Senedd Cymru (Members and Elections) Bill: data protection impact assessment

The Local Democracy and Boundary Commission for Wales (LDBCW) is an independent Welsh Government sponsored body. Amongst its current key functions is that of  publishing a programme of work which keeps under review the electoral arrangements for the 22 principal councils in Wales. It is required under existing legislation to carry out reviews of the electoral arrangements for Wales’ principal councils at least once every 10 years.

The Welsh Government’s proposed Bill relating to Senedd Reform would confer functions on the existing Local Democracy and Boundary Commission for Wales (LDBCW) to similarly undertake Senedd boundary reviews that will determine Senedd constituencies for the 2026 Senedd election and beyond (to note, it is intended that the legislation will also rename the body to reflect its new responsibilities). The legislation will state the rules and procedures the renamed LDBCW will need to follow to conduct Senedd boundary reviews.

It is intended that as part of those provisions, there will be a requirement for the renamed LDBCW to propose constituencies within a variance range of an electoral quota – calculated by reference to the number of local government electors in Wales on the review date (as divided by the number of Senedd constituencies). This will therefore require the renamed LDBCW to review electoral register data, to ensure that their proposed new constituencies are within that variance range. The electoral register to be used is to be local government electoral registers (given that the persons entitled to vote at Senedd elections are those who would be entitled to vote as electors at a local government election in Wales - as a result of the provision made in section 12 of the Government of Wales Act 2006).

The renamed LDBCW could undertake this work by either reviewing full electoral registers, which include details such as names, addresses, and electoral numbers (the LDBCW already has access to the full local government electoral registers due to its existing responsibilities for local government electoral reviews - the legal basis of which is Representation of the People (England and Wales) Regulations 2001, specifically regulation 101(2) and (3), which requires each registration officer in Wales to supply, free of charge and on publication, copies of registers to the Local Democracy and Boundary Commission for Wales). Or alternatively, the renamed LDBCW could undertake this work by requesting redacted version of electoral registers from Electoral Registration Officers, which is the practice utilised by the LDBCW as part of its existing responsibilities. Given this is an option, the proposals therefore don’t necessitate the renamed LDBCW to process personal data for the purposes of proposing constituencies within a variance range of an electoral quota, as they could undertake this work without processing personal data i.e. by requesting redacted versions of electoral registers (which, as set out above, is current practice).

Discussions with the secretariat of the LDBCW suggests they will continue with the above practice of requesting redacted versions of electoral registers as part of their Senedd boundary review work, therefore the proposals do not require the processing of personal data. However, should this change and the LDBCW decide to use the full electoral registers (which is a possibility as the legislation will not state the renamed LDBCW must use redacted versions of the registers, (or conversely must use full registers)), that would be the LDBCW’s decision, which would then be required to ensure that any processing of personal data is done so in compliance with UK GDPR.

Given that it involves a comparable statutory regime, it may also be helpful to refer to current arrangements for the 2023 UK Parliament boundary review conducted in Wales by the Boundary Commission for Wales (BCW), which shares the same secretariat as the LDBCW. The legislation covering the rules and procedures of the UK Parliament boundary review also includes a requirement for the BCW to propose constituencies within an electoral quota variance, which therefore entails reviewing electoral register data. As is indicated in the BCW’s privacy note, where they receive electoral roll data, they specifically request that it does not contain any personal information, and that in the event they do receive personal details from local authorities they would immediately be deleted.

To summarise therefore, the proposals don’t necessitate the renamed LDBCW to process personal data for the purposes of proposing constituencies within a variance range of an electoral quota.

The provisions will also include a requirement on the renamed LDBCW to consult on its proposals, where people will be invited to provide comments on LDBCW’s proposals. The requirement to consult is considered necessary so that the views of people are taken into account as part of the boundary review process. It is a standard practice for boundary reviews that take place across the UK.

