ICO warns councillors of need to register as data controllers; threatens fines

The Information Commissioner's Office (ICO) is to write to all councillors in England to remind them of their need to register as data controllers if they are handling personal information.

Six thousand councillors are already registered as data controllers, but the ICO estimates that as many as 13,000 are failing to fulfil their obligations. While not all councillors will need to notify with the ICO, failure to do so when required is a criminal offence and, if convicted, defendants can face a fine of up to £5,000 in the Magistrates Court or an unlimited fine in the Crown Court.

The ICO said that councillors need to consider the role in which they are processing personal information. If they are carrying out their role as a representative of the residents in a ward or an independent councillor who is not affiliated to any political party a councillor, they may need to notify. However, if a councillor is only handling personal data in their role as a member of the council or as a representative of a major political party, they will not normally be required to notify with the ICO.

Simon Entwisle, Director of Operations at the ICO, said:"Most councillors have regular access to the personal information of the residents they represent. Like all organisations who handle people's information, it is of paramount importance that they take their responsibilities under the Data Protection Act seriously. We will be writing to councillors with advice on whether they need to notify with the ICO. Those who fail to notify with us when required may face enforcement action."