Summary: There was fault by the Council in record keeping and handling sensitive data and this caused Mr X avoidable distress. The Council will apologise, pay him £500, erase a letter and arrange training for staff.

The complaint

1. Mr X complained Surrey County Council (the Council):
1. Cut his ASD support funding
2. Told a care agency he had sexual behaviour problems when he did not
3. Told the LGSCO it was still investigating a complaint when it wasn’t
4. Used a ‘script’ when dealing with him by phone
2. Mr X said the Council’s actions caused him distress.

Back to top

What I have investigated

3. I investigated complaint (b). My reasons for not investigating the other complaints are at the end of this statement.

Back to top

The Ombudsman’s role and powers

4. We normally expect someone to refer the matter to the Information Commissioner if they have a complaint about data protection. However, we may decide to investigate if we think there are good reasons. (Local Government Act 1974, section 24A(6), as amended)
5. Mr X could refer the case to the Information Commissioner to consider taking enforcement action, but I have exercised discretion to investigate because the Council has already admitted fault though the complaints process, and we have the power to make recommendations to remedy his injustice and improve services to others.
6. We investigate complaints about ‘maladministration’ and ‘service failure’. In this statement, I have used the word fault to refer to these. We must also consider whether any fault has had an adverse impact on the person making the complaint. I refer to this as ‘injustice’. If there has been fault which has caused an injustice, we may suggest a remedy. (Local Government Act 1974, sections 26(1) and 26A(1), as amended)
7. We provide a free service, but we use public money carefully. We do not start or may decide not to continue with an investigation if we decide:

• there is not enough evidence of fault to justify investigating, or
• any injustice is not significant enough to justify our involvement

(Local Government Act 1974, section 24A(6))

8. If we are satisfied with a council’s actions or proposed actions, we can complete our investigation and issue a decision statement. (Local Government Act 1974, section 30(1B) and 34H(i), as amended)

Back to top

How I considered this complaint

9. I considered Mr X’s complaint to us, the Council’s response to the complaint and documents described later in this statement. I discussed the complaint with Mr X.
10. Mr X and the Council had an opportunity to comment on my draft decision. I considered any comments received before making a final decision.

Back to top

What I found

Relevant law and guidance

11. Our Principles of Good Administrative Practice is guidance we expect councils to consider. We use this as a benchmark for the standards we expect when we investigate actions of local authorities. We expect councils to be open and accountable. This includes keeping proper and appropriate records.
12. The UK General Data Protection Regulation (‘GDPR’) sets out the principles, rights and obligations for processing of personal data.
13. Article 1 of the GDPR says processing data (which includes sharing it with an external body) is only lawful if the person has given consent or if it is necessary in one of the following situations:
• for the performance of a contract to which the person is a party
• for compliance with a legal obligation
• to protect the vital interests of the person
• for the performance of a task carried out in the public interest or in the exercise of official authority
• for legitimate interests pursued by the controller or third party except where such interests are overriden by the interests of fundamental rights and freedoms of the person which require protection of personal data.
14. Article 17 of the GDPR is the right to erasure (the right to be forgotten). It says data subjects have the right to obtain erasure of personal data which has been unlawfully processed.
15. Article 8 of the European Convention on Human Rights (EHCR) guarantees the right to respect for private life, family life, home and correspondence. The UK brought the EHCR into law in the Human Rights Act 1998. The Human Rights Act requires councils and other public bodies to respect and protect individuals’ rights. Article 8 is a qualified right and so a body may justify an interference to protect the rights of others or in the wider public interest. Any interference with a qualified right must be in accordance with the law; in pursuit of a legitimate aim; no more than necessary to achieve the intended objective; and must not be arbitrary or unfair.
16. Our remit does not extend to making decisions on whether or not a body we investigate has breached the Human Rights Act – this is for the courts to decide. But we can decide whether or not a body has had due regard to an individual’s human rights in their treatment of them as part of our consideration of a complaint. Councils will often be able to show they have complied with the Human Rights Act if they can show they have considered the impact their decisions will have on the individuals affected.

What happened

17. Mr X is an adult who needs care and support. In 2021, the Council was helping Mr X to find an agency to provide him with care.
18. Mr X’s social worker told me in a written statement for this investigation there had been instances when Mr X had made sexually inappropriate comments to him on the phone. The statement went on to describe the specifics of what Mr X said. The social worker said he responded to Mr X by trying to move the conversation on to a different topic. The statement did not say when the conversation took place, what the context was or whether this happened just once or more often.
19. The Council told me the social worker did not make a written record of what Mr X had told him because of ‘…..embarrassment about the sexual theme and because he was unsure how to record these discussions in writing.’ The Council went on to say the social worker’s manager had stressed the need to document all discussions and it shared the document with the agency ‘as a tool to assist should further instances occur’
20. In February 2021, the Council’s learning disability and autism team (the LDA team) sent a letter to Mr X about his contact with council officers. The letter gave examples of behaviour officers considered unacceptable and said how officers would respond to him in different scenarios. The letter did not mention anything about any inappropriate conversations about sex.
21. In April, an officer from the LDA team sent the agency an undated copy of the letter to Mr X described in the previous paragraph. The version the agency received included a description of behaviour considered unacceptable including

