Is this anything to do with GDPR?

Question

I have been told it might be related to GDPR but surely if someone provides a service for a public body then they do so in the knowledge it has to be transparent, they are after all being paid with public money and need to submit an invoice for payment.

Answer 1

No. The Transparency Code for Smaller Authorities include sections on Data Protection and Commercial Confidentiality. It's worth reading the whole text to understand the context, but for brevity:

"The Government believes that local transparency can be implemented in a way that complies with the Data Protection Act 1998."

"The Data Protection Act 1998 also does not automatically prohibit information being published naming the suppliers with whom the authority has contracts, including sole traders, because of the public interest in accountability and transparency in the spending of public money."

"The Government has not seen any evidence that publishing details about contracts entered into by smaller authorities would prejudice procurement exercises or the interests of commercial organisations, or breach commercial confidentiality..."

Some councils have endeavoured to keep secret the salary of the clerk, but in a small council with only one paid member of staff, this will be shown as a separate item on the Annual Return. I have always taken the view that it's not our money we're spending, so we should provide the public with the same information we provide to the members of the council.

Answer 2

GDPR does not impose a blanket ban on the disclosure of personal data.  But it does require consent from data subjects (people who have provided some of their personal data)  to process personal data beyond the legitimate purpose for which that data was collected,   It could be argued that complying with Transparency codes is a legitimate purpose.  A council  could stipulate what personal data they wish to declare with respect to the code to any potential supplier, and make it conditional that the supplier agrees in order to be chosen to provide the services etc,.

Comments

If the Council is relying on legitimate interests and also making it clear to suppliers how their data will be used, no consent is required.

Answer 3

I doubt whether GDPR could be used to justify withholding all details.  It only applies to the personal information of living individuals.  Many of the payees will be corporate bodies (eg limited companies) and therefore won't class as living individuals and won't be covered by GDPR.

The purpose of GDPR is not to stop sensible things happening, but to ensure that organisations treat individual's information fairly and in a transparent manner. As other replies have highlighted, you would almost certainly be able to find a lawful ground for processing financial information as part of the main agenda (for example public interest, consent, legal requirement or legitimate interests of the PC are all lawful grounds for processing under GDPR) and your privacy notice could make it clear to tendering contractors that the payments will be made public thus meeting the transparency requirements..

Comments

One issue is that some people use their name for their self owned business,  e.g. John Smith accountancy services or  Chris Brown Aerials etc. My  TC mistakenly refused to provide  the name in such circumstances but she actually made it public on her face book page that she had got more work for the TC!