General Data Protection Regulation (GDPR)

With the imminent arrival of the General Data Protection Regulation (GDPR), I’d like to share this conundrum with you with regards to long term empty properties, and would appreciate your views on the same.


My understanding is that by using S85, para 18a, schedule 2, of the Local Government Finance Act 1992 we can lawfully obtain from council tax records, details of all long term empty properties, and the name and address of the owners.


However, the issue under GDPR, would appear to be what we can then do with those details.


I have been advised that using the council tax data to create a mail shot to contact the owners of long term empty properties (offering help and advice in order to bring the property back into use etc.) will be classed as “marketing”, and subsequently fall foul of GDPR.


In short, unless the owner of the empty property has given consent to be contacted by the council about help and advice for long term empty properties, then we can no longer carry out the mail shot.


I understand that legislation allows “taking steps to bring vacant dwellings back into use” but am unsure how this can be interpreted within the constraints of GDPR.


Hi Paul,

Does this mean that we canont write to owners on a one to one basis, stating;

that  we are aware that the property is vacant.

Ask them what their plans are to bring the property back into use

Give them options to consider i.e. Rent privately or via the council or sell.

Let the know that there are grants avaialbe.

Tell them about possible enforcement action that can be taken.



I beginning to form the view that we can lawfully obtain a list of empty properties across the borough from our Council Tax team...but what we can actually do with that data is another issue.

I suspect that if we are dealing with a complaint regarding a specific property and exercising specific enforcement powers then we can use the data.

I further suspect that once GDPR comes into effect, in about a month’s time, we will no longer be able to use the Council Tax data to write to the owners of long term empty properties offering help and advice, as they have not been given the opportunity to “opt in” to receive communications from the council. I am advised that such an approach will be deemed as marketing under GDPR.

From carrying out some research, it would appear that if GDPR is breached, then liability lands firmly at the feet of the person (or in our case the officer) responsible for causing the breach to occur, who in turn is likely to have to pay a substantial financial fine.



Paul Tobin

Private Sector Housing

Swale Borough Council


It is essential that we all understand the GDPR properly as there are a lot of assumptions being made about what the implications are for a number of functions exercised by local authorities.  In many cases these appear to be false assumptions once you look at the guidance. For example, the GDPR does not prohibit marketing, and consent is not required where you have established a 'lawful basis'.  I would recommend people visit the very user friendly ICO website and GDPR toolkit, which covers the 6 ‘legal basis’ for the processing of personal data -

The key part of the GDPR for empty property practitioners working for public bodies, in relation to the processing of empty property data from Council Tax (under s83 of the Local Government Act 2003), seems to be lawful basis no5 (‘Public Tasks’)

The GDPR is clear that public bodies can rely on the ‘Public Tasks’ lawful basis if you need to process personal data:

  1. ‘in the exercise of official authority’. This covers public functions and powers that are set out in law; or
  2. to perform a specific task in the public interest that is set out in law (SUCH AS s83 LGA 2003)

Legal basis no3 covers ‘Legal Obligations’ (common law or statute law) which will cover other areas of empty property work, but not s83 as it is a 'power' not a 'duty'.  The ‘Public Tasks’ lawful basis has been created specifically to reflect the wide range of valuable functions that are exercised by public bodies, including empty property work.

    Importantly, and as applies to the whole of GDPR, the processing must be necessary. If you can achieve the same purpose without processing personal data, the processing will not be lawful.

    The webpage above helpfully provides a checklist for ensuring you meet the ‘Public Tasks’ test and as this should be documented in a privacy notice.  Maybe there are LA's that have already drafted a GDPR 'PN' for this purpose and would be willing to share?  We are not yet one of them!

    I am confident GDPR will not mark the end of ‘marketing’ of support to empty property owners where details have been provided by Council Tax, but we do need to fully understand and document the legal basis for our activities and ensure that data subjects (i.e. recipients of the marketing/owners) are informed of their rights at the time you process their data (write to them). Further information

    Data subjects have a right to object even if you are processing the data in order to perform a legal task. As far as I can see you can continue to process their data if you can demonstrate that there are "compelling legitimate grounds" which "overide the interests, rights, and freedoms of the individual".  I think this would be quite easy to argue as empty property work exists to increase the supply of housing for the benefit of the whole community and to support a housing trategies.  However, we would really need to consider whether there was any value in forcing marketing of support on an individual who didn't want to receive it (I would suggest not), and we would be better off considering whether other forms of action were more appropriate.

    This is how I see it but please someone let me know if I have got it wrong. But each pratitioner will need to satisfy themselves before they process personal data, and empty property work should really only be one part of a comprehensive audit of all work programmes ahead of GDPR coming into force. 


    James Bailey

    Senior Officer, Housing Standards and Adaptations Team

    City of York Council


    I'm no data protection expert, but surely “taking steps to bring vacant dwellings back into use” covers contacting empty home owners to;

    • inform them of an increase in their council tax if the property remains empty;
    •  ask why the property is empty;
    •  to outline options for re-occupation (E.g. sell it, move in or let it);
      and then to state that the LA has schemes and initiatives that may be of use, without going in to detail about them, but perhaps states "for information, visit www.... can hardly be considered marketing?


    Interestingly, the GDPR defines six 'lawful grounds' for data processing based on a 'legitimate interest' and if our work as Empty Homes Practitioners doesn't fall in to one of these, I'll hang up my EH hat tomorrow!

    "Article 6.1 of the GDPR defines the lawful grounds for data processing as follows:

    • Consent of the data subject
    • Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
    • Processing is necessary for compliance with a legal obligation
    • Processing is necessary to protect the vital interests of a data subject or another person
    • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
    • Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject. (Note that this condition is not available to processing carried out by public authorities in the performance of their tasks.)”

    My view is that by continuing to act as we do with regards to contacting owners of long term empty properties, we are acting well within a number of the above exceptions:


    Processing is necessary for compliance with a legal obligation

    An owner has a legal obligation to pay council tax and to ensure they comply with this obligation we should be able to contact them to inform them that a premium rate will soon be charged, why it is being charged and what can be done to reduce the charge back to its original rate (i.e. return the property to use). An owner also has other legal obligations, e.g. to ensure the property is safe, secure and it not posing a risk to members of the public etc.


    Processing is necessary to protect the vital interests of a data subject or another person

    Certainly it would seem logical that by contacting owners of  long term empty properties (which we know are at a higher risk of vandalism, arson, ASB, dilapidation) and offering a range of support options to repair / return the property to use, we are clearly trying to protect the vital interest of the data subject (owner) and indeed 'another person' being the public, surrounding neighbourhood etc.


    Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

    For similar reasons as outlined above, and perhaps the most appropriate grounds - contacting the owner to discuss the LTE status and offer support options etc. is surely necessary for the performance of 'a task carried out in the public interest' or in the 'exercise of official authority vested in the controller'. We know empty properties attract a range of problems for neighbourhoods, they de-value nearby homes, and cost the city money in lost New Homes Bonus – if preventing these issues is not in the public interest, I don’t know what is!


    Just my humble thoughts on the matter :-)


    Scott Tunnicliffe

    Plymouth City Council