Millom Town Council
Millom Town Council was formed in 1974 when the parish boundaries changed from Cumberland.
Use of Artificial Intelligence (AI) to Prepare Public Documents for Publication
Adopted: 27th May 2026 Review Date: May 2027
This Data Protection Impact Assessment follows the structure recommended by the Information Commissioner’s Office (ICO).
Article 35 of the UK GDPR requires a DPIA where processing is likely to result in a high risk to the rights and freedoms of natural persons, or where the processing involves the innovative use of new technology. The use of Artificial Intelligence to assist with the preparation of public documents constitutes the innovative use of a new technology and is therefore appropriate for a DPIA, even though the underlying data is largely already in the public domain.
This DPIA is conducted in support of the Council’s Artificial Intelligence (AI) Use Policy, adopted May 2026, and supplements the short-form summary set out in the Annex to that policy.
Millom Town Council (“the Council”) publishes a range of approved public documents on its website, including minutes, agendas, expenditure reports, policies, news items and notices. To assist with the preparation of these documents for publication, the Council’s website provider uses an AI-assisted system that performs the following functions:
No document is published automatically. The Clerk reviews and approves every output. Where a document concerns a matter to be voted on, councillors are also involved in the review prior to publication.
The AI system is used at low frequency, approximately weekly to monthly, as and when documents need to be prepared for publication. The system is intended to operate only on documents that are part of the Council’s public publication workflow.
Whamos Ltd has confirmed that the AI system processes documents at the preparation stage as well as following formal approval. This means that the AI may briefly process draft material before it has been finalised by the Clerk. The Clerk maintains responsibility for ensuring that any document submitted to the AI system, whether in draft or final form, is intended to form part of the public publication workflow and contains no information that should not be exposed to the AI sub-processor. This control is reinforced by the rules in Section 7 of the AI Use Policy concerning information that must not be entered into AI tools.
The Council acts as Data Controller for all personal data processed in the course of its public functions. The website provider, Whamos Ltd, acts as Data Processor under a written contract that meets the requirements of Article 28 UK GDPR. Whamos Ltd does not operate its own AI service. The AI functionality on the Council’s website is provided by way of integration with OpenAI’s API, on which Whamos Ltd is itself a customer. OpenAI therefore acts as a sub-processor of the Council’s data within the meaning of Article 28(2) UK GDPR.
Before any document is sent to OpenAI’s API, Whamos Ltd applies a proprietary AI-based de-identification process designed to detect identifiers relating to individuals, businesses and locations and to replace them with dummy data. Whamos Ltd has indicated that this process is intended to meet UK GDPR anonymisation standards. The Council records this de-identification as a significant additional safeguard reducing the personal data risk associated with the use of the AI sub-processor. As a matter of prudence, however, the Council continues to treat the processing as falling within UK GDPR, and the Article 28 contractual chain, the IDTA international transfer mechanism, and the controls set out in this DPIA continue to apply. The Council will revisit this position if independent assurance becomes available that the de-identification process meets the UK GDPR anonymisation threshold (taking account, in particular, of the motivated intruder test described in the ICO’s Anonymisation Code of Practice).
Whamos Ltd has confirmed in writing to the Council that:
The Clerk retains the written confirmation from Whamos Ltd with this DPIA.
The purpose of the processing is to support the Council in meeting its obligations as a public authority to make information available to the public efficiently and accessibly, in line with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 (WCAG 2.2 AA), and in support of the principles of transparency in public administration.
In preparing this DPIA, the Council has consulted:
The Council does not currently have an appointed Data Protection Officer. The Clerk performs the data protection lead function. As the personal data being processed is, in substance, already in the public domain, the Council has not consulted residents directly on this assessment, but a public notice describing the use of AI is published on the Council’s website and feedback is welcomed via the Clerk. The Council will consider further consultation, including with the Information Commissioner where appropriate, if the scope of AI use changes materially in future.
