TfL Ref: EIR-2705-2324
Thank you for your email of 30th October 2023 asking for information about the ULEZ expansion.
Your request has been considered in accordance with the requirements of the Environmental Information Regulations (EIR) and our information access policy.
I can confirm that we hold the information you require. Your questions are answered in turn below:
Question 1: You state Yunex keeps data about sightings of compliant and non-compliant vehicles for 7 (!) years. (a) What is the exact legal entity corresponding to Yunex here (e.g. Companies House company number)? (b) Where (and in what jurisdiction) does Yunex store this data exactly? and (c) Who has direct access to this data, and who may request it indirectly? (d) What justification is there to store this data for 7 years (especially on compliant vehicles)? (e) What volume of data (in terms of number of log entries and data size) has Yunex collected since 1 August 2023?
Answers: (a) Yunex Limited; company number: 13199800; registered Office at Sopers Lane, Poole, Dorset, United Kingdom, BH17 7ER. Note that in retaining these logs, Yunex is operating as TfL’s data processor and subject to contractual obligations imposed by TfL.
(b) Data is stored within the UK;
(c) TfL is required to adhere to the principle of purpose limitation and ensure that any personal data collected shall be processed only for specified, explicit and legitimate purposes. TfL’s network of ANPR cameras is used by TfL solely for the purposes of road user charging enforcement and traffic monitoring. It is not a tool by which individuals can, in essence, routinely track or monitor either their own, or other individuals’ movements across London. That is not the intended purpose for the cameras’ use and TfL takes great steps to ensure that this cannot – and more importantly, should not - be able to take place. TfL (and, for the avoidance of doubt, Yunex) has never disclosed information held in these log files to any potential data subject or third party.
(d) Data captured by our ANPR cameras is retained in a ‘log file’ maintained by Yunex for a period of seven years (currently) and comprises the vehicle registration mark, time, date and camera ID. The existing retention period is under review with the expectation that this can be reduced. The log files are retained in a secure ringfenced system by our supplier Yunex in an encrypted form. TfL has no direct access to the log files. Yunex has no ability to attribute or otherwise match the log file data with any individual at any time.
(e) TfL does not hold this information, and there is no duty under EIR law to source information from external bodies in response to a request. However, that said, colleagues have been in touch with Yunex which has reported the following, based on the Capture data from 1 August 2023:
No. of records = 2,172,280,572
Size of data = 627.080456GBytes
Question 2: You state number plates are pseudonymised before being used by TfL. (a) What procedure is used to pseudonymise the numbers plates; in particular would the procedure result in a different pseudonymous representation on different days? (b) What are the pseudonymised versions of my registration plates (c) Can vehicle owners request their registration data not be used for these purposes, which clearly falls outside the necessary processing required to enforce ULEZ? (d) What volume of pseudonymised data (in terms of number of vehicle sightings) has TfL collected from ULEZ expansion cameras since 1 August 2023?
Answers: (a) Vehicle registration numbers used for our traffic monitoring are encrypted at source with a multi-character unique encryption code, which is irreversible. The encryption is unique to each vehicle identity so the same code would apply on different days.
(b) This information is excepted from disclosure under Regulation 13 of the EIR, which applies to information that constitutes personal data. Release of information under the EIR is considered to be to the world at large. If encrypted registrations were provided to the public at large, it would enable people to reverse-engineer the encryption, which negates the purpose of pseudonymising the registrations in the first place.
(c) Vehicle owners (or the registered keepers of vehicles) cannot currently request that a specific VRM is excluded from traffic monitoring. Schedule 2 (Part 6) of the Data Protection Act 2018 provides an exemption to a data subject’s right to request the restriction of processing of their personal data as well as an exemption from the right to object to processing to personal data used for scientific or historical research purposes. This is the case where it can be shown that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.
TfL undertakes traffic monitoring activities using ANPR cameras installed for all road user charging schemes (ie the congestion charge, LEZ and ULEZ). The data processed for traffic monitoring purposes forms the basis of research and analysis and this includes:
- Analysing the types of vehicles on London's roads
- Analysing numbers of vehicles on London's roads
- Measuring levels of vehicle compliance with emissions standards
- Measuring average journey times to assess levels of congestion on key routes
- Monitoring the impact of specific roadworks on journey times
In this case, traffic monitoring is an essential activity that supports TfL’s statutory functions which include delivering the Mayor’s Transport Strategy and implementing measures that encourage safe, economic and efficient transport facilities in London. Without the ability to monitor traffic volumes, traffic flow/travel patterns and the types of vehicles on key routes, TfL would be prevented from being able to produce accurate or meaningful statistical results which in turn, would leave TfL unable to measure, evaluate or otherwise assess or report on the impacts of its policies.
