.

(Local Government Act 1974, section 24A(6), as amended, section 34(B))

Back to top

How I considered this complaint

5. I considered information provided by Mr X.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. Mr X complained the Council provided him with the personal information of a third party in error.
8. The Information Commissioner’s Office (ICO) enforces data protection legislation.  The ICO can investigate complaints about data protection.
9. We will not investigate this part of Mr X’s complaint. The ICO is better placed to consider and decide data protection complaints, and it is reasonable to expect Mr X to complain to them.
10. Mr X also complained about drift and delay in the Council responding to his complaint about the data breach.
11. In its response to Mr X’s complaint, the Council acknowledged the data breach and provided an explanation for how this happened. The council also recognised the unacceptable delay in responding to Mr X’s complaint, apologised and took learning from his experience.
12. We will also not investigate this part of Mr X’s complaint. Given the findings the Council have already made, we could not add to the investigation it has already done.
13. Additionally, it is not a good use of resources to investigate complaints about complaints procedures when we decide not to investigate the substantive matter.

Back to top

Final decision

14. We will not investigate Mr X’s complaint because the ICO is better placed to consider and decide data protection complaints, and we could not add to the investigation the Council has already done.

Back to top

Investigator's decision on behalf of the Ombudsman