Clarion Housing Association Limited (202210730)

REPORT

COMPLAINT 202210730

Clarion Housing Association Limited

25 January 2024

Our approach

The Housing Ombudsman’s approach to investigating and determining complaints is to decide what is fair in all the circumstances of the case. This is set out in the Housing Act 1996 and the Housing Ombudsman Scheme (the Scheme). The Ombudsman considers the evidence and looks to see if there has been any ‘maladministration’, for example, whether the landlord has failed to keep to the law, followed proper procedure, followed good practice, or behaved in a reasonable and competent manner.

Both the resident and the landlord have submitted information to the Ombudsman, and this has been carefully considered. Their accounts of what has happened are summarised below. This report is not an exhaustive description of all the events that have occurred in relation to this case, but an outline of the key issues as a background to the investigation’s findings.

The complaint

The complaint is about the way the landlord handled the resident’s:
1. Rent arrears;
2. Concerns about contractor visits;
3. Personal data following a cyber incident;
4. Complaint.
This report will also assess the landlord’s record keeping.

Jurisdiction

What we can and cannot consider is called the Ombudsman’s jurisdiction. This is governed by the Housing Ombudsman Scheme. When a complaint is brought to the Ombudsman, the Service must consider all the circumstances of the case as there are sometimes reasons why we will not investigate a complaint.
After carefully considering all the evidence, in accordance with paragraph 42(j) of the Housing Ombudsman Scheme, the resident’s complaint about how the landlord handled his personal data following a cyber incident is outside the Ombudsman’s jurisdiction.
Following a cyber incident the landlord experienced on 17 June 2022, the resident wrote to it on 22 August 2022. He asked if any of his personal data had been accessed by unauthorised parties during the attack. In his stage 1 complaint of 9 September 2022, he queried how his personal data could be “safe” in the landlord’s computer system when it was not even able access his account. He stated that the landlord had a duty to keep his data safe at all times.
The matter was considered through the landlord’s internal complaints procedure. The landlord stated in its stage 1 response that there was no evidence online account passwords had been compromised or that its ‘Customer Relationship Management system’, where it kept the main bulk of its resident information, had been accessed.
The resident subsequently contacted the Service as he was unhappy with the response he had received from the landlord. While the serious nature of this complaint is acknowledged, this is not a matter the Ombudsman can consider. Paragraph 42(j) of the Housing Ombudsman Scheme states that “the Ombudsman will not investigate complaints which, in the Ombudsman’s opinion fall properly within the jurisdiction of another Ombudsman, regulator or complaint-handling body”.
The Information Commissioner’s Office (ICO) is an independent body set up to uphold information rights. It has the power to investigate data breaches, to assess whether an organisation has failed to comply with the relevant data handling provisions, and to make orders aimed at putting things right. It follows that, if the resident remains unhappy with how the landlord responded to his concerns about its handling of his personal data, and the actions that it took in response, he should refer the matter to the ICO accordingly. While we have not investigated the matters relating to the resident’s date, they have been referred to in the report below for the purpose of providing context.

