GDPR - am I a data controller?

[Derek Grim]

I have requested to inspect the accounting records of my Local Authority. This is something all electors are entitled to do by law (Local Audit and Accountability Act 2014 and Local Audit (Public Access to Documents) Act 2017).

The Authority is being quite obstructive. In particular, they are trying to get me to sign an agreement stating that I confirm I accept that I will have the same responsibilities as a Local Authority Data Controller under GDPR when inspecting the records. This means that I must not disclose any personal data from the records on social media or pass it to newspapers etc. I can't say I have any intention to do this anyway, as my reasons for inspecting the acconting records are quite mundane. However, what if I do come across information showing that a Councillor has, say, misused thousands of pounds of taxpayers cash, such as claiming personal items on expenses? Surely revealing that information would be in the public interest, no? But the 'agreement' would prevent me from disclosing this info. It basically states that I must only use personal information for the purposes of submitting a formal complaint through the Authority's own complaint procedure. Beyond that, I would have no right to publish anything (or, if I did, I would just have to refer to 'Councillor X' rather than disclose their name!).

So is it right that the Authority designates me as a data controller under GDPR? At the end of the day, I am just a local elector seeking to view the accounts.

[islandgirl]

I can see they have to protect themselves from data breach problems. If you DID find anything of this nature you could tip off a local journalist and tell them where to look...you would not be disclosing it, just suggesting someone does the same as you did - you can just say it would be "in the public interest". The paper will have lawyers who can deal with that kind of stuff!

[echat11]

It's standard protocol, but if you find some 'fraudulent activity' you'd have to inform the authorities i.e. police etc.

I think they want to protect information that belong to other parties, that you would have access to. You could always 'whistle-blow' although not employed.

https://www.gov.uk/government/public...ple-and-bodies

[R0b]

Interesting question Derek, never come across this piece of legislation before. I have looked at the Local Audit and Accountability Act 2014 and I think it is section 26 that gives the right for you to inspect and audit the accounts.

From what I've read you can inspect and make copies of:

26(1) ... accounting records for the financial year to which the audit relates and all books, deeds, contracts, bills, vouchers, receipts and other documents relating to those records

But there are certain restrictions which are set out in section 26(4) to (9) and see particular my emphasis on (6)-(8):

(4) This section does not entitle a person—

(a)to inspect or copy any part of any record or document containing information which is protected on the grounds of commercial confidentiality, or

(b)to require any such information to be disclosed in answer to any question.

(5)Information is protected on the grounds of commercial confidentiality if—

(a)its disclosure would prejudice commercial confidentiality, and

(b)there is no overriding public interest in favour of its disclosure.

(6)This section does not entitle a person—

(a)to inspect or copy any part of any record or document containing personal information, or

(b)to require any personal information to be disclosed in answer to any question.

(7)Information is personal information if it identifies a particular individual or enables a particular individual to be identified (but see subsection (8)).

(8)Information is not personal information merely because it relates to a business carried on by an individual as a sole trader.

(9)Information is personal information if it is information about an officer of the relevant authority which relates specifically to a particular individual and is available to the authority because—

(a)the individual holds or has held an office or employment with that authority, or

(b)payments or other benefits in respect of an office or employment under any other person are or have been made or provided to that individual by that authority.

Basically, it appears to me that you are not obliged to sign any form of agreement. I would challenge them and explain that there is no legal requirement for you to sign a data processing/sharing agreement under the Local Audit and Accountability Act 2014 and in fact it explicitly states a relevant person is not entitled to inspect/copy personal information. In short, they need to stop being awkward and let you access otherwise you can exercise your rights which may include legal proceedings (if you are inclined to go that far) and ask the court to make an order forcing the authority to give you access.