The legislation will not place a requirement for the LDBCW to process personal data as part of this requirement to consult (it will be for the renamed LDBCW to decide on the specific processes involved). However, when considering the potential effect of the legislation in practice, it is difficult to envisage consultation that doesn’t involve the processing of some personal data.

For example, the renamed LDBCW will likely want to understand local opinion about proposals accurately in order to increase the likelihood the final recommendations will be generally acceptable to the majority of those who live in the proposed constituencies, therefore location data may be helpful for the LDBCW to undertake its work. It is envisaged that individuals could also volunteer personal data whilst responding to the consultations, and this could include data such as names, addresses, phone numbers and email addresses. This means that the renamed LDBCW will be processing personal data whilst fulfilling its obligation to consult (even though the legislation does not state that personal data must be captured).

As part of the consultation process, it is also proposed that the renamed LDBCW will be required to hold public hearings - the purpose of which will be to enable representations to be made about its proposals. This may therefore result in the processing of personal data by virtue of applications to attend, and oral representations made, at such hearings.

The legislation will also place a requirement on the renamed LDBCW to publish responses to consultations and representations made at public hearings. This is considered necessary to ensure maximum transparency and credibility for the review, as the renamed LDCBCW’s proposals will be implemented automatically (by subordinate legislation made by the Welsh Ministers) without any Senedd procedure. It is therefore considered important that people are able to see the representations received which informed the LDBCW’s proposals.

The renamed LDBCW is expected to publish the responses with all personal information redacted, with appropriate processes in place to ensure any published information is anonymised. This reflects existing practices undertaken by the LDBCW, which publishes a summary of consultation responses as part of both community and electoral reviews. For the former, potential respondents are made aware that the LDBCW will publish all representations received in full, with personal information redacted from members of the public (but that names are published alongside representations made in an official capacity). The LDBCW’s guidance document for electoral reviews states that:

A summary of every representation the Commission receives is published in an appendix in the Commission’s Draft Proposals and Final Proposals Reports. The Commission has a policy that members of the public will not be named in the summaries of representations that will be published in the reports. The Commission will ascribe the locale of their residence to the representation summary.

It may also be helpful to again refer to current arrangements for the 2023 UK Parliament boundary review conducted in Wales by the BCW. The legislation covering the rules and procedures of that review also includes a requirement for the BCW to consult on their proposals, and to publish representations made.

BCW Data protection and privacy policy
BCW publication of redacted versions of representations made.

Yes (but as stated above the Senedd Reform legislation will not place a requirement for the LDBCW to capture personal data as part of consultation arrangements, but the effect of the legislation in practice will likely mean that the renamed LDBCW will be processing personal data whilst fulfilling its obligation to consult).

Please tick the personal data items that will be processed (this list is not exhaustive):

(To note, the below reflects what we consider is reasonable to expect the renamed LDBCW could be processing as part of the consultation process).

Personal

• Name
• Name address
• Business address
• Postcode
• Email address
• Telephone numbers
• Date of birth

Special category

(To note, the LDBCW will not require or request any of the below, however as indicated in the comparable BCW’s privacy notice , data on political affiliations or religion for example may be volunteered in consultation responses and during attendance at and representations made at public hearings.

It is proposed that the Bill will specifically enable representations to be made by each political party registered under Part 2 of the Political Parties, Elections and Referendums Act 2000 and which either has at least one Member of the Senedd or received at least 10% of the votes cast in the most recent general election.

It could also be argued more broadly that respondents could volunteer any of the below (apart from biometric data) as part of their written responses or at public hearings because representations is also to be allowed at such hearings by any other person considered by the chair to have an interest in any of the proposals with which the hearing is concerned).

• Political opinions
• Religious / philosophical beliefs

If special category personal data is being processed, is this data being collected mandatorily (i.e. without the data subjects having an option to not provide it)?

No

Do any of the data subjects whose personal data will be processed fall into the following categories?

• Children (under the age of 12)
• Patients
• Asylum seekers
• Welsh Government employees

The consultation will be open to all, therefore we cannot categorically rule out any of the below responding to the consultation and volunteering personal data.