Background and summary of events

The resident lives in a 1 bedroom, general needs property, which is owned by the landlord. He moved into the property in May 2021 following a homelessness application to the local council. He currently holds an assured shorthold tenancy. A management company is responsible for the day to day running of the properties in the block.
On 22 May and 6 June 2021, the landlord wrote to the resident to tell him that his rent account was in arrears. It asked him to arrange payment within 7 days and that, if he was having difficulty paying, it could provide help and advice.
The resident wrote to the landlord on 14 June, 12 July, 23 and 27 August 2021. He said he had told the management company when he moved that his housing benefit would be paid directly to the landlord. He attached the email he had sent to the council, explaining that the landlord had not received any rent for his flat. He provided the landlord with the name of a contact at the council’s Housing Benefit office, who he said could help progress matters. The resident added that he did “not wish to run the risk of losing” his home and that he would do everything he could “to resolve the arrears situation as quickly as possible”.
The landlord acknowledged the resident’s emails on 2 September 2021 and told him that its Customer Accounts team would contact him directly. On 24 September 2021, it sent him a letter saying that he had rent arrears of £1,989.53. It said it had not been able to make contact with him and that, if it did not hear from him within 7 days, it would “continue with legal action to repossess” his home.
On 30 September 2021, the resident contacted the landlord to say:
1. He did not want to lose his home;
2. The council had paid his rent directly to his previous landlord;
3. Following the move to his current property, the council had told him that his new landlord should contact it to agree a direct payment;
4. He had sent this information to the landlord, who assured him it would pass his email to its accounts department.
It is not clear whether the landlord responded to the resident’s correspondence; however, on 8 and 12 October 2021, the landlord sent the resident further rent arrears letters. On 14 October it wrote to him to say:
1. His arrears stood at £3634.21;
2. It understood he had been in contact with the council about transferring his Housing Benefit;
3. If he needed help to do this, it could refer him to its tenancy sustainment team for support;
4. If he continued not to pay rent, it would apply to the court to recover the property.
Between 20 October and 10 November 2021, there were further email exchanges between the landlord and resident. The landlord stated that it had tried to make phone contact on a number of occasions but was unable to reach him. It also asked him to send his national insurance (NI) number and housing benefit reference number. The resident told it that he had given the management company his NI number on 5 May 2021. He attached proof he had done this. The landlord stated that, if he needed help with his rent arrears and benefit claims, it had a specialist welfare benefits team that could provide him with support.
On 28 November 2021, the resident wrote to the landlord to say:
1. He had written to it several times about his rent situation and had done everything the landlord had asked him to do;
2. The landlord had not replied to his emails;
3. The management company had been “sitting” on his NI number for 6 months and had not bothered to pass it on;
4. He wanted to raise a formal complaint about the landlord’s “very poor, slow and unprofessional” communication.
The resident chased up his complaint on 27 December 2021, stating that it had been more than 20 working days since he sent his email. The landlord sent him a Notice of Seeking Possession on 14 January 2022, informing him he had rent arrears of £3,634.21.
On 20 January 2022, the landlord received an enquiry from the resident’s member of parliament (MP), a copy of which it did not provide to the Service. The landlord responded to the MP on 2 February 2022 and stated:
1. Its Customer Accounts team had attempted to phone the resident on numerous occasions to discuss his rent account but had been unsuccessful;
2. It recognised it should have responded using the same method of communication he had used;
3. It had informed the resident via email, on 4 January 2022, that it had not received any housing benefit from the council and encouraged him to contact it to discuss this further;
4. It informed his via email, on 21 January 2022, of his arrears balance and advised him that if he made no rent payments, it would apply to the court to recover the property;
5. It was of “utmost importance” that the resident contacted it to set a payment arrangement, or informed it of any support he required.
The landlord sent the resident a letter on 10 February 2022 giving details of its tenancy sustainment service, and a telephone number where residents could refer themselves.
Further email exchanges took place between 11 February and 17 March 2022. The resident stated that, despite what it had told his MP about using the same method of communication as him, the landlord continued to try and contact him via telephone. The landlord stated that it had tried to contact him to offer a telephone appointment with its welfare benefit advisors and tenancy sustainment service. It advised him that telephone appointments were the preferred method of engaging with the service on offer. However, if he wanted an initial consultation communicated to him via email, he should let it know. It added that it had tried to contact him several times via telephone and in writing and that it was his responsibility to arrange payment of his rent.
On 5 April 2022, the landlord started receiving payment from the Department of Work and Pensions (DWP) for the resident’s rent.
The landlord experienced a cyber incident on 17 June 2022 and, on 22 August 2022, the resident wrote to it to ask whether any of his data had been accessed by ‘unauthorised people’ during the attack.
On 6, 7, 8 and 9 September 2022, the resident wrote to the landlord and raised concerns about:
1. The safety of his personal data following the cyber incident;
2. The landlord’s failure to resolve his rental payment issue;
3. The landlord’s lack of response to his emails;
4. The landlord’s lack of response to letters from the council;
5. Contractors making unsolicited visits to his property;
6. The lack of an automated email acknowledgement system.
On 9 September 2022, the landlord acknowledged the resident’s concerns as a stage 1 complaint. It asked him to provide more clarification about contractors attending his property without prior notice, including dates of and reasons for the visits. It stated had no record of any letters from the council but that they may not have been accessible due to the cyber incident. It asked the resident for a contact at the council so it could ask them to resend the letters.
The landlord sent the resident an email, on 3 October 2022, to tell him it had nearly finished investigating his complaint. It sent its stage 1 response on 12 October 2022, which stated:
1. There was no evidence resident’s online account passwords had been compromised during the cyber incident;
2. It had informed the resident, on 4 January 2022, that it was not receiving rental payments and had offered him support from its tenancy sustainment team;
