Applications are open to join the next Housing Ombudsman Resident Panel – find out more Housing Ombudsman Resident Panel.

Sanctuary Housing Association (202325425)

Back to Top

REPORT

COMPLAINT 202325425

Sanctuary Housing Association

15 April 2025


Our approach

What we can and cannot consider is called the Ombudsman’s jurisdiction and is governed by the Housing Ombudsman Scheme. The Ombudsman must determine whether a complaint comes within their jurisdiction. The Ombudsman seeks to resolve disputes wherever possible but cannot investigate complaints that fall outside of this. 

In deciding whether a complaint falls within their jurisdiction, the Ombudsman will carefully consider all the evidence provided by the parties and the circumstances of the case.

The complaint

  1. The complaint is about the landlord’s response to the resident’s reports of a data breach.

Determination (jurisdictional decision)

  1. When a complaint is brought to the Ombudsman, we must consider all the circumstances of the case as there are sometimes reasons why a complaint will not be investigated.
  2. After carefully considering all the evidence, I have determined that the complaint, as set out above, is not within the Ombudsman’s jurisdiction.

Summary of events

  1. On 6 September 2023, the resident complained to the landlord. He said that he had provided his bank details twice and asked for their deletion afterwards. Since his bank information was not removed, he asserted that it was a data breach and a breach of GDPR regulations, and that the landlord kept his information illegally.
  2. The landlord responded at stage 1 of the complaints process on September 20, 2023. It stated that the complaint was not upheld because no breach had occurred.
  3. The resident requested that the complaint be escalated and said he had also raised it to the Information Commissioner’s Office (ICO) for investigation.
  4. On 23 October 2023, the landlord provided a stage 2 response. This response confirmed that, following standard procedure, emails regarding the acceptance of compensation were deleted and redacted. Deleted emails are saved in the ‘deleted folder’ and routinely purged monthly. Additionally, the landlord asserted that it had a lawful basis for collecting and processing this information. However, it noted that the resident had the right to complain to the ICO.
  5. The resident expressed his dissatisfaction and said that the landlord had misinformed him about using his data. On 23 October 2023, the landlord issued a final response. It apologised for not clarifying how his data would be used and offered £100 as a gesture of goodwill. It confirmed that it would also recommend reviewing the compensation guidance wording after receiving the complaint.
  6. The resident asked us to investigate his complaint. He said that the landlord had not been truthful about how it used his data and had breached the Data Protection Act 2018. He requested an increase in the compensation offered.

Reasons

  1. Paragraph 42(j) of the Scheme notes as follows:
    1. The Ombudsman may not investigate complaints which, in the Ombudsman’s opinion fall properly within the jurisdiction of another Ombudsman, regulator, or complaint-handling body.
  2. In September 2023, the resident raised a concern with the landlord that it had breached the Data Protection Act 2018 by unlawfully retaining his information. While the serious nature of the complaint is acknowledged, this is not a matter we can consider.
  3. We are unable to investigate complaints regarding potential breaches of the Data Protection Act 2018. The ICO more appropriately handles such issues as it has the authority to assess whether a landlord has failed to comply with relevant data handling provisions and can make orders aimed at putting things right.
  4. We understand that the resident contacted the ICO to file a complaint and received a response on 20 November 2023. In this response, the ICO requested that the landlord verify the removal of the resident’s data from their system and offered guidance on reviewing their processes for handling such requests in the future. We believe this action satisfactorily addresses the resident’s concerns.