Data Sharing Between Councils: Legal Framework

Data is the foundation of modern PRS enforcement. The properties, landlords, agents, tenants, and compliance records that councils hold are individually valuable, but when shared between authorities they become exponentially more powerful. A landlord's enforcement history in one area, combined with their property portfolio across three others, paints a picture that no single council can see alone. Yet data sharing between councils remains inconsistent. Officers frequently cite data protection concerns, uncertainty about legal gateways, and lack of formal agreements as barriers. This guide clarifies the legal framework and provides practical guidance for establishing lawful, effective data sharing arrangements.

The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 govern the processing of personal data, including sharing between councils. Key principles for PRS enforcement data sharing: Lawful basis (Article 6): The primary basis for sharing enforcement data is Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. Housing enforcement under the Housing Act 2004 and the Renters' Rights Act 2025 is clearly a public interest task. Special category data (Article 9): If enforcement data includes health information (e.g., tenant health impacts of hazards) or criminal conviction data, additional safeguards apply. Criminal conviction data can be processed under Part 2, Schedule 1 of the Data Protection Act 2018 for the exercise of a function conferred by law. Data minimisation: Share only the data necessary for the enforcement purpose. A landlord's name, property addresses, and enforcement history are relevant; their medical records are not. Transparency: Privacy notices should inform data subjects (landlords, tenants) that their data may be shared with other local authorities for enforcement purposes. Update your privacy notice if it does not currently cover inter-authority sharing. Data Protection Impact Assessment (DPIA): Where data sharing involves large-scale processing, novel technology, or sensitive data, a DPIA should be completed before sharing begins. For routine enforcement data sharing between councils, a DPIA is good practice even where not strictly required.

Part 5 of the Digital Economy Act 2017 provides specific legal gateways for data sharing between public authorities. Two chapters are relevant to PRS enforcement: Chapter 1 (Public Service Delivery): Allows data sharing to support the delivery of public services, including housing and welfare services. This gateway is broad and covers most PRS enforcement data sharing between councils. Chapter 3 (Fraud, Error and Debt): Allows data sharing to combat fraud and error in public services. This can support enforcement against landlords who make false declarations on licence applications or the PRS Database. To use these gateways, councils must ensure that: - The sharing has a clear objective that falls within the statutory purposes - A data sharing agreement is in place - An appropriate Codes of Practice are followed - The sharing is proportionate The Digital Economy Act gateways are particularly useful because they provide explicit statutory authority, which some Data Protection Officers find more reassuring than relying on GDPR Article 6(1)(e) alone. In practice, both legal bases support enforcement data sharing.

The Housing Act 2004 and Housing and Planning Act 2016 include specific data sharing provisions: Rogue Landlord Database (Section 30, Housing and Planning Act 2016): Councils must make entries for banning orders and may make entries for other enforcement outcomes. The database is accessible to all local housing authorities, providing a statutory sharing mechanism. PRS Database (Renters' Rights Act 2025): The PRS Database will be accessible to local authorities for enforcement purposes. This creates a statutory sharing mechanism for registration and compliance data. Section 237 of the Housing Act 2004: Allows local housing authorities to serve information notices on any person requiring them to provide information for housing enforcement purposes. These statutory frameworks complement the GDPR and Digital Economy Act provisions. Together, they provide a robust legal basis for sharing PRS enforcement data between councils. Where the sharing involves other public bodies (police, fire services, NHS), the Crime and Disorder Act 1998 (Section 115) provides an additional gateway for sharing information for crime prevention purposes.

A data sharing agreement (DSA) is the practical tool that enables lawful sharing. Key elements: 1. Parties: Which councils are involved? Include a mechanism for adding new parties without renegotiating the entire agreement. 2. Purpose: What enforcement purpose does the sharing serve? Be specific but not so narrow that the agreement needs amending for every new use case. 3. Data types: What categories of data will be shared? Typically: landlord identities, property addresses, licence status, enforcement actions, civil penalties, and complaint summaries. 4. Legal basis: Reference the specific legal gateways (GDPR Article 6(1)(e), Digital Economy Act, Housing Act provisions). 5. Data handling: How will shared data be transmitted (encrypted email, secure portal, API), stored (on council systems, for how long), and disposed of? 6. Access controls: Who within each council can access shared data? Limit access to officers with a legitimate enforcement need. 7. Subject access requests: How will data subject requests be handled when data has been shared between parties? 8. Breach response: What happens if shared data is compromised? Notify all parties within 72 hours and coordinate the response. 9. Review: The agreement should be reviewed annually to ensure it remains fit for purpose. Template DSAs are available from the LGA, regional data sharing groups, and some DLUHC guidance. Adapting a template is far quicker than drafting from scratch.

Common barriers and how to address them: "Our DPO says we can't share data." Many DPOs default to caution. Present the specific legal gateways (GDPR Article 6(1)(e), Digital Economy Act, Housing Act provisions) and the enforcement purpose. Offer to complete a DPIA. Most DPOs will support sharing once the legal basis is clearly documented. "We don't have a data sharing agreement." Templates are freely available. A basic DSA can be drafted, reviewed, and signed within weeks. Do not let the absence of a formal agreement prevent urgent intelligence sharing; the legal basis for sharing exists regardless of whether a DSA is signed. "Our system can't export data." Start with manual sharing (structured emails, secure spreadsheets) while working on system integration. Imperfect sharing is better than no sharing. "We don't know what other councils need." Start a conversation. A single joint meeting between enforcement teams reveals common needs and opportunities. "Landlords will complain." Landlords subject to enforcement action have no legal basis to prevent councils from sharing enforcement data for legitimate statutory purposes. Privacy notices should make this clear. The PRS Database will normalise inter-authority data sharing from late 2026. Councils that establish sharing arrangements now will be best positioned to exploit the national database effectively.