Reasons for having complaints procedures
Although the vast majority of public sector organisations will already have adequate complaints procedures in place, this guidance specifically covers complaints about handling of personal information. Such complaints may concern, for example, breeches of confidentiality, data inaccuracy, or release of information under the Data Protection Act 1998 or Freedom of Information Act 2000 .
If organisations deal with complaints appropriately, this can prevent them escalating and possibly ending up in the courts.
What is a complaint?
Not all letters should be treated as complaints. For example, there is a difference between a complaint and a suggestion for improving the way an organisation handles personal information. In addition, if someone points out that their name is spelt incorrectly or that their address details should be updated, this is not a complaint.
Organisations may find it useful to encourage feedback separately by publishing the fact that they welcome suggestions for improving services. This could be published in documents and promoted on the internet via a suggestions box.
It is useful for staff to be given a definition of a complaint so that meaningful statistics can be collected on them. The definition might be "any expression of dissatisfaction from a member of the public that needs a response".
How to make a complaint
Complaints can be made in person, in writing, (including by e-mail), or by telephone. Written complaints may be encouraged, but oral complaints should also be registered and taken seriously.
All procedures should be fair, which means considering people with disabilities, or those who could be at a disadvantage when expressing their complaint (for example, if their English is limited). The organisation may need to consider making arrangements for handling complaints from members of the public who have reading, writing, or language difficulties.
Complaints procedures - the steps to be taken
Each organisation should explain to members of the public how they can make a complaint by publishing an explanation of each stage of the process involved. This should include relevant contact details (on forms and leaflets) and a description of what type of complaints the organisation will deal with.
Publishing a form for written complaints with simple questions such as: a) what is your complaint b) what happened, or what went wrong (details) and c) what would you like to happen - do you want an apology/compensation? - will help clarify the issues for both parties and establish a shared understanding.
When responding to a complaint
Acknowledge the complaint and state a time limit in which the complaint will be dealt with (e.g. 20 days). Full contact details of the person dealing with the case should be provided.
If the deadline cannot be met, the organisation may need to issue a holding reply explaining why.
In the substantive reply, it is useful to outline the organisation's understanding of the complaint, especially if it was made orally, so that there are no misunderstandings about what the complaint is about.
The reply should be written in plain English and no legal knowledge (for example of Data Protection or Freedom of Information legislation) should be presumed.
If, after the investigation the organisation is found to be at fault, an apology should be given, explaining whether anything will be done to prevent the problem arising again. The letter should be open about any mistakes made and should not take a defensive tone.
If the complaint is rejected, or partly rejected, the complainant should be informed of their right to appeal.
If the complaint included a claim for compensation, the complainant should be told whether or not they have been successful and an explanation of the decision should be provided. An explanation should also be given if the amount of compensation offered is less than that claimed. Again, if the claim is unsuccessful, or only partially successful, the complainant should be told about their right to appeal.
Internal Appeals
Medium to large organisations will usually have at least one internal route of appeal.
If the complainant decides to appeal they should be provided with full contact details of the person to whom they can appeal. Outline the process of appeal and also give a time scale for issuing a final response.
The investigator of the appeal should be independent from those involved in any earlier investigations and of a more senior grade. The final appeal might be to the organisation's Chief Knowledge Officer.
The appellant will need to be told whether the original decision about their complaint was correct. If the decision was found to be incorrect, then the appellant will require an apology and reassurances that that the organisation will try to address the problems, which led both to the initial complaint, and to the way it was dealt with.
External Appeals
After exhausting the procedures for internal complaints and if the complainant is still dissatisfied with the conclusions of the appeal, the organisation should let the complainant know what external appeals procedures exist.
Complainants should be advised that they can refer claims about breeches of the Data Protection Act or Freedom of information Act, to the Information Commissioner at:
Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK95AF
http://www.informationcommissioner.gov.uk
Note that the Information Commissioner is a regulator, not an ombudsman. He will make an assessment as to whether it is likely or unlikely that the provisions of the Data Protection Act have been complied with, if requested. However, it will be for him to decide whether or not to take enforcement action.
If the complaint is about maladministration by a Government Department, complainants should be advised that they can ask an MP to write to the Parliamentary Commissioner for Administration (the Ombudsman) and ask her to investigate.
The Parliamentary Ombudsman
Millbank Tower
Millbank
London
SW1P 4QP
http://www.ombudsman.org.uk
Other complaints can be referred to the relevant independent Ombudsman or Adjudicator. A comprehensive list and contact details can be located at http://www.bioa.org.uk.
Reviewing Procedures
Complaints should be analysed so that procedures for information handling can be improved. Information collected on complaints should include: the number of complaints received, the number of justified/unjustified complaints, the time taken to deal with them, the amount of compensation paid, the areas of complaint (e.g. security, breach of confidence etc) and any changes made as a result.
Guidance to staff
Organisations will need to ensure that staff are adequately trained to deal with complaints about the handling of personal information. Staff should be able to understand the options available to the public, including the role of any ombudsman or tribunal.
Staff should be encouraged to see complaints in a constructive way, as a means to improve services. They should be issued with clear written procedures that focus on sorting out complaints quickly and effectively.
Which organisation is responsible for the complaint?
If, because of data sharing agreements with other bodies, a complaint involves more than one organisation, it should be determined in advance which organisation will deal with it.
If a complaint is transferred to another organisation, the first organisation should:
tell the complainant where it has been sent
let the complainant have a copy of the second organisation's complaints procedure and full contact details of who will deal with the complaint
If the complaint involves more than one organisation, the determining organisation will need to arrange for the other organisation to investigate its area of responsibility and contribute to the determination of the complaint. Both parties should then agree a draft of the substantive response