Disclosure of personal details by a local authority on its website [08/04/2010]
I received a complaint from a member of the public towards the end of 2008 regarding the disclosure of personal data submitted as part of an application for planning permission to a local authority.
Background
(i) In the latter part of 2006, my Office entered into discussions with the Department of the Environment, Heritage and Local Government in an effort to establish an appropriate balance between an open and transparent planning system and the rights of individuals to privacy and data protection. Following these discussions, the Minister for Environment, Heritage and Local Government signed the Planning and Development Regulations 2007 (SI 135 of 2007). Amongst other things, these regulations introduced an amended planning application form. The amended form re-arranged the address/contact details section from the front of the form to a detachable page at the rear of the form to ensure that these personal details could be removed prior to the publishing of planning applications on the planning authority's website.
(ii) The Department of the Environment, Heritage and Local Government also issued Development Management Guidelines for planning authorities which, among other things, recommended the use of a Robots Exclusion Protocol (this is a simple protocol that, when placed on a web page, reputable search engines do not then proceed to index the page for inclusion in search results) by all planning authorities in relation to planning application data on their website to protect personal data on those websites from search engine access.
Complaint
In this case, the complainant completed the planning application form and provided the planning authority with his contact details on the detachable part of the form. However, the information supplied in this section was subsequently made available to the public on the local authority's website.
My Office contacted the local authority involved and asked it for its comments on what led to the publication of the contact details on the website and if it had implemented a Robots Exclusion Protocol to prevent personal data appearing on search engines.
In reply, the local authority informed my Office that, on this occasion, its procedures which it had in place to comply with the data protection requirements did not operate and that as the procedures were relatively new, the physical removal of the contact details portion of the planning application form was overlooked. It also indicated that the procedures had since been strengthened to ensure compliance with the data protection requirements. The response also indicated that the local authority had not yet implemented a Robots Exclusion Protocol and that it was currently being considered. At that point, my Office made it clear to the local authority that, given the passage of time since the Department had published its Development Management Guidelines in 2007, we found it unacceptable that a Robots Exclusion Protocol had not yet been put in place. We pointed out that by not having it in place personal information of individuals making planning applications continued to be at risk of being picked up by search engines when the applications were uploaded onto the websites. The local authority was instructed by my Office to put in place a Robots Exclusion Protocol immediately and failing that, I would use whatever legal powers I deemed necessary to protect the personal data of those individuals who submit planning applications to that local authority. My Office subsequently received confirmation from the local authority that a Robots Exclusion Protocol had been put in place.
The complainant in this case requested a formal decision under Section 10 of the Acts. My decision found that the local authority had contravened Section 2(1)(d) of the Data Protection Acts when it published, on its website, the contact details which the planning applicant had submitted on part of the planning application form. It breached this requirement by not having in place appropriate measures to prevent the unauthorised disclosure of the planning applicant's contact details.
This case demonstrates the need for local authorities to be extra vigilant when uploading planning applications to their websites to ensure that only the information required by law to be made publicly available is published in this way. In addition, having a Robots Exclusion Protocol or similar in place guards against the risk of the planning applications themselves being captured by search engines.