Why Council Data Should Stay in Public Hands

Recently, we learnt that the Reform-led council has put forward a plan involving a so called Trump style “DOGE” unit (Department of Government Efficiency). The proposal is for the council to share and open up access to several key datasets.

The DOGE team could consist of engineers, analysts, and auditors, with the stated aim of reviewing budget models, financial data, and identifying waste in order to drive efficiency. Areas under review may include asylum hotels, home-to-school transport, service performance metrics, and even adult and children’s social care data.

Leaving aside the politics of engaging a private company, which already suggests the risk of “behind closed doors” deals, I want to focus on the risks to our data and why residents and councillors should be concerned.

This data is not simply a resource to be traded. It represents people’s lives, homes, finances, health, and the services they rely on every day. When such information moves out of the council’s domain and stewardship, it risks being treated as an asset to monetise. Private companies are accountable first to their shareholders, not residents. This tension is inevitable. What happens when the commercial incentive to extract value from data collides with the council’s duty to protect it? 

From a data management perspective, the risks are clear. Once data leaves the council’s systems, control is lost. No contractor can guarantee how many times highly sensitive data will be copied, where it will be stored, or how it will be used in the future. Regulatory compliance may still legally sit with the council, but oversight becomes blurred. Worse still, poor integration and multiple silos increase the risk of inaccuracies and duplication. Bad data leads directly to mistakes in service delivery.

Councils are bound by strict standards in the UK. Handing this data to a private contractor raises immediate concerns about security. How can the council ensure GDPR compliance if it does not even know where the data is being stored? Could it be overseas? Even if so, the council remains legally responsible. Any breach could lead to a long and costly legal battle. With taxpayers footing the bill.

We have seen in recent months that major organisations such as M&S, the Co-op and JLR have all fallen victim to serious cyber incidents. There is no guarantee that a private contractor would maintain the same level of cyber resilience. If their systems are compromised, it is residents’ highly personal information at risk not the CEO’s.

There are also practical risks. Mistakes creep in when multiple copies of data exist across different systems. For residents, this could translate into council tax errors, disrupted housing lists, or delays to benefits. Once again, the residents bear the consequences.

Finally, there is the matter of trust. Residents rightly expect their personal information to be handled by a body they can hold accountable at the ballot box. If data is handed to a private firm, transparency is lost. Councillors and residents alike cannot easily see how it is being used, or whether commercial interests are being put ahead of public safety.

Councils should instead work to strengthen their own governance frameworks, investing in clean, accurate, and well-managed datasets that underpin modern public services. This means transparency, direct accountability, and building trust not outsourcing responsibility to actors whose incentives are not aligned with the public interest.

Council data is not just spreadsheets or abstract numbers. It represents the real world and the services people depend on every day. It is among the most sensitive information a local authority can hold, and demands the highest standards of protection and democratic oversight.

The drive to save money cannot justify the erosion of good data practice. Residents’ personal information must never become a bargaining chip for political or financial gain. Any council that seeks to hand over data to a private company for short-term political point scoring is signalling, clearly, that it does not understand the depth of responsibility or the risks that come with poor data management.