Personal Data is Not 'Personal Data', Not When It's Gathered For the Purposes of the Workplace Parking Levy

About a year ago I revealed that enforcement of the Workplace Parking Levy would involve officers in a vehicle equipped with Automatic Number Plate Recognition (ANPR) tech touring the car parks of Nottingham, recording the registration numbers of cars parked there to determine how many spaces are being used by people working there. I suggested that this was a bit dodgy because, arguably such activity should be registered under RIPA and it would mean shunting quite a lot of individuals' personal data around which implies certain obligations. As the WPL rules do not include spaces used by Blue Badge holders i.e. people with disabilities, this includes what is defined as 'sensitive' personal data which requires explicit consent for processing. In other words, from a data protection point of view, this is some heavy shit.

Not surprisingly others are interested in this issue and there has been a rather illuminating response to a Freedom of Information request. Be amazed at this extract;

"We have determined that the information collected by our ANPR vehicle for the purposes of the WPL does not constitute personal data.

We have not completed the ICO self-assessment questionnaire.

We have obtained legal advice regarding all aspects of the Data Protection Act and the Workplace Parking Levy however, this information is exempt from disclosure under section 42 of this act as we feel releasing the information would breach legal professional privilege."

Ok, so they are claiming that records of thousands of individuals' number plates do not constitute personal data. They claim to have legal advice on this but they're not going to tell us. Handily this let's them off all the obligations for processing personal data fairly, including whether they pass it on to all and sundry which is another of my key concerns.

Let's have a look at the definition of personal data from the Information Commissioner's website;

"Personal data means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

Now it's probably fair to say that this information doesn't count as personal data under part a), you can't identify somebody from their number plate alone. But what about part b)? We know that NCC has access to the DVLA database because there was a hoo-har about them allegedly being suspended from it a while back due to lax security procedures. The council also processes Blue Badge applications. There's probably more but from these two sources, combined with the ANPR data, individuals would be personally identifiable and the latter is thus personal data. No wonder they're unwilling to share the legal advice that says it isn't, it sounds well dodgy. That FoI exemption they used looks a lot less than watertight as well.

Later on in the response NCC appears to be saying that the ANPR vehicle has yet to be used in anger but it cost £93k so it will be at some point.

There is one other element of the response which has quite a lot of amusement value as well as being wrong. The questioner asked for the locations of signs at NCC's administrative boundaries informing people that they are entering ANPR surveyed areas. Here is the priceless response;

"These signs are in the public domain therefore this information is exempt from disclosure under section 21 of this act as it already publicly available."

Ok, there is an exemption under the Freedom of Information Act for information obtainable elsewhere but I'm really not sure that's what it means. The fact that the signs are physically viewable at the side of the road is not the same as a list of their locations. I hope that actually is a kind of a subtle 'fuck you' because if the FoI officer really believes that is the correct response, the work is only just beginning.

Update;

Thanks to 'Sanman' in the comments for the news that NCC's Data Protection Register Entry now includes vehicle registrations. See 'Purpose 7; Assessment and Collection of Taxes and Other Revenue', further description of purpose includes 'ADMINISTRATION AND ENFORCEMENT OF WORKPLACE PARKING LEVY' and 'Data Classes' includes 'VEHICLE REGISTRATION MARKS'.

This kind of implies that they do accept the vehicle reg numbers are personal data after all which in turn implies that the FoI response is incorrect.

Workplace Parking Levy to Use Auto Number Plate Recognition

Firstly, I should say that I support the principle of the workplace parking levy. I do believe that we need to reduce car use whenever possible and especially short journeys which cause the most environmental damage. This can really only be done by some form of 'green taxation' i.e a means to translate some of the external costs of car driving i.e. pollution etc into a financial cost to car users and the revenue from that used to invest in alternatives i.e. more public transport. In addition, it will be useful to be able to compare the effectiveness of WPL schemes compared to congestion charging and I suspect that this fact is a significant reason for the WPL to be still going ahead despite the change in government since the scheme was first approved.

However, I may have been naive but I had largely misunderstood how the scheme was to be operated. I presumed that businesses would apply for their car park license by saying how many spaces they had and a bloke from NCC would turn up with his tape measure and check. No, it's not as simple as that.

You see, the WPL Order set before parliament says that spaces provided for people visiting the premises but who don't work there or spaces for delivery vehicles and spaces used by blue badge holders aren't charged although must be declared for the license. Therefore employers are expected to work out how many parking spaces are provided for people who normally work there. Of course this has to be checked at some stage to ensure that employers don't suddenly sprout a huge number of disabled employees, or find that they need an awful lot of deliveries. And it seems that this checking is to be done by an ANPR equipped vehicle, which has just been ordered for the princely sum of £93k, including software.

I have concerns about ANPR, mainly around how the information is used and who it is passed onto. There are stories of it being used to identify protesters traveling by car to demos and it arguably requires proper authorisation under the Regulation of Investigatory Powers Act. I can't see any mention of the use of ANPR in any of the documents on the WPL page of NCC's website (although I haven't read all of them I must admit) and it doesn't seem to have come up in the public enquiry or any of the consultation documents. If anybody knows where there is any previous discussion on this or has any info on compliance (or not) with RIPA please let me know in the comments.

And this is a big issue because as far as I can see the method of monitoring is to drive the ANPR car into the employers' car parks and record the registrations of all the cars parked there. This is done 8 times in a 28 day period and the data analysed to identify the regular parkers.

So unlike the normal use of ANPR which is to monitor car use on the roads, which are in fact highly regulated public spaces, and merely produce data identifying when a person momentarily passes a fixed point*, it will be used to monitor private spaces and will collect data which could establish where an individual spends an awful lot of their time or whether a person is disabled (which is actually sensitive data under the Data Protection Act and thus requires explicit permission to record).

It doesn't take a lot of imagination to work out a whole list of agencies who would dearly love to get their hands on this info from the police to the social security agencies. It really is a whole new order of surveillance.

*Yes, I realise that a network of ANPR can build up a detailed picture of a person's traveling habits but the fact remains that the roads are public and there are good reasons for regulating car use. I'm not saying there aren't valid objections, merely that routine surveillance by the state of private spaces where individuals are staying is a big step up.