Summary: We will not investigate Mr X’s complaint about a data breach by the Council and about its response to his data requests. This is because complaints about data matters, such as this, are best considered and decided by the Information Commissioner’s Office.

The complaint

1. The complainant, Mr X, complains the Council committed a data breach when it sent him sensitive information about an unnamed third party in error. He also complains the Council did not respond to his freedom of information and subject access requests within the usual timeframes.

Back to top

The Ombudsman’s role and powers

2. We investigate complaints about ‘maladministration’ and ‘service failure’, which we call ‘fault’. We must also consider whether any fault has had an adverse effect on the person making the complaint, which we call ‘injustice’. We provide a free service, but must use public money carefully. We do not start an investigation if we decide the tests set out in our Assessment Code are not met. (Local Government Act 1974, section 24A(6), as amended)
3. We do not start an investigation if we decide there is another body better placed to consider this complaint. (Local Government Act 1974, section 24A(6), as amended, section 34(B))
4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
5. The Information Commissioner's Office considers complaints about freedom of information. Its decision notices may be appealed to the First Tier Tribunal (Information Rights). So where we receive complaints about freedom of information, we normally consider it reasonable to expect the person to refer the matter to the Information Commissioner.

Back to top

How I considered this complaint

6. I considered information provided by the complainant and the Council.
7. I considered the Ombudsman’s Assessment Code.

Back to top

My assessment

8. Mr X complained to the Council that it committed a data breach when it sent him sensitive information about an unnamed third party in error, causing him distress. He also complains the Council has not responded to his freedom of information and subject access requests within the set timescales.
9. The Council investigated. It upheld Mr X’s complaint and apologised for its error. It signposted Mr X to the Information Commissioner’s Office (ICO) if he remained dissatisfied with its final response.
10. We will not investigate Mr X’s complaint. This is because the complaint is about data matters which are best considered by the ICO. The Council has appropriately signposted Mr X to that office. We will not also investigate it.
11. In relation to the freedom of information matter, Mr X would also have a right of appeal to the first tier tribunal should he remain dissatisfied with the Council’s final response on that point.

Back to top

Final decision

12. We will not investigate Mr X’s complaint because it is about data matters which are best considered and decided by the ICO which is the body set up to consider such matters.

Back to top

Investigator's decision on behalf of the Ombudsman