3. In September 2022, it had asked him for the date when he had moved into the property. It would have usually had access to this information but, due to the cyber incident, access to its systems was severely limited;
4. It was a resident’s responsibility to inform the council and DWP when they move, and to submit a benefit claim;
5. The arrears still stood but were being paid. Therefore, the landlord would not take any further action as long as this remained the case;
6. It apologised that it did not respond to the emails the resident sent. However, due to the cyber incident, it was unable to locate historic emails;
7. Although it had been unable to locate records of any contacts from the council, a member of staff who was dealing with the resident’s enquiries had managed to obtain copies;
8. There had been “clear and open communication” from the council and the landlord had responded to all the emails. There were issues with some emails being received following the cyber incident and the council had also blocked some of its emails for “security reasons”;
9. It wanted to address the resident’s reports of unsolicited visits individually:
  1. It confirmed that its pest control contractor had written to all residents in the block on 18 April 2022. It said it would attend on 13 and 23 May, and on 9 June 2022 to respond to reports by tenants of rodent activity;
  2. With regard to gas safety visits carried out on 24 March and 26 May 2022, it was a legal requirement to undertake gas safety checks. Letters were sent to residents prior to the appointments and they were given the opportunity to request alternate dates;
  3. There were no records of any unsolicited visits in August 2022;
  4. A representative of a contractor had visited the resident as part of her duties to arrange an appointment to replace his windows. This had been done with all residents in the block.
10. Although the visits were justified, it acknowledged it had not called the resident back as he had requested;
11. It was not in a position to add an automated acknowledgement feature at that time but this was a feature in its email communication prior to the cyber incident;
12. It offered the resident £350 compensation for failing to reply to emails and callback requests. It also offered £50 for the delay in responding to his complaint.
The resident responded to the landlord on 14 October 2022 and stated that:
1. The landlord’s published response time was 10 working days but it took about 30 working days to respond to his complaint;
2. It did not answer any of his specific questions;
3. The landlord had asked him for his NI number more than once after he had moved in. However, he had already provided this information before he signed the lease;
4. The landlord had failed to acknowledge his letter that he had sent via recorded delivery;
5. He wanted the landlord to address the rent arrears issue as a matter of urgency. The landlord needed to access the information he had sent it from the time he moved in;
6. He wanted it to send him evidence that his personal data had not been compromised;
7. He wanted the landlord to explain why it did not obtain copies of the contacts from the council before stating that it did not have access to them;
8. It was untrue to say there was no record of any unsolicited visits as the management company had written to him to say he was not at home when they were made;
9. He wanted to escalate his complaint to stage 2.
On 23 November 2022, the landlord sent the resident its stage 2 response, which it referred to as a ‘peer review final response’. The landlord stated that:
1. It was sorry for the delay in providing a response, which was caused by disruption caused by a “cyber security incident”. This meant it was unable to respond within its usual timescales;
2. It had changed its response time for stage 1 complaints from 10 to 20 working days following the cyber incident. It had made the change following discussions with the Ombudsman. In cases where responses took longer than 30 days, it offered compensation as in the resident’s case;
3. It had addressed his concerns about unsolicited visits. With regard to gas safety visits, “due to the nature of the work and importance of gas servicing” it was unable to provide him with the name of the contractor who would attend. However, it would try and call him prior to any visits;
4. It acknowledged the delay in responding to his stage 1 complaint. However, it stated that, during the investigation, the resident had raised several additional points, which further delayed the response;
5. There were numerous communications about the resident’s rent prior to the cyber-incident. It had also attempted to respond to his complaint about his rent with the limited access it had. It acknowledged that it had failed to respond to his recorded letter;
6. It explained it had been unable to give the resident a proper update due to the lack of access to the necessary information. As it now had access to its information systems, it was able to respond to his query about his rent arrears;
7. The resident signed his tenancy agreement on 4 May 2021 and the landlord wrote to him on 7 May 2021 to advise him of his balance. It also offered help and support, including help making benefit claims;
8. It had also advised him to contact the council with regard to any housing benefit claims he may have made. On 25 August 2021, he informed the landlord he had contacted the council and was waiting for an update;
9. It had spoken to the council on 10 November 2021, who confirmed that it had not received an application from him for housing benefit;
10. His balance was £3,741.76 and it was receiving payments from his universal credit toward his rent and arrears. It was satisfied it had taken the necessary steps to assist him;
11. A member of staff who had been handling the resident’s previous correspondence was able to retrieve copies of the emails from the council, which meant it was then able to investigate this part of the resident’s complaint;
12. The management company advised the landlord that the visits the resident had mentioned were not unsolicited. The gas safety contractors, as part of the annual gas safety checks, send appointments in advance of the anniversary of when checks are due. If a resident cannot be contacted, the landlord would continue to contact them until the checks had been carried out;
13. If offered the resident £100 compensation for failing to respond to all the points he had raised in his stage 1 complaint.
The resident wrote to the Service on 25 November 2022 to say he was not satisfied with the landlord’s response. He stated that all the issues in his complaint related to events prior to the cyber incident in June 2022. In his email, he reiterated the concerns he had raised with the landlord, including the numerous requests for his NI number, the way it had handled his rental payments and that it had failed to respond to the letter he had sent via recorded delivery.
The landlord wrote to the resident on 9 January and 11 April 2023 to inform him that his rent account was in arrears. On 26 May 2023, it wrote to him again to acknowledge that, as he was paying his rent by universal credit, it should not have sent him the arrears letters. It offered him £300 compensation for the inconvenience caused by this.