The lawful basis for the processing is “public task” under Article 6(1)(e) UK GDPR. The Council exercises functions of a public authority and the processing is necessary for the performance of those functions, in particular its obligations to make information available to the public. No special category personal data within the meaning of Article 9 UK GDPR is intentionally processed. Where any such data appears in approved public documents (for example, where a councillor has voluntarily disclosed an interest that touches on a special category), it is processed only as part of the public record.
The use of AI to format and check documents is not strictly necessary in the sense that documents could be prepared by hand, but it is reasonably necessary to enable the Council, as a small authority with limited staff resource, to publish documents promptly and to a consistent accessibility standard. Manual preparation to the same standard would not be feasible at the Council’s scale.
The use of OpenAI’s API may involve the transfer of data to servers outside the United Kingdom, including to the United States. Whamos Ltd has confirmed that this transfer is governed by the UK International Data Transfer Agreement (IDTA), which is a recognised mechanism under UK GDPR for the transfer of personal data to third countries. The Clerk retains a copy of that confirmation with this DPIA. The personal data potentially transferred is limited to what already appears in approved public documents, which is by definition information the Council intends to make publicly available. The risk to data subjects from any onward transfer is therefore low, but the assessment is recorded for completeness.
Data subjects retain all rights under UK GDPR in respect of personal data processed by the Council. The Council has a Subject Access Request Policy and a published Privacy Notice. Where personal data has been entered into the AI system as part of an approved public document, the Council can, on request, identify and (where lawful and proportionate) act on requests for rectification or erasure, working with the website provider as necessary. Data subjects also have the right under section 91 of the Data (Use and Access) Act 2025 to complain directly to the Council about the handling of their personal data, in addition to their existing right to complain to the Information Commissioner. Such complaints are handled under the Council’s Complaints Procedure.
The following risks have been identified. Likelihood and severity are each assessed on a scale of low, moderate or high. Overall risk is the combination.
Risk 1 – Misclassification
The AI may incorrectly classify a document, leading to it being filed or labelled in the wrong way on the website. Likelihood: Moderate. Severity: Low. Overall risk: Low. Personal data impact is minimal because misclassification does not change what data is published; it changes only how the document is indexed.
Risk 2 – Accessibility Defects
The AI may produce HTML or PDF output that does not meet WCAG 2.2 AA standards, with the result that the document is not fully accessible to users of assistive technology. Likelihood: Moderate. Severity: Moderate. Overall risk: Moderate. This is primarily an Equality Act 2010 concern rather than a UK GDPR concern, but it is recorded here because it falls within the same operational workflow.
Risk 3 – Accidental Inclusion of Restricted Information
A document submitted to the AI for publication preparation may inadvertently contain information not intended for publication – for example, draft text, redacted material that has been re-revealed by formatting changes, or personal data not appropriate for the public record. Likelihood: Low. Severity: Moderate to High depending on what is disclosed. Overall risk: Low to Moderate. This was previously the principal personal data risk arising from the use of AI in this context. The likelihood is materially reduced by the de-identification process described in Section 2.3, which is designed to strip identifiers before any data is sent to OpenAI. The residual risk reflects the possibility that the de-identification process may fail to detect a particular identifier, or that contextual information may permit re-identification despite the removal of direct identifiers.
Risk 4 – Algorithmic Bias
The AI may, in the course of preparing or summarising material, reflect biases present in its training data. This could result in outputs that, for example, paraphrase or label material in ways that disadvantage people sharing a protected characteristic under the Equality Act 2010. Likelihood: Low (because the AI is used for formatting and checking rather than substantive content generation). Severity: Moderate. Overall risk: Low. This risk is recorded explicitly because the Council, as a public authority, is subject to the Public Sector Equality Duty.
Risk 5 – Sub-processor and International Transfer Risk
A failure of OpenAI’s data protection arrangements, or the loss of an appropriate transfer mechanism between the United Kingdom and the United States, could in principle expose the Council’s data to processing not authorised by the Council. Likelihood: Low. Severity: Low. Overall risk: Low. The severity is reduced by two factors: first, that the underlying data is in substance information already published by the Council; and second, that the data is de-identified by Whamos Ltd before any transfer to OpenAI takes place.
