Applications are open to join the next Housing Ombudsman Resident Panel – find out more Housing Ombudsman Resident Panel.

Southwark Council (202324142)

Back to Top

REPORT

COMPLAINT 202324142

Southwark Council

26 March 2025


Our approach

What we can and cannot consider is called the Ombudsman’s jurisdiction and is governed by the Housing Ombudsman Scheme. The Ombudsman must determine whether a complaint comes within their jurisdiction. The Ombudsman seeks to resolve disputes wherever possible but cannot investigate complaints that fall outside of this. 

In deciding whether a complaint falls within their jurisdiction, the Ombudsman will carefully consider all the evidence provided by the parties and the circumstances of the case.

The complaint

  1. The complaint is about the landlord’s handling of the resident’s concerns about a data breach.

Determination (jurisdictional decision)

  1. When a complaint is brought to the Ombudsman, we must consider all the circumstances of the case as there are sometimes reasons why a complaint will not be investigated.
  2. After carefully considering all the evidence, I have determined that the complaint, as set out above, is not within the Ombudsman’s jurisdiction.

Summary of events

  1. The resident is a secure tenant of the property, a 1-bedroom flat. He has lived there since August 2018.
  2. On 17 August 2023 the landlord replied to an email from the resident regarding a cancelled meeting and copied in another email address. The resident complained to the landlord the same day and asked why his reply was copied to someone outside of the landlord’s organisation. The landlord responded and informed the resident that his concerns had been passed to its Data Protection Officer (DPO).
  3. The landlord issued its stage 1 complaint response on 4 September 2023 and apologised for the breach of data. The landlord said:
    1. The matter had been raised with the DPO on the day it was reported, and appropriate actions had been taken.
    2. It was unable to discuss any follow action it would be taking.
  4. The resident escalated his complaint with the landlord on 5 September 2023. He said the breach had negatively impacted his mental and physical wellbeing and caused him stress and anxiety. The resident requested to be paid compensation, and for the person responsible for the breach, to be removed from their position.
  5. The landlord issued its stage 2 complaint response on 3 October 2023. It again apologised for the data breach and said that it had taken measures with the individual involved to prevent any further breaches occurring in the future. The landlord also apologised for any distress and inconvenience caused and stated that it had found no failings in how the concern was handled and it would not award compensation.
  6. The resident remains dissatisfied and brought the complaint to us. He is seeking to be compensated for the distress and inconvenience he has been caused.

Reasons

  1. The resident raised concerns to us regarding an alleged data breach by the landlord. This was in relation to sharing his personal information with a third party outside of the landlord’s organisation.
  2. Paragraph 42.j. of the Scheme states the Ombudsman may not investigate complaints, which in the Ombudsman’s opinion, fall properly within the jurisdiction of another Ombudsman, regulator, or complaint handling body.
  3. The Information Commissioner’s Office (ICO) is an independent body, which has the power to investigate data breaches and to assess whether an organisation has failed to comply with the relevant data handling provisions.
  4. This resident’s complaint is solely about the alleged data breach and the landlord’s decision making around its investigation of that breach. As such, the complaint is outside of the Ombudsman’s jurisdiction. If the resident remains unhappy with how the landlord responded to his concerns about the alleged data breach, he may wish to visit the website of the ICO and seek further information about how to progress his complaint. The website contains information and advice about what to do if you are concerned about how an organisation has handled your data.