Summary: We will not investigate this complaint about an alleged data breach due to the way the Council sent documents to the complainant. This is because it is a matter for the Information Commissioner and because the Council has provided a satisfactory response.

The complaint

1. The complainant, Mrs X, complains about the way the Council sent documents through the post. She says the envelope was not sturdy enough, the Council initially said it had not sent the material, and it did not use recorded delivery.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse impact on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start an investigation if we decide:

• there is another body better placed to consider this complaint, or
• if we are satisfied with the actions an organisation has taken or proposes to take.

(Local Government Act 1974, section 24A(6) & 24A (7), as amended, section 34(B))

3. We normally expect someone to refer the matter to the Information Commissioner (ICO) if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)

Back to top

How I considered this complaint

4. I considered information provided by Mrs X and the Council. This includes the Council’s response. I also considered our Assessment Code.

Back to top

My assessment

5. The Council sent Mrs X about 500 pages of documents through the post. The bundle included personal and financial information. When Mrs X received the bundle she found the envelope was torn, some pages were missing and the contents could be viewed.
6. Mrs X complained to the Council. She said there had been a data breach and the Council should have sent the documents more securely.
7. The Council investigated the matter as a data breach and signposted Mrs X to the ICO if she was dissatisfied with the response.
8. The Council explained it had sent similar sized bundles in the past without any problems. It said Royal Mail had retained some documents as part of its procedures for dealing with damaged post. The Council apologised for what happened and explained the steps it would take to improve its service. This includes using a plastic envelope when sending bundles of more than 200 pages and adding a return address to the envelope.
9. I will not investigate this complaint because Mrs X can complain to the ICO. It is reasonable for her to do this because the ICO is the appropriate body to consider complaints about data protection. The ICO could ask the Council to take further steps to improve its data handling if it thinks additional action is needed.
10. I also will not start an investigation because the Council has provided a satisfactory response by apologising and explaining how it will improve its service.

Back to top

Final decision

11. We will not investigate this complaint because Mrs X can complain to the ICO and because the Council has provided a satisfactory response.

Back to top

Investigator's decision on behalf of the Ombudsman