Ever since the samsung debacle, I've treated QR codes in public spaces with extreme suspicion.
It's loading data from an unknown source, directly into your phone, and hoping that there isn't some unknown exploit.
Utter insanity: Just use a reasonably short URL.
I honestly do feel sorry for the council on this one, it's not easy to stop twats spamming these up.
Though not using QR in the first place would make people less likely to fall for it.