Local government reorganisation (LGR) raises urgent data-protection questions.

It may not be clear who will be legally responsible for residents’ personal information, how to handle Subject Access Requests, what to put in new data-sharing agreements and how to keep everyone compliant while services move from one body to another.

Getting these questions right quickly and getting legal advice early avoids regulatory risk, service disruption and costly complaints or enforcement action.

We want to help you understand your legal obligations and the way that they are impacted as structures change.

Who is the data controller, joint controller and processor?

Who is the data controller, joint controller, or processor depends on who decides the purpose and means of the processing, not simply who holds the files.

• If your organisation decides why and how data is used, you are a controller.
• If two or more organisations decide together, you are joint controllers.
• If you only act on someone else’s instructions, you are a processor.

This distinction matters legally as it centres on different duties with different liabilities.

You should document roles in writing and seek legal advice before transferring or redesigning services.

You should not assume the successor authority automatically “inherits” controller status without paperwork and legal checks.

How does the law work?

Under the UK GDPR and the Data Protection Act 2018, the legal duties differ by role.

The data controller must lawfully justify processing by working to identify the lawful basis.

They must maintain records of processing, respond to data-subject rights, keep data secure, notify personal-data breaches to the Information Commissioner’s Office (ICO) where required and be accountable for compliance.

Joint controllers are when two or more organisations that decide the why and how together.

You must have a public, written agreement that clearly divides responsibilities and you must tell people which organisation to contact about their rights.

Both parties remain directly answerable to data subjects and the ICO.

The processor acts only on the controller’s instructions, must follow contract terms and has direct legal duties too.

Those duties are not optional and it is worth seeking professional legal advice to ensure you stay compliant with your obligations.

What happens at vesting day?

Structural Change Orders (SCOs) set the vesting day and transfer functions, property and records.

In many cases, the successor authority becomes the practical controller for services that transfer, but that outcome depends on how processing is actually carried out during and after transition.

If, during the transition, a shadow authority or combined authority and predecessor councils jointly determine policy or share decision-making about a dataset, the receiving party may be a controller (or you may be joint controllers) even before vesting day.

If a body simply hosts records while another authority sets policy, the host may be a processor.

What are the special categories and sensitive datasets?

Health, social-care, law-enforcement and pension/HR datasets often need specific legal gateways or exemptions and different handling.

Some transfers fall into Part Three (law-enforcement processing) or require statutory gateways.

You should view these datasets as bespoke and be sure to map them first, identify the correct legal basis for reuse and transfer and document the gateway in the DSA and any DPIA.

Be careful not to accidentally lump sensitive datasets into generic arrangements without legal sign-off.

Security, breaches and contractors

Controllers must ensure appropriate technical and organisational measures, including oversight of measures applied by processors.

If a data breach happens during transition, controllers or joint controllers may need to notify the ICO within 72 hours where there is a likelihood of risk to the rights and freedoms of data subjects.

Data subjects may also need to be informed where there is a high risk to their rights and freedoms.

Processor contracts must include timely notification and co-operation obligations.

Why you must take action now

The status of controller, joint controller or processor has real legal implications that need to be managed effectively.

They involve different duties, different liabilities, different timelines for responses and reporting and potential fines or enforcement by the ICO.

LGR brings complexity and political change so seeking expert legal advice is essential for staying compliant.

For help understanding how data protection may be impacted by devolution, be sure to get in touch with our expert team today.

We are hosting a webinar on this topic, the details of which can be found here. If you’re looking for more information or require legal advice, this is a good place to start! 

If you have any questions on the matters raised above, please do contact Kate Edwards or Claire Jones by e-mail Kate-Edwards@birketts.co.uk or Claire-Jones@birketts.co.uk

In them, Claire Jones, Legal Director in the Public Sector Team at Birketts, will interview a series of partners and senior lawyers across the firm. She’ll ask how the forthcoming unitarisation of local government will affect councils currently working within a two-tier system.