Assessment and findings

The resident’s rent arrears

The Ombudsman does not underestimate the considerable inconvenience and distress the resident experienced while the arrears on his rent account increased. This would have been particularly upsetting given he had recently been homeless. It is acknowledged that the resident is responsible for ensuring he pays his rent and apply for any benefits to which he is entitled. However, the landlord would be expected to make reasonable efforts to provide appropriate support if a resident reports they are having difficulty making their rental payments. It is both in the landlord’s and resident’s interests to take all reasonable steps to prevent the resident from building up rent arrears.
The landlord states in its stage 2 response that it had written a letter to the resident on 7 May 2021 in which it enclosed a rent statement and offered help and support in making benefit claims. However, the landlord has not provided any records to evidence this. The first record showing that the landlord sent the resident a rent statement was an email dated 19 May 2021. In its email, it also signposted the resident to its website . This stated that he could access a range of services from his mobile or tablet, including viewing his rent account and calculating benefits.
The evidence shows that, following receipt of an arrears letter from the landlord, dated 22 May 2021, the resident wrote to it 6 times between 14 June and 30 September 2021. It was clear in his communication that the resident was keen to resolve the problem as soon as possible. There is no indication that, apart from sending further arrears notification letters, the landlord responded to the resident’s enquiries during this time, or offered any direct assistance. Although the landlord has stated that it had tried to contact the resident by telephone, it has not provided any telephone records to evidence the efforts it had made to do this.
It was not until around 5 months after the resident first contacted the landlord that it responded. By this time, the arrears had risen from £344,85 to £3634.21. Prior to 14 October 2021, there is no record that the landlord had offered to refer the resident to its tenancy sustainment team or any other support service. The records demonstrate that the landlord’s communication was severely lacking during this time. The landlord’s delay in offering support showed a lack of customer focus and contributed to the resident’s rent arrears increasing. The landlord’s failure to provide any meaningful assistance eventually culminated in him being sent a notice to seek possession letter. This would have caused the resident significant distress, particularly when facing the possibility of eviction.
The landlord acted correctly when, in October 2021, it gave the resident the option to access the appropriate support services. The evidence shows it had offered to refer the resident to its benefit support team on a number of occasions after this date. It is understandable that the landlord may prefer to provide some services via the telephone, such as giving welfare benefits advice. However, there may be various reasons why a resident may not want to engage via certain communication methods. It was positive therefore that the landlord offered to arrange for a welfare benefit advisor to provide an initial consultation via email. The landlord could also have explored other ways to provide the resident with the appropriate advice and support, such as through its webchat service. Once it had made the referral, the landlord could not reasonably be held at fault for any subsequent delays in the resident accessing the support the landlord had offered.
The landlord has not provided any records of contacts it had made to the council prior to January 2022, following the resident’s enquiries. Nor has it provided copies of any replies from the council. The landlord stated in its stage 2 response that it had spoken to the council on 10 November 2021. This was to check if the resident had made a housing benefit application.
The evidence shows that the resident had been telling the landlord, from 14 June 2021, that he usually paid his rent via direct housing benefit payments. It is not clear why the landlord failed to offer assistance when the resident made it aware he was struggling to transfer his housing benefit to his new property. He had also asked the landlord to contact the council, and gave it the name of an officer who he said could assist. The delay in contacting the council when the resident was repeatedly asking for assistance shows the landlord did not take appropriate steps to help prevent him from going into rent arrears. The delay in liaising with the council to help the resident set up managed payments was a missed opportunity. That it took the landlord around 5 months to eventually liaise with the council or to respond to the resident was maladministration.
The resident has stated that he gave the management company his NI number when he moved into the property in May 2021. The landlord has not provided any records of contacts between it and the management company regarding this matter. It therefore cannot reasonably demonstrate that the resident’s NI number was passed on or that the landlord had liaised with the company with regard to this matter. This shows a lack of joint working between the landlord and its management company. Had the landlord made necessary enquiries when the resident first contacted it in June 2021, it would not have had to ask for his NI details 5 months later. The lack of communication between the landlord and its management company would have also contributed to the delay in resolving the resident’s rent arrears issue.
The landlord confirmed that it had started to receive rental payments from April 2022. It was inappropriate for the landlord to attribute its lack of communication to the cyber incident in July 2022. This is because the period when the landlord failed to respond to the resident’s email enquiries was between June to November 2021. This was over 6 months before the incident occurred.
The landlord’s Compensation Policy states that it offers remedies of between £250 to £700 for cases where it found considerable failure but where there may have been no permanent impact on the resident. The landlord acted appropriately by offering compensation in its stage 1 response for its poor communication. However, the £350 that it had offered is on the lower end of what it could have offered, and did not go far enough to recognise the impact on the resident. The landlord’s lack of action and failure to communicate for over 5 months lead to the resident receiving a note of seeking possession for rent arrears. This could have been prevented had the landlord taken swift and immediate steps to support the resident. Owing to the landlord’s failings, the resident experienced avoidable distress and inconvenience for over 5 months. The landlord will therefore need to make further redress to put things right.

