Do Councillor have a 'right' to read Parishioners letters of complaint?

Question

When a parishioner writes to the Council via the clerk about an issue, should councillors have access to read the full letter?

Answer 1

The short answer is yes.  Cllrs should be made aware of all correspondence received and have access to read it if they so choose. They are responsible for the operations and actions of their council and can't exercise that responsibility if the Clerk or Chair obstructs access to correspondence.

Answer 2

If you have a Complaints Committee or similar then it should go to them in the first instance. If you don’t then yes full council should see BUT only keep the name.

If there is an email address, telephone number or home address that should be kept private to the Clerk as GDPR states only if that NEEDS sharing should be shared.

Comments

The personal data of the complainant must be processed in accordance with the 11 Articles of the GDPR regulations 2018. Although the Clerk is usually the data controller, the issue is one that the whole Council has responsibility for. If a letter came from John Smith, Cllrs might ask, is this a bogus letter? Is it from an address in the Parish?  What is the substance of his complaint?  DO you want the clerk to spend time redacting everything? Accordingly I don't agree that there is a blanket one size fits all rule that only the Clerk can see the personal data. The important thing is how the data is used, by who, and what steps are in place to dispose of it once there is no need to retain it.

---

Hi Graeme_r

I’m not saying there’s a blanket approach but you must appreciate that when people respond they may (like me) work in areas with a speciality and therefore comment accordingly. To mix messages isn’t helpful.

The Data Controller has to determine in line with legislation what information other people NEED. If John Smith of 123 Plymouth Rd, Plymouth PL12 3MT 07123456789 is complaining about Grass not being cut or a sign the PC have put up then the information does NOT NEED to be shared.

If they are complaining about the PC objecting to an extension on the above address then I would argue it is relevant.

---

I would contend that the data controller role is  to control the purpose for which, and the manner in which, personal data is processed. Simply showing it to other cllrs by for example passing round a photocopy of the letter or displaying it on a screen in a conference room does not imply it has been processed by Cllrs.  If Cllrs make their own private copies of personal data that is a different matter.  However, they should all be aware of their obligations under GDPR and should not be

---

Hi Graeme_r
Shall I pass your details on to my Director to take my job as You clearly know better than me on GDPR.
Btw I’m head of legal for a multi-national train manufacturer.

---

If you can quote any legislation that supports your view of the role of the data controller, by all means please do.  My view of the role of a data controller is derived from this. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/controllers-and-processors/what-are-controllers-and-processors/

---

Hi Graeme-r I admire you persistence. As I said I am more than happy to discuss with my Director your appointment whilst I take leave.

I have provided the Correspondent with the relevant advice and I’d like to think my education and resume speaks for its self.
The process is not complicated and shouldn’t attempt to be made complicated. My suggestion is if you disagree then follow your own path and accept any ramifications should there be any.

---

Sorry I have no interest in sitting in for you! I note whilst promoting your reputation you haven't availed yourself of the opportunity to provide relevant clauses of legislation to reinforce your assertions and prove mine to be flawed in respect of  personal details of correspondents to the council and the role of a data controller. Perhaps you think the information commissioner is unreliable source?  Maybe you might like to consider this https://ico.org.uk/for-organisations/in-your-sector/local-government/local-gov-gdpr-faqs/

---

Hi Graeme, like you I've found myself questioning Chloe's interpretation of data protection legislation on previous posts and received similar "don't you know who I am" responses.

 The data controller here is the Parish Council, not the Clerk. The complainant's details should only be shared with those who need to know. The Parish Council as data controller is responsible for deciding who that is. It may be comfortable that only the Clerk needs to know but it may not. To that extent, Chloe's initial advice that only the Clerk can see the information is too simplistic (I note that she has rowed back a little in her subsequent response).

---

WRONG!!!

I’m simply informing you of fact, if you feel that you know better than that is up to you. HOWEVER I am informing you that my education and career is legal. If you have equal knowledge (in this case you clearly don’t) then great. However I’ve always been taught to respect where people know best.

The council is NOT the data controller. As grey an area as GDPR is, it is not difficult.

The law states that ONLY necessary information should be shared with ONLY the necessary parties.
Therefore a person complaining about about bin emptying for example should NOT have their email address, home address or telephone number shared, it is unnecessary!!

If a complainant provides name, address etc etc and is complaining about the councils objection to their planning application and you have a complaint committee AND planning committee then could argue that each committee can have access to the details as it could be deemed necessary.

As I said it really, really isn’t hard.

---

Thanks Smallb34r. It's not just me then.  As you remark, "Sharing"  in the context of GDPR  refers to one organisation providing or withholding personal data with another in accordance with the appropriate articles, not limiting who within the same organisation can view (but not necessarily process) personal data. This link provides more relevant info  https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en  Chloe insists she is right and isn't happy about being challenged. Rather than cite appropriate legislation to support her assertions, she continues to resort to diversionary measures essentially saying how eminent she views herself to be. Accordingly it is pointless arguing with her any further

---

Very very much the opposite Graeme_r I welcome, appreciate, applaud and encourage healthy challenge.

---

I'm sorry that you disagree. Your assumptions that you are better qualified than me are wide of the mark. I would urge anyone interested in this thread to call the ICO directly. They are friendly and helpful and you can rely on their advice in the event of a complaint.

---

However, I would not hold my breath for any definitive response from the ICO in relation to any concern you may wish to formally raise with them in this regard.