Almost a full year after being formed, North Yorkshire Council has found itself facing accusations of breaching GDPR rules thousands of times over.
When making comments on planning applications, members of the public have noticed that both their names and addresses have appeared on the public planning portal, exposing this private data to potentially thousands of people. On the North Yorkshire Council planning portal, it states:
“Please note that comments on planning applications need to be assessed and any personal information removed before publishing.”
This comment would give an individual the reasonable expectation that their personal information would be redacted publicly, while being retained by the data controller, especially as members of the public tend to be first time users of planning portals.
The Information Commissioner’s Office helpfully points out that the principle of ‘transparency’ is critical.
- “Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR.”
- “You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with. We call this ‘privacy information.”
Residents in North Yorkshire contend that they have been given no information on who their private information ‘will be shared with’ and that consent for this private information to be available to anyone accessing North Yorkshire Council’s planning portal has not been given.
This expectation that personal data will not be shared with the public is especially relevant for a variety of people who do not wish their home addresses to be shared – whether this is people fleeing domestic violence, school teachers, local community leaders, or anyone else who could be targeted as a result of the public release of this information.
Residents also argue that Article 5d of GDPR 2018, on the accuracy of the data, could be called into question, as some current, live applications have been on the planning portal for months. Within this time, it is reasonable to assume that addresses could have changed, with no reasonable steps taken from the council to rectify the data.
“Personal data shall be … accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.”
Are democratic voices being silenced?
North Yorkshire resident Jane White* told Yorkshire Bylines that they had to escalate matters to the Independent Commissioner’s Office following an initial complaint to North Yorkshire Council.
“I have now made an official complaint to the ICO as I do not agree with North Yorkshire Council’s response. At my request, the council have removed my objection and details from the site, but obviously my objection now does not count.
“All objections should contain a name and address for identification purposes, however the addresses can be redacted when uploaded to the public site.That way their legal requirements are met and GDPR is followed.
“My complaint to the ICO is that my ability to object is compromised if my address has to be uploaded to a publicly accessible website as a condition of objecting and that the NYC consent form does not make this unambiguously clear, regardless of that my right to object is still compromised. My address being in the public domain may put me at risk if I were fleeing domestic abuse or a stalker.
“I would love to know how many people who have objected or indeed supported realise that their home address details are now available on a publicly accessible forum for anyone to access.”
The ICO itself warned of the dangers of data breaches leading to people’s lives being put in danger. They highlighted seven organisations in the past two years which had released the home addresses of victims of domestic abuse.
White also highlighted the anomalous practice of North Yorkshire Council redacting email addresses on submitted comments, deeming them to be personal data, yet systematically publishing names and home addresses of members of the public, arguing that there was no legal necessity or purpose in a name and full home address of an individual being made openly available to the public.
Councils argue that they do this to satisfy the GDPR for planning applications, however Article 40 of the The Town and Country Planning Order 2015 only requires the names and addresses for certificates of lawfulness of the register. The decision to publish names and addresses is for each council to take.
Inconsistent GDPR practices around the country
Yorkshire Bylines has discovered that the publication of personal data such as home addresses differs drastically around the country, calling into question whether the actions of councils are guided by national regulations.
Durham County Council oddly cite the ICO’s value of ‘transparency’ when it states:
“We will remove (redact) email addresses, telephone numbers and signatures before publishing them online, but your name and postal address will not be removed. Please do not include other personal or sensitive data within your representations.
“Your name and postal address is crucial so that we can establish who and where representations have come from, so comments can be given full weight and for transparency.”
Can an individual be identified from the public data?
On the other hand, Hull City Council automatically withholds names and addresses,
“Your comment if submitted electronically using Public Access will publish the content of your comment only – your personal data is automatically withheld from publishing such as – name, address, email address, telephone number.”
Birmingham City Council confirmed their position when they said that, “the name and addresses are redacted when public participation comments are released”.
Leeds City Council were even stronger in their protection of individuals, by not publishing any third party comments at all and before last year, they never published the names of individuals.
“From 6th June 2023 we made the decision to not publish any 3rd party comments made on planning applications on our Public Access (PA) website.
“Before this date we did publish comments but only the address of the person making the comment was available on PA and not their name.”
Response from North Yorkshire Council
North Yorkshire was contacted about this issue and their assistant director for planning, Trevor Watson, gave a brief response:
“We do not consider our procedure regarding the publication of representations to planning applications to be in breach of general data protection regulations.”
Yorkshire Bylines are awaiting a fuller response from the Information Commissioner’s Office, which told us today that we would have to wait for a calendar month as part of the process.
For vulnerable members of the public to have their home address made public on a planning application, viewable for up to a month, without their explicit consent, appears to limit freedom of expression in the best case and could be abused by those wishing them harm in the worst case. It may also be that as people move around the country, the publication of personal data may not be allowed by one local council, but by another, leaving them uncertain as to how their privacy is being handled.
*Name changed to protect anonymity