Please give an indication of the scale of the processing (e.g. pan-Wales; targeted group)

Pan-Wales - as outlined above, the consultation will be open to all.

For the personal data being processed, please indicate:

Who the data controller is?

Local Democracy and Boundary Commission for Wales (to be renamed)

Any data processors?

The Bill will not make any provision as regards this but it is expected that given the personal data will be stored on the LDBCW’s IT infrastructure, it will also be shared with LDBCW’s data processors who provide email, and document management and storage services. (This reflects what is included in the Boundary Commission for Wales’ privacy notice – which shares a Secretariat with the LDCBW).

Will the data be shared?

See above. It is not anticipated that the LDBCW will share personal data with other organisations. (This again reflects what is included in the Boundary Commission for Wales’ privacy notice).

What is the statutory basis for processing the data?

NB – GDPR itself does not provide a statutory legal basis to process personal data.

The proposed Bill relating to Senedd Reform will provide the basis for Senedd review boundary processes which will include a requirement to consult on its proposals and for that consultation to include public hearings.

The ‘lawful basis’ for processing personal data by the LDBCW is the ‘public tasks’ basis, that is, ‘the processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller’, in accordance with Article 6(1)(e) of the UK GDPR.  Section 8 of the Data Protection Act 2018 supplements Article 6(1) of the UK GDPR by providing a more specific list of examples of ‘public tasks’. For the LDBCW, their processing activities will likely fall into the example at section 8(c) of the 2018 Act which provides ‘the processing of personal data is necessary for…….(c) the exercise of a function conferred on a person by an enactment of a rule of law’.

When the LDBCW is processing ‘special category data’ an additional basis is needed under Article 9 of the UK GDPR. For the LDBCW, this is likely to be Article 9(2)(g) of the UK GDPR (the ‘substantial public interest’ condition) again this is supplemented by the 2018 Act. Section 10 provides that when relying on ‘substantial public interest’ requirement in Article 9(2)(g) UK GDPR, one of the ‘conditions’ in Part 2 of Schedule 1 of the DPA 2018 must also be met. For the LDBCW, this is likely to be Paragraph 6(2)(a) of Part 2 of Schedule 1, that the processing is necessary for ‘the exercise of a function conferred on a person by an enactment’.

Have legal services confirmed that the basis outlined above provides the necessary statutory gateway for processing (including any proposed sharing)?

Yes

Will the proposal involve new or significantly changed processing of personal data about each individual?

Yes. The processing of personal data by LDBCW for the purpose of Senedd boundary reviews will be new, however it should be noted that the processing involved is similar to existing consultation arrangements for local government electoral reviews.

Will the personal data be consolidated, linked or matched with data from other sources?

No

Will the personal data be used for automated decision making?

No

Will the personal data result in systematic monitoring of data subjects?

No

Does the proposal involve new or changed data collection, retention or sharing policies/practices for personal data?

No

Do you have a clear retention policy and what practical things are in place for you to ensure that your Retention Policy is applied?

Yes. For any personal data collected for the purposes for Senedd boundary reviews, we expect the LDBCW to follow the same retention policies as is currently the case for any personal data collected for local government electoral reviews.

Will the proposal involve the introduction of privacy-intrusive technologies?

No

Will the proposal involve new or changed identity management or authentication processes?

No

Will the proposal have the effect of enabling identification of individuals who were previously anonymous?

No

Is a data protection impact assessment (DPIA) required for this proposal?

No. The proposal does not meet the criteria for a full DPIA.

Has advice on General Data Protection Regulation (GDPR) compliance been provided?

No

Does the proposal require a Privacy Notice to be drafted?

No

Does the proposal require consultation with the ICO under GDPR Art 36(4)?

Yes

Does the proposal require a contract between Welsh Government as data controller and a third party processor?

No

Does the proposal require a data sharing agreement to be drafted?

No