Councillors as data controllers

Lancashire County Councillors can also be data controllers but this depends in what capacity they are working in:

• As a member of the council, for example, as a cabinet member or a member of a committee. In this circumstance the council is the registered data controller. Personal information held by the council will not be used for political purposes unless both the council and the individuals concerned agree.
• As a representative of residents of their ward, for example, in dealing with complaints. In this circumstance, the councillor is the data controller. Whilst Councillors are considered to be 'data controllers' for constituency casework purposes, they are exempt from payment of the Information Commissioner's Office registration fee, with a few exceptions such as if councillors are personally responsible for of any kind of CCTV, either recording or live feed cameras. All Councillors take into account the context in which personal information is collected to decide whether their use of the information will be fair and lawful, as required by the first data protection principle. Where a councillor is representing an individual resident who has made a complaint, the councillor will usually have the implied consent of the resident to retain relevant personal data provided and to disclose it as appropriate. The resident will also expect that the organisation who is the subject of the complaint will disclose personal data to the councillor. If there is any uncertainty regarding the resident’s wishes, it will be appropriate to make direct contact with the resident to confirm the position. Special Category information, such as health data, racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation is treated differently, and to process this data the councillor will always obtain your explicit consent.
• They may represent a political party, particularly at election time. In this circumstance, the political party will be the data controller. When campaigning for election as the representative of a political party, candidates can use personal information, such as mailing lists, legitimately held by their parties. However, personal information they hold in their role as representative of local residents, such as complaints casework, will not be used without the consent of the individual. When campaigning for election to an office in a political party, councillors will only use personal information controlled by the party if its rules allow this. Candidates for election are also aware that political campaigning falls within the definition of direct marketing. Consequently, they have regard to the requirements of data protection legislation and the Privacy and Electronic Communication (EC Directive) Regulations 2003 which set out specific rules that must be complied with for each type of marketing communication.

All councillors will comply with the council's information governance policies and data protection legislation including the UK general data protection regulation (UK GDPR). Personal information will be processed in line with data protection legislation and will be kept for as long as it is required to be retained. The retention period is either dictated by law or by the councillors' discretion. Once your information is no longer needed it will be securely and confidentially destroyed.