Where a parish council website has published unredacted Register of Interests forms of all its members, in a way which openly displays all the entries completed by hand and all of the councillors' respective personal signatures, which as it happens is followed by a number of phishing emails purporting to be from the chairperson, clearly this must be a GDPR breach that warrants a risk assessment; but can the council - whether as part of an agreement to resolve complaints or potential claims by affected members, or just on its own initiative - require all of its members and staff to undertake training on data protection? What if tries to do so but some councillors for whatever reasons refuse to attend the training, which would prevent a resolution of the complaints or claims? Is there anything a monitoring officer or anyone else can do to ensure all of the councillors are provided at least basic awareness of data protection obligations and information rights?
