Yes, waste-collection companies can legally give the council data on who doesn’t pay them for bins

As local residents in the north inner-city and elsewhere in Dublin lament the rubbish-strewn streets, Dublin City Council is preparing to sharpen the tools it uses to tackle illegal dumping.

Among new measures, waste management companies are set to hand over customer data to the council, so that it can compile a list of households that don’t have bin contracts.

“They have a legal right to request customer lists from us, and we are legally obliged to give that to them,” says Conor Walsh, secretary of the Irish Waste Management Association (IWMA), a trade association.

In February, Barry Woods, the council’s head of waste management, told a meeting of the Central Area Committee that the council intends to compile a register of the households that don’t have bins.

Starting with a pilot project in the north inner-city, the council plans to ramp up enforcement of existing by-laws, and prosecute people who cannot show that they disposed of their waste legally, he said.

“We can then follow that up with cold calling, calling at houses, calling at properties and then we can then prosecute,” said Woods in February.

That discussion led to questions around whether the waste-collection companies could hand over their customers’ data without breaching the data protection rights of those householders.

Antoin O Lachtnain, director of Digital Rights Ireland, says he thinks the council is on solid ground, if it acts within ministerial guidelines issued in 2023.

The council has to show that requesting the data is necessary and proportionate, he says.

Considering the impact of illegal dumping in the northeast inner-city, that shouldn’t be a problem.“I don’t think they have a necessity or a proportionality problem,” says O Lachtnain.

Necessary and proportionate

In 2023, the government passed the Circular Economy Act.

Section 27 updates legislation to allow councils to establish a register of households that don’t have bins, in certain circumstances.

Since then, the council has undergone all the necessary preparation, says Walsh, of the IWMA.

“They’ve gone through all the hoops. We haven’t objected to it; if they want to use it for enforcement purposes, we’ll support that,” he says.

The General Data Protection Regulation (GDPR), is a European Union law that sets guidelines for the collection, storage, and use of people’s personal data.

O Lachtnain says councils can establish a register that is in compliance with GDPR as long as they show that requesting and collating the data is both necessary and proportionate.

“They have got a legal basis in the act as amended,” he says. “As long as they carry out the impact assessment as per the guidelines.”

In 2023, the Department of the Environment issued ministerial guidelines to councils.

Those guidelines allow the council to collate a register of eircodes, where the address is not linked to a waste-collection contract, or other method to legally dispose of waste.

The council’s chief executive officer should satisfy themself that establishing the register is proportionate to the problem and necessary to tackle it, says the guidelines.

The council also needs to do a data protection impact assessment, to inform this decision.

A spokesperson for Dublin City Council says it won’t request any transfer of data from the waste management companies until after the preparation and approval of the Data Protection Impact Assessments.

The spokesperson says the Waste Enforcement Regional Lead Authorities (WERLA) has prepared procedures that take account of GDPR. The council will comply with those, she says.

The Waste Enforcement Regional Lead Authorities co-ordinate waste enforcement and ensure consistency of approach among councils. Dublin City Council is the lead local authority for the Eastern and Midlands region.

Will it be effective?

According to the ministerial guidelines, after it establishes the register, the council should review whether the register is working and if it is still needed.

That review should be done at least every five years, they say.

O Lachtnain, of Digital Rights Ireland, says that review will be important, because if the register is not effective then it might no longer be proportionate to continue to gather the data.

“How will it be re-assessed?” says O Lachtnain. “Does it actually get a result?”

Transparency is also an important aspect of GDPR, so the council should be upfront about what it is doing and why, he says.

Councillors say that establishing a reverse register should help the council to tackle illegal dumping in the north inner-city, where many local residents already have suspicions.

“People locally know who is doing it,” Green Party Councillor Janet Horner has said.

The reverse register should provide the council with concrete evidence, so they don’t need to rely on witness testimony or anecdotal evidence, she said.

It should also allow the council to target resources at those who are likely offenders, said independent Councillor Cieran Perry.