Summary: We will not investigate this complaint about an alleged data breach and associated matters. The Information Commissioner’s Office is better placed than us to consider complaints about data protection. Where the Information Commissioner’s Office has already considered a matter, it is best placed to make recommendations about data practices, and there is a right to go to court to seek compensation it would be reasonable to use. Investigating the remaining matter alone would not lead to any worthwhile outcome.

The complaint

1. Miss X said there was a major data breach by the Council in sending sensitive information about her to another person. She also said the Council’s records about her were inaccurate, and that it dissuaded her from seeking the support of an organisation that she has found to be helpful. She wanted the Council to admit its mistakes, change its practices and acknowledge the harm done.

Back to top

The Ombudsman’s role and powers

2. The Local Government Act 1974 sets out our powers but also imposes restrictions on what we can investigate.
3. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
4. We cannot investigate late complaints unless we decide there are good reasons. Late complaints are when someone takes more than 12 months to complain to us about something a council has done. (Local Government Act 1974, sections 26B and 34D, as amended)

Back to top

How I considered this complaint

5. I considered information provided by the complainant and the Council.
6. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

7. Miss X has already referred a data breach to the Council. It has accepted the breach. Despite the Information Commissioner’s Office (ICO) referring Miss X to a court or an ombudsman service, the ICO is better placed than us to make recommendations about data practices. We cannot make recommendations about compensation for damages caused by a breach. Only a court could do that. Investigating this matter would not lead to any worthwhile outcome.
8. Alleged data inaccuracy is also a matter for the ICO. It has powers to require rectification and to impose penalties that we lack.
9. Investigating the alleged dissuasion by the Council of Miss X from contacting an organisation she found helpful would be unlikely in isolation to lead to any worthwhile outcome.

Back to top

Final decision

10. We will not investigate Miss X’s complaint. Doing so would be unlikely to lead to any worthwhile outcome because:

• The majority of her complaint concerns data matters that the ICO is better placed to investigate as it has powers we lack to require rectification and to impose penalties;
• Where the ICO has already found a data breach, it is better placed than us to make recommendations about practice, and only a court could recommend compensation for a breach; and
• Investigating the alleged dissuasion alone would not lead to any worthwhile outcome separable from the main matters complained of.

Back to top

Investigator's decision on behalf of the Ombudsman