The resident’s concerns about contractor visits

The tenancy agreement states that the resident must agree to allow the landlord’s employees, agents or contractors to enter their home at reasonable times and subject to reasonable notice of not less than 24 hours (unless it is an emergency). This is to inspect the condition of the resident’s home or any installations; to carry out repairs, yearly gas and electrical safety checks or other works to the property.
The landlord acted appropriately when asking for specific details in order to investigate the resident’s reports of unsolicited visits. This is because it had to ensure it was acting in accordance with the tenancy agreement and that the resident was getting at least 24 hours’ notice of any non-emergency contractor visits. Although it had not provided any contemporaneous records of enquiries it had made with the management company, its stage 2 response evidences that it had liaised with it as part of the investigation.
It is acknowledged that any unannounced visits can be frustrating for a resident. However, the evidence shows that the landlord had made appropriate enquiries to check whether or not any operatives had attended without prior notice. It therefore made reasonable attempts to investigate the resident’s concerns. However, the Ombudsman will make a recommendation that the landlord liaises with its management company to ensure residents receive at least 24 hours’ notice before it or its contractors make any visits.

Complaint

The landlord’s complaint policy that was effective in November 2021 stated that it had a 2 stage procedure. If an initial attempt to resolve a query was not achieved, a formal complaint would be recorded and investigated. It said it would do all it could to resolve the resident’s issues and “put things right”.
The Ombudsman’s Complaint Handling (the Code) states that when a complaint is made, it must be acknowledged and logged at stage 1 of the complaints procedure within five days of receipt. It adds that landlords must respond to the complaint within 10 working days of the complaint being logged.
On 28 November 2021, the resident raised a complaint, in which he stated, “I hereby lodge a formal complaint against your very poor, slow and unprofessional communication”. There is no evidence the landlord acknowledged the complaint, carried out any kind of investigation or provided a response, even after the resident had chased this up. The resident was therefore put in a position where he had to approach his MP for assistance. That the landlord significantly departed from its policy and the Code, was maladministration.
By the time the resident raised a further stage 1 complaint in September 2022, the landlord had amended its complaints policy in response to the cyber incident in June 2022. It states that it will log and acknowledge requests for a stage 2 complaint in 10 working days. It aimed to respond within 40 working days. Although the landlord responded to the resident’s stage 2 complaint within its timescale, there is no evidence that it had sent him an acknowledgement. This is further demonstration that it had departed from its complaints policy. Although the landlord offered £150 for its poor complaint handling, this does not go far enough to recognise the extent of its maladministration and will need further redress to put things right.

