Information regulator failed to properly assess data protection complaints

What happened

Mrs N asked an NHS trust and a local authority for a copy of the information they held about her. This type of request is a 'subject access request'. Mrs N complained to ICO about the subject access requests and about her personal information being disclosed. ICO assessed the complaints, but Mrs N was unhappy with both of the assessments and asked us to review the decisions.

What we found

We partly upheld this complaint. ICO did not properly consider all of Mrs N's complaints about the NHS trust in the assessment. However, it considered the complaints when it finished its internal review of its decision.

ICO did not address Mrs N's complaint about the local authority in either the assessment or the review. Mrs N had not had a view from ICO about whether the local authority had complied with the Data Protection Act 1998. This caused Mrs N frustration, inconvenience and upset.

There was an unreasonable delay in ICO completing its review, because the review was not reassigned after the person originally responsible went on leave. ICO's delay in completing the review caused Mrs N frustration and upset. However, ICO's apology for this was adequate.

Putting it right

ICO apologised to Mrs N for failing to properly assess the complaint about the local authority. It agreed to review its handling of the assessment to see whether there was anything more it could do on the information request made to the local authority.