We regret to report that on 5 March, a list of complainants’ names and some information about their complaints were published in error on our website. The names of the caseworkers who worked on these complaints were also published.
The data did not include any contact details such as telephone numbers, emails or addresses, nor personal information such as age or date of birth.
The information was removed on 28 April 2020. If you have downloaded or otherwise obtained a copy of the spreadsheet, please delete it in whatever form you hold it.
How many people were affected?
The names of just over 5,300 complainants and 197 members of PHSO staff were published. For the vast majority, we are satisfied that no issues arise which require action beyond publishing this notice. However, we are taking a cautious approach by notifying 311 people individually where inferences could be drawn from the data.
Where was the data?
The information was in a spreadsheet published alongside the Ombudsman’s Annual Casework Report 2019. The spreadsheet showed the number of complaints received about each organisation. The information was not visible to readers unless they clicked to reveal hidden tables.
What did the data include?
The information published was:
- the names of the complainants
- the date a complainant contacted us
- how they contacted us (by telephone or using the web form)
- the organisation(s) complained about
- the name of the caseworker and whether the case was upheld, partly upheld or not upheld.
What are the risks?
Having investigated the information that was published, we believe the risk of someone using this information maliciously is very low.
What action has PHSO taken?
As soon as we became aware of the situation, we removed the information from the website and reported the data breach to the Information Commissioner. We are investigating what went wrong and have reviewed and changed our processes to make sure this does not happen again.
We are very sorry that this happened and any for any worry it may cause our service users and colleagues.
I downloaded and saved a copy of the spreadsheet while it was available on the website. What should I do?
If you have downloaded or otherwise obtained a copy of the spreadsheet, please delete it in whatever form you hold it.
If you want to contact us
If you have any questions or would like to discuss this further, please contact our Data Protection Officer at privacy@ombudsman.org.uk. If you are unhappy with our response, you can complain to the Information Commissioner’s Office.