Personal Data is Not 'Personal Data', Not When It's Gathered For the Purposes of the Workplace Parking Levy

About a year ago I revealed that enforcement of the Workplace Parking Levy would involve officers in a vehicle equipped with Automatic Number Plate Recognition (ANPR) tech touring the car parks of Nottingham, recording the registration numbers of cars parked there to determine how many spaces are being used by people working there. I suggested that this was a bit dodgy because, arguably such activity should be registered under RIPA and it would mean shunting quite a lot of individuals' personal data around which implies certain obligations. As the WPL rules do not include spaces used by Blue Badge holders i.e. people with disabilities, this includes what is defined as 'sensitive' personal data which requires explicit consent for processing. In other words, from a data protection point of view, this is some heavy shit.

Not surprisingly others are interested in this issue and there has been a rather illuminating response to a Freedom of Information request. Be amazed at this extract;

"We have determined that the information collected by our ANPR vehicle for the purposes of the WPL does not constitute personal data.

We have not completed the ICO self-assessment questionnaire.

We have obtained legal advice regarding all aspects of the Data Protection Act and the Workplace Parking Levy however, this information is exempt from disclosure under section 42 of this act as we feel releasing the information would breach legal professional privilege."

Ok, so they are claiming that records of thousands of individuals' number plates do not constitute personal data. They claim to have legal advice on this but they're not going to tell us. Handily this let's them off all the obligations for processing personal data fairly, including whether they pass it on to all and sundry which is another of my key concerns.

Let's have a look at the definition of personal data from the Information Commissioner's website;

"Personal data means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

Now it's probably fair to say that this information doesn't count as personal data under part a), you can't identify somebody from their number plate alone. But what about part b)? We know that NCC has access to the DVLA database because there was a hoo-har about them allegedly being suspended from it a while back due to lax security procedures. The council also processes Blue Badge applications. There's probably more but from these two sources, combined with the ANPR data, individuals would be personally identifiable and the latter is thus personal data. No wonder they're unwilling to share the legal advice that says it isn't, it sounds well dodgy. That FoI exemption they used looks a lot less than watertight as well.

Later on in the response NCC appears to be saying that the ANPR vehicle has yet to be used in anger but it cost £93k so it will be at some point.

There is one other element of the response which has quite a lot of amusement value as well as being wrong. The questioner asked for the locations of signs at NCC's administrative boundaries informing people that they are entering ANPR surveyed areas. Here is the priceless response;

"These signs are in the public domain therefore this information is exempt from disclosure under section 21 of this act as it already publicly available."

Ok, there is an exemption under the Freedom of Information Act for information obtainable elsewhere but I'm really not sure that's what it means. The fact that the signs are physically viewable at the side of the road is not the same as a list of their locations. I hope that actually is a kind of a subtle 'fuck you' because if the FoI officer really believes that is the correct response, the work is only just beginning.

Update;

Thanks to 'Sanman' in the comments for the news that NCC's Data Protection Register Entry now includes vehicle registrations. See 'Purpose 7; Assessment and Collection of Taxes and Other Revenue', further description of purpose includes 'ADMINISTRATION AND ENFORCEMENT OF WORKPLACE PARKING LEVY' and 'Data Classes' includes 'VEHICLE REGISTRATION MARKS'.

This kind of implies that they do accept the vehicle reg numbers are personal data after all which in turn implies that the FoI response is incorrect.

Jon Collins Receives the News that the Post Has Defied Him

Yes, we've done a 'Downfall' parody at long last. See the previous post if you want the background. It is a bit sweary though so prob best not to watch it at work.

Now all there is to do is wait for the trained idiots to write in with their 'outrage' at me comparing Collins to Adolf, like an internet meme never happened.

JoCo Parks His Tanks on the Post's Lawn

It seems that Collins was a bit rattled by the Post's recent reporting of his apparent refusal to let NCC's Information Governance staff search his emails for a FoI request. So rattled in fact that he's made a subject access request to the Post asking for any information they hold on him and written a blog post about it.

JoCo says -

"I believe this was misleading since all my Council e-mails are covered by the act..."

Well yes, we know that but stating that the emails are covered by the FoI Act doesn't explain why the Post's article was misleading. Information being covered by the Act is not necessarily inconsistent with a public authority withholding that information; it just means that the authority is in breach of the Act. Is JoCo saying that he didn't try and stop his emails being searched and that the Post was lying or had made a mistake? Perhaps he'll be going to the Press Complaints Commission about it?

He goes onto claim -

"... the Council has spend hundreds of thousands of pounds of City tax-payers money providing this information to the Nottingham Post."

Ah, the oft claimed NCC Freedom of Info victim status makes an appearance. Except of course NCC hasn't spent hundreds of thousands of ponds on providing JoCo's emails to the Post, he's referring to the total spend of NCC's FoI obligations. A sum inflated by NCC's often unjustified attempt to avoid disclosure requiring unnecessary and time-consuming trips to the Information Commissioner.

Cllr Collins of course has as much right to make a request for information under the Data Protection Act as any other citizen and the Post of course has a duty to treat his request in the same way it would treat a request by anybody else. In the event, the Post has refused his request under s.32 of the Data Protection Act, an exemption to disclosure rights for information that has been processed for journalistic purposes. JoCo says this is hypocritical.

But is it? Well it is conceivable that SOME of the information the Post has on JoCo isn't necessarily connected with its journalism . Furthermore, JoCo rightly points out that there is a public interest consideration for this exemption. JoCo presumably considers that there is no public interest in not providing the information to him. He would therefore be entirely justified with pursuing a complaint to the Information Commissioner.

I have to admit that Data Protection is not my strong point but you can see why there is an exemption for journalistic purposes, even though I can understand that it would be frustrating for an individual affected. Journalists need to protect their sources and people may be less willing to help journalists if they know that the subject of an investigation will see a copy of any info they provide. Even if any personal details are redacted it may well be possible to identify a whistleblower from the nature of the information concerned. I'm sure journalists could come up with a number of other reasons. Some of the info held may also be wrong and providing it to the data subject may open a journalistic source to a defamation claim. Again, the risk of this may well cause sources to dry up.

Furthermore, it seems clear that JoCo is only making the request to make a point (more on possible motivations in a bit) which hardly assists his public interest arguments. You might even see a parallel with the 'vexatious' request provisions in the FoIA, although there isn't an equivalent provision in data protection as far as I know.

But what if that isn't his motivation and he is in fact trying to find out who's been dobbing him in at the council? What would that say about his respect for journalists' responsibility to protect sources? I've left a comment on his blog post asking that very point and it will be interesting to see if a) he publishes it (it was subject to moderation last time I looked and I wouldn't be surprised if it stayed there, JoCo has form on that) and b) if he answers it. I'll update if he does.

Update - 10.30pm and my comment on JoCo's blogpost is STILL awaiting moderation