You can see an introduction to the series here.

Featured topics include:

LGR and employment matters

• webinar recording
• introductory article

LGR and governance

• webinar recording
• introductory article

LGR and real property to follow

LGR and planning law to follow

• webinar recording
• introductory article

The legal framework for unitarisation isn’t new and the process used to achieve LGR was established under the Local Government and Public Involvement in Health Act 2007.

We will be looking at that legislation, associated regulations and what we know about Government’s proposed approach. We will share that with you over the coming weeks.

Most of the questions our clients ask us in relation to LGR relate to what they can be doing to prepare, what the next steps might be and what we can tell them about councils that have been through the process.

Our aim is to answer as many of these questions as possible over the coming series and so please do get in touch and let us know if there are specific questions you would like us to answer.

Many of the queries received from our clients so far relate to employment law matters and we have discussed some of the key issues in our bitesize webinar.

The key legislation for unitarisation is set out in the Local Government Public Involvement in Health Act 2007, and the regulations that have been made under that.

The Local Government (Structural and Boundary Changes) (Staffing) Regulations in 2008 make it clear that the Transfer of Undertakings (Protection of Employment) Regulations 2006 (known as TUPE) would be deemed to apply on unitarisation, even though the wording of the TUPE Regulations do not necessarily on their face apply.

The position does remain unclear however, until we know what ministers are going to determine in respect of the current LGR process, as there is an indication that a ‘continuing authority’ model may be applied.

This means that an authority continues in the way that it has done previously, albeit with the need to consider where there might be some duplication of roles and the differences that will come into effect because of an amalgamation of entities bearing that same geographical footprint. It is therefore difficult to give any clear guidance on the application of TUPE to unitarisation at this stage as it will differ depending on the new unitary authorities to be put in place and ministers’ approach.

Despite this, there are practical things that existing authorities can start doing now and human resources teams can audit the workforce currently in place to ensure that its records are up to date. However, this does come with a health warning. Authorities must be careful about making any particular changes in advance of a potential transfer, because if TUPE is deemed to apply to unitarisation, making changes to a workforce in anticipation of a transfer can be unlawful.

Key questions for local authorities to consider now are:

• What staff have we got?
• What do our staff do?
• Where have we got people carrying out particular functions?
• What are they doing that might have differed from their original job descriptions and things that they were employed to do?

A general audit as part of an authority’s due diligence processes will help to understand the staffing levels and challenges they have now, so that they can start to think about what might be required in the future.

A particular point to consider is duplication of existing roles in the workforce and what the Authority requires now, with this being an opportunity to tidy up the existing operation (where this can legitimately be done without it being linked to a potential TUPE transfer).

We recommend that authorities think about employees who need to be managed from the point of view of current performance and capability, and work on those carefully and diligently in accordance with all the correct legal processes. This will avoid bringing employees whose employment might have ended earlier across to any new unitary authority. Care must be taken to ensure that the authority is not taking any steps solely because there might be a transfer, because that could be unlawful should TUPE apply. Pure performance issues could however be managed in their own right.

The same applies to issues of ill health. There could be staff who have had long term sickness absence at the authority, and this may be an opportunity to look at this issue across the organisation and identify whether any steps should be taken properly and lawfully in accordance with the authority’s own capability management procedures for ill health.

Authorities could also be having good communications with employees now and ensure that relationships with relevant trade union bodies are as good as they can be, as they will be a pivotal part of any negotiations in the future about changes to terms and conditions or redundancy processes that may need to take effect in any reorganised entity. A positive relationship with the trade unions now will only stand you in good stead for the future.

We have a recorded a bitesize webinar to explore these issues in more detail. To watch the webinar recording, please follow this link.

If you have any questions on the matters raised above, please do contact Sonya O’Reilly or Claire Jones by email at Sonya-oreilly@Birketts.co.uk or Claire-jones@Birketts.co.uk.