We are trying to get our Data Protection/Privacy statements correct
for our PCNs. In particular because we're not a unitary authority and
therefore need to share data with or get data from the county's
boroughs and districts.
So far we have agreed :
- This information is being collected and held on the lawful basis
of a public task (in accordance with the Town and Country Planning
Act 1990, as amended, related orders and regulations and other
related legislation) for the purpose of gathering information on the
use of land under the Act. As such we do not require your consent to
process and retain your data. The data you provide on this form will
become part of the official enforcement history of a site and is
therefore retained indefinitely.
However, when it come to sharing that information with the
borough/district or vice versa our legal team are questioning whether
it's the same public task (because the borough district need
information on local matters and we as the county need information on
waste matters). There are cases that have been lost at court because
both types of matters were not handled simultaneously, but GDPR seems
to prevent the natural sharing of that data collected between the
authorities because the TCP specifically says authority (singular).
We're now going round in circles on this. We want to avoid both
borough/district AND county issuing separate PCNs because the
landowner would then be able to play one off against the other and say
information already provided.
My view is that if the person served with the PCN is informed about
the potential for sharing data, if necessary, then that would cover
us. So adding:
-
Your data may be shared with other authorities where necessary,
including the borough or district council where the land is
situated and the Environment Agency. In the event of enforcement
action then the data may be used as evidence in court, if necessary.
(or even insert the specific borough/district name if that's
clearer... but more error prone and it would be better for this to be
built into the template).
We would also provide the URLs to the full privacy policy and
enforcement protocols.
Anyone have thoughts or know how it's handled in their area?