The UK GDPR requires that where personal data is processed for scientific or historical research purposes, appropriate safeguards should be put in place to ensure the principle of data minimisation. A controller (in this case TfL) is also required where possible, to fulfil these purposes by only processing data that do not permit (or no longer permit) the identification of data subjects. Accordingly, TfL replaces (pseudonymises) the original vehicle registration mark with meaningless string of characters that does not reveal its 'real world' identity and therefore prevents an identifiable vehicle from being placed at a certain location on a certain date or time and prevents it from being associated with the recorded registered keeper. TfL has no need to understand the identity of any individual driver or registered keeper for traffic monitoring purposes and does not use the data processed to support any specific measures or decision-making regarding any particular individual or identifiable person.
To address your statement that this processing falls outside the necessary processing required to enforce ULEZ, Article 5 (1) (b) of the UK GDPR provides that where personal data is processed for scientific or historical research purposes, this shall not be considered to be incompatible with the initial purposes [for which that data was originally collected].
(d) The London wide ULEZ first month report published on the London Assembly website via the link below provides the number of unique vehicles detected in London wide ULEZ each day for 29/08/2023 to 30/09/2023, on Page 58, Table 21:
Question 3: With regards to the possibility of people other than the registered keeper driving the vehicle, I am the only insured driver of [VRM redacted], so your objection to providing the data does not apply. I therefore once more request you provide me with the data I requested together with any information needed to help me interpret it (e.g. please provide details of camera belonging to each camera ID). As for [VRM redacted] I will provide a letter from the other insured driver, so your objection will also not apply.
Answer: I understand that this part of your request relates to a previous Subject Access Request for “Any ULEZ camera records including position, time, speed etc. at which any of my vehicles were observed by said cameras during the period 1 August 2023 to 13 September 2023”. Colleagues in TfL’s Privacy and Data Protection team responded to this request withholding the requested information, in accordance with data protection legislation, explaining the reasons for that decision. You have again made a request for that data, together with any information needed to help interpret it (e.g. please provide details of camera belonging to each camera ID).While this part of your request again constitutes a Subject Access Request, for completeness/ease of reference we have included our response to this question alongside our response to the information you have requested under the Environmental Information Regulations. As this response will be published, we have removed references to any individual Vehicle Registration Marks that you provided.We previously explained to you that for some of the period for which you requested data, the expanded ULEZ was not operational and while testing activities for the new cameras took place, data was not retained in our day-to-day back office systems.As also previously described to you, our records show that one of the vehicles is compliant with ULEZ standards. Therefore, if this vehicle is seen by one of our ANPR cameras, any data captured is not retained in our day-to-day back office operational systems as it is not required for payment or enforcement purposes. The other vehicle is not ULEZ compliant (according to the TfL vehicle checker) and we noted that you have added this vehicle to an AutoPay account. If this vehicle were to be captured by a camera used for ULEZ, this would result in a daily charge being added to your account, and an associated evidential record created, showing the location of the vehicle, and date and time it was seen. No such data was held in relation to this vehicle.The right to access to personal data under Article 15 of the UK GDPR only applies if TfL is in a position to identify a specific individual who is the data actual data subject (in this case, the driver) - unless the individual provides additional information to enable such identification. Being the registered keeper legally responsible for a vehicle, or being a named driver under the terms of a vehicle’s insurance policy does not mean that you are also the individual actually driving that vehicle on a given day or time or location.We would refer you to our earlier response on this matter which is that only providing a Vehicle Registration Mark (VRM) is not sufficient to establish a definite determination that a particular individual (in this case you) is the same person driving the vehicle on each occasion. It is not practical or proportionate to attempt to establish who was driving the vehicle on each occasion, and, in any event, TfL’s cameras focus on the vehicle (make, model and number plate) as opposed to any occupants. Providing a more detailed level of journey data without verifying the identity of the actual driver, could mean that we enable a person to construct the movements and travel patterns of another individual and who has a reasonable expectation that the details of their journeys should remain private.Personal data is defined in Article 4 of the UK GDPR as, “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person…” No vehicle number plate data (including that retained in the log files) is ever associated by TfL with any identifiable individual until such a time that a daily charge is paid, or a chargeable item is taken from a TfL customer’s road user charge account (where held), or when a Penalty Charge Notice (PCN) is issued to the registered keeper by TfL for non-payment of a daily charge. With the exception of these three scenarios, the VRM is never associated by TfL with any identified or identifiable natural person.TfL is also subject to restrictions on access to vehicle licensing and registered keeper data, which is held by the DVLA. The only occasion that a registered keeper is identified is for the issue of a PCN. (You do not need to be the registered keeper of a vehicle to pay a daily charge or add a vehicle to an auto pay account.)In addition, you have also asked for details of [the] camera belonging to each camera ID. We have interpreted this to mean the location of those cameras. Your request has been considered in accordance with the requirements of the