Summary: We will not investigate Ms X’s complaint about an alleged breach of data as there is another body better placed to consider.

The complaint

1. Ms X complains the Council improperly disclosed confidential information about her child to a third party.
2. She believes the Council's subsequent investigation was flawed and the Council prevented her from pursuing the matter through the complaints process.

Back to top

The Ombudsman’s role and powers

3. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service but must use public money carefully. We do not start an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
4. We will not usually investigate complaint handling if we are not investigating the rest of the complaint. This is because there is not usually enough injustice to justify us doing so. We collect information about particularly poor complaint handling practice and report this back to organisations. (Local Government Act 1974, section 24A(6), section 34B(8))

Back to top

How I considered this complaint

5. I considered information provided by the complainant which includes the Council’s response.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. I have seen information showing the Council investigated the data breach allegation through its Information Governance process. It decided there was no evidence of breach of confidential information. The Council advised that concerns about an alleged data protection breach should be pursued with the Information Commissioner's Office (ICO), which is the independent regulator for data protection matters. It subsequently reiterated that it does not operate an internal review process for data breach investigations of this nature and directed Ms X to the ICO if she remained dissatisfied
8. We will not investigate this complaint because it is better placed to be considered by the Information Commissioner's Office (ICO). The core issue is if the Council improperly disclosed personal data and whether its handling of the alleged data breach complied with data protection legislation. These are matters that fall within the ICO's specialist remit and powers. The Council has already investigated the allegation through its Information Governance process and specifically advised the complainant of her right to refer the matter to the ICO. The complainant has also indicated that she intended to pursue the matter with the ICO.
9. The ICO is the specialist body established to investigate and determine complaints about alleged breaches of data protection law, including whether personal information has been disclosed improperly and whether an organisation's response to a reported breach was adequate. It is therefore the more suitable agency to consider the complainant's concerns.
10. As we are not investigating the underlying data protection matter, we would not separately investigate concerns about how the Council dealt with the complaint or requests for a further review. Those issues are separate to the main complaint and there is no evidence of a separate injustice arising to warrant an investigation of the complaints process.

Back to top

Final decision

11. We will not investigate Ms X’s complaint because there is a more suitable body better placed to consider her complaint.

Back to top

Investigator's decision on behalf of the Ombudsman