Risk 6 – Loss of Public Trust
Members of the public may be concerned about the Council’s use of AI, particularly if it is perceived as making decisions or generating content rather than supporting publication. Likelihood: Low to Moderate. Severity: Low. Overall risk: Low.
The Council has put in place, or will put in place, the following measures to reduce the risks identified in Step 5:
Human approval before publication:
No document is published automatically. The Clerk reviews and approves every output, including for accuracy and for any indication of bias or discriminatory effect. Where a document concerns a matter to be voted on, councillors are also involved in the review.
Article 28 contract:
The Council’s contract with Whamos Ltd as Data Processor reflects the requirements of Article 28 UK GDPR. Whamos Ltd has confirmed that an OpenAI Data Processing Addendum is in place between Whamos Ltd and OpenAI to address the sub-processor relationship.
De-identification before sub-processor exposure:
Whamos Ltd applies a proprietary AI-based de-identification process to documents before they are sent to OpenAI’s API, designed to detect identifiers relating to individuals, businesses and locations and replace them with dummy data. This significantly reduces the personal data risk associated with the OpenAI sub-processor, as recorded in Section 2.3.
Confirmed sub-processor terms:
The Council uses the OpenAI API rather than the consumer ChatGPT product. Under OpenAI’s standard API terms, inputs are not used to train OpenAI’s models. Written confirmation of this position has been obtained from Whamos Ltd and is retained with this DPIA.
International transfer safeguards:
The transfer of personal data to OpenAI’s servers outside the United Kingdom is governed by the UK International Data Transfer Agreement (IDTA), as confirmed in writing by Whamos Ltd.
Data minimisation:
AI is applied only to documents already approved for publication, or being prepared for publication, and not to internal Council records, drafts of confidential matters, or correspondence.
Audit logs:
The website provider maintains logs of AI activity, approvals and publication events sufficient to allow the Council to audit the activity if required.
Accessibility QA:
Outputs are checked against the Council’s working accessibility checklist, with reference to the WCAG 2.2 AA standard.
Bias review:
The Clerk reviews AI outputs not only for factual accuracy but for any indication that the output disadvantages people sharing a protected characteristic. Where any such indication is identified, the output is corrected before publication.
Correction process:
Where errors are identified after publication, the Council corrects them and, where appropriate, adds a note explaining the correction.
Transparency:
A short public notice describing the Council’s use of AI is published on the Council’s website (Annex to the AI Use Policy).
Training:
An annual briefing is provided to staff and to the Processor covering the matters set out in the AI Use Policy.
Breach reporting:
Any data breach involving the AI system is reported to the Clerk immediately and handled under the Council’s Data Breach Policy. Reportable breaches are notified to the Information Commissioner’s Office within 72 hours, in accordance with Article 33 UK GDPR.
Periodic review:
This DPIA is reviewed at least annually, and sooner where the AI tools used by the Council change, or where the law changes (in particular the further commencement of provisions of the Data (Use and Access) Act 2025).
Following the application of the measures set out in Step 6, the residual risk is assessed as low. The processing is appropriate to the Council’s functions, the data processed is in substance already in the public domain, and the principal risks are controlled by human oversight, contractual safeguards, the de-identification process applied by Whamos Ltd before any data is sent to OpenAI, and a defined correction process. The Council retains the position that the processing falls within UK GDPR notwithstanding the de-identification step, on the cautious basis described in Section 2.3.
The processing is approved. The written confirmations from Whamos Ltd referenced above are retained on file with this DPIA.
Chair of the Council: …………………………………… Date: 27th May 2026
This DPIA will be reviewed by May 2027, or sooner if the scope of AI use changes materially.
© Millom Town Council. All rights reserved
APRIL 30TH: Methodist Church meeting room
MAY 28TH: Methodist Church meeting room
JUNE 25TH: Methodist Church meeting room
JULY 30TH: Methodist Church meeting room
All meetings will commence at 07.00pm unless otherwise stated on
the agenda.