GDPR PCNs and sharing data

2019-11-13T11:43:18Z

We are trying to get our Data Protection/Privacy statements correct for our PCNs. In particular because we're not a unitary authority and therefore need to share data with or get data from the county's boroughs and districts.

So far we have agreed :

This information is being collected and held on the lawful basis of a public task (in accordance with the Town and Country Planning Act 1990, as amended, related orders and regulations and other related legislation) for the purpose of gathering information on the use of land under the Act. As such we do not require your consent to process and retain your data. The data you provide on this form will become part of the official enforcement history of a site and is therefore retained indefinitely.

However, when it come to sharing that information with the borough/district or vice versa our legal team are questioning whether it's the same public task (because the borough district need information on local matters and we as the county need information on waste matters). There are cases that have been lost at court because both types of matters were not handled simultaneously, but GDPR seems to prevent the natural sharing of that data collected between the authorities because the TCP specifically says authority (singular). We're now going round in circles on this. We want to avoid both borough/district AND county issuing separate PCNs because the landowner would then be able to play one off against the other and say information already provided.

My view is that if the person served with the PCN is informed about the potential for sharing data, if necessary, then that would cover us. So adding:

Your data may be shared with other authorities where necessary, including the borough or district council where the land is situated and the Environment Agency. In the event of enforcement action then the data may be used as evidence in court, if necessary.

(or even insert the specific borough/district name if that's clearer... but more error prone and it would be better for this to be built into the template).

We would also provide the URLs to the full privacy policy and enforcement protocols.

Anyone have thoughts or know how it's handled in their area?