“Calls of a sexual nature that are not related to your care…… staff will first give a warning, if you continue to discus sexually inappropriate matters, the call will be terminated”

22. Mr X did not receive a copy of the version of the letter the agency received at the time the officer sent it to the agency.
23. Mr X later found out about the Council sending the second version of the letter to the agency and complained. He was concerned that a different version of the letter had been shared which he had not seen. He believed that a particular senior officer had amended the letter to add the paragraph about calls of a sexual nature before sending it to the agency.
24. The Council’s response to Mr X’s complaint said

“a worker can choose to work from a previous document for a variety of reasons…… I can confirm that no alternative documents have been created or sent to any parties for any other purpose”

25. The Council’s complaint response said “please accept my apologies that the incorrect document was shared with [the agency]”
26. The Council’s data protection officer also completed an investigation as Mr X raised further concerns over the way the Council handled his personal data. The data protection officer’s response said:
• The paragraph was in a draft copy of the letter which was kept. It was removed in the final version Mr X received
• The Council was not transparent because Mr X was unaware of the content that had been disclosed to the agency. There had been a breach of Mr X’s data protection rights because the Data Protection Act 2018 says personal data should be processed lawfully, fairly and in a transparent way
• While the disclosure was well intended because it was with the aim of achieving consistency in managing phone contact, the Council could have achieved this aim without sharing the whole letter
• The Council was sorry for his distress
• The data protection officer would ensure staff in the LDA team were made aware of their duties to consider what is proportionate and necessary when sharing information and not to share a draft document with any party not directly contributing to its creation.
27. The Council told me it had not described Mr X as having a sexual behaviour problem or suggested he was a sex offender. The Council went on to say the point Mr X was objecting to was first included in the draft letter because he had made comments of a sexual nature during conversation. The Council accepted the draft letter should not have been shared with the agency.
28. Mr X told us finding all this out had a profound effect on him. He went on to explain he already has significant problems with anxiety and said Council’s actions caused him severe distress.

Was there fault causing distress?

29. There was fault by the Council which caused Mr X avoidable distress because:
1. It already upheld Mr X’s complaints about inappropriate sharing of data with the agency. The data protection officer found Mr X’s data protection rights had been breached.
2. There should have been a contemporaneous written record of the discussion with Mr X. We expect councils to keep records of significant actions on a case. Record keeping fell below our expected standard.
3. There was no evidence the Council had regard to Mr X’s right to respect for private life and correspondence when sharing the draft letter with the agency or when dealing with his complaint or investigating the data breach.
30. I have not concluded the letter was amended to include the offending paragraph after Mr X received a copy. There is not enough evidence for me to say on a balance of probability that it was.

Back to top

Agreed action

31. The Council has already taken some action to remedy the injustice to Mr X – an apology and guidance to the adult social care team around making a written record of phone calls, around proportionality and data sharing and not sharing a draft document with parties that have not contributed to it. This is a partial remedy.
32. The Council will also:
1. apologise to Mr X again for the added fault I have identified
2. pay him £500 to reflect his avoidable distress.
3. remove the draft letter from Mr X’s records because the Council has already accepted in its own investigation that Mr X’s data was not processed lawfully, fairly or transparently. Mr X therefore has a right to obtain erasure under Article 17 of the GDPR. The Council also needs to ask the agency (which is one of its contractors for social care) to do the same.
4. arrange a training session for staff involved in this case (including members of the LDA team, complaints team and information governance team) about the Council’s obligations under the Human Rights Act 1998.
33. The Council will make the payment and apology within one month and take the other actions (points (c) and (d)) within two months of my final decision. I will require evidence of compliance.

Back to top

Final decision

34. There was fault by the Council in record keeping and handling sensitive data and this caused Mr X avoidable distress. The Council will apologise, pay him £500, erase a letter and arrange training for staff.
35. I have completed the investigation.

Back to top

Parts of the complaint that I did not investigate

36. I did not investigate the complaint (a) because we have already investigated a complaint about a funding cut previously. And, if there has been a more recent cut since our investigation, we expect Mr X to use all stages of the Council’s complaints procedure before we will investigate.
37. Complaint (c) is not serious enough for us to investigate.
38. There is not enough evidence of fault in complaint (d). It is acceptable and not fault for officers to follow a ‘script’ or set of guidelines when speaking to Mr X on the phone.

Back to top

Investigator's decision on behalf of the Ombudsman