Summary: We will not investigate Ms X’s complaint about possible breaches of the General Data Protection Regulation by the Council. This is because the Information Commissioner and the courts are better placed to deal with the matter and to get the outcome Ms X wants.

The complaint

1. The complainant, Ms X, complains the Council breached the General Data Protection Regulation (GDPR) by discussing her personal information with a third party. She also complains it heavily redacted information provided in response to her subject access request (SAR). She wants the Council to compensate her for the alleged breach of the GDPR and provide full unredacted records of complaints made against her.

Back to top

The Ombudsman’s role and powers

2. The Local Government Act 1974 sets out our powers but also imposes restrictions on what we can investigate.
3. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
4. The law says we cannot normally investigate a complaint when someone could take the matter to court. However, we may decide to investigate if we consider it would be unreasonable to expect the person to go to court. (Local Government Act 1974, section 26(6)(c), as amended)

Back to top

How I considered this complaint

5. I considered information provided by Ms X and the Ombudsman’s Assessment Code.

Back to top

My assessment

6. The question of whether the Council’s actions in discussing Ms X’s personal information with a third party and redacting information it provided in response to her SAR amount to breaches of the GDPR are ones for the Information Commissioner, rather than for us. The Information Commissioner is the expert in data protection matters and it can make findings as to whether the Council has breached the GDPR.
7. If the Information Commissioner decides the Council’s discussions with the third party amount to a breach of the GDPR, and if Miss X believes she has suffered damages as a result of any breach, it would be reasonable for her to make a claim against the Council at court. The courts are the only bodies able to determine whether Ms X is entitled to damages and the amount of any damages she should receive.
8. If Ms X believes she is suffering harassment she should report her concerns to the police and if they decide to investigate further they may be able to obtain records directly from the Council in relation to their enquiries.

Back to top

Final decision

9. We will not investigate this complaint. This is because the Information Commissioner and the courts are better placed to consider the alleged breaches of the GDPR and to decide whether Ms X is entitled to compensation for any damages she has suffered.

Back to top

Investigator's decision on behalf of the Ombudsman