Record Keeping

The evidence shows that the landlord’s record keeping was poor. It was unable to provide any contemporaneous telephone logs, or records of any correspondence with the council or its own management company. The landlord was unable to carry out an effective complaint investigation due to its inability to access historic contacts between it and the resident, or communication with other bodies.
It is the view of this Service that the landlord’s record keeping practices were insufficiently robust and that this prevented recovery of the information lost during the cyber-attack. Notwithstanding the cyber-attack and its obvious impacts, the landlord missed opportunities to revisit key data during the complaints process, which would have assisted it to properly investigate the resident’s concerns about the service he had received. It is unclear why database backups were not able to be accessed. While it is not the remit of the Service to investigate the information technology arrangements of the landlord, the absence of records meant the landlord could not fully acknowledge its communication failures. As a result, it failed to uphold the resident’s concerns around how it dealt with his issues over rent payments.
That the landlord failed to reasonably demonstrate it had a robust and reliable record keeping system, or provide evidence that it kept or held contact records was maladministration.

Determination (decision)

In accordance with paragraph 52 of the Housing Ombudsman Scheme, there was maladministration in the way the landlord handled the resident’s rent arrears.
In accordance with paragraph 52 of the Housing Ombudsman Scheme, there was no maladministration in the way the landlord handled the resident’s concerns about contractor visits.
In accordance with paragraph 42(j) of the Housing Ombudsman Scheme, the complaint about the way the landlord handled the resident’s personal data following a cyber incident is outside the Ombudsman’s jurisdiction.
In accordance with paragraph 52 of the Housing Ombudsman Scheme, there was maladministration in the way the landlord handled the resident’s complaint.
In accordance with paragraph 52 of the Housing Ombudsman Scheme, there was maladministration in the landlord’s record keeping.

Reasons

The landlord failed to respond to the resident’s requests for support in setting up a managed housing benefit payment for his new property. This led to the resident’s rent arrears accruing to the point that the landlord sent him a notice of seeking possession.
The landlord took reasonable steps to investigate the resident’s reports that he had received unsolicited visits from its contractors.
The landlord failed to acknowledge or respond to a complaint the resident made in November 2021. It also failed to properly acknowledge the resident’s stage 2 complaint in line with its complaints policy.
The landlord’s record keeping was consistently poor and this prevented it from carrying out a full and proper investigation of the resident’s complaint.

Orders

The Ombudsman published a report in October 2022 detailing the findings of its special investigation of the landlord’s services. The report is available on our website, and makes recommendations further to the landlord’s existing action plan. The Ombudsman’s report and recommendations include reference to all of the issues detailed above that impacted the resident’s complaint, including its complaint handling, communication and record keeping. The Ombudsman has asked the landlord to provide an update of its progress against the recommendations.
Within 4 weeks of receiving this determination, the landlord to pay the resident £1300, which is comprised of:
1. £500 in recognition of the distress and inconvenience caused by the landlord’s poor communication and lack of action in providing the resident with appropriate support;
2. £500 in recognition of its poor complaint handling;
3. £300 in recognition of its poor record keeping.

This replaces the landlord’s combined offer of £400 compensation it made in its stage 1 and stage 2 complaint responses. The landlord must not offset this award against any rent arrears without first agreeing this with the resident.

Within 4 weeks of receiving this determination, the landlord to provide, with a copy to the Ombudsman, an apology to the resident from a senior member of staff for its maladministration.

Recommendations

The landlord to remind its management company to speak to residents to ensure appointments are convenient for them and that it ensures that contractors provide at least 24 hours’ written notice before they make any visits to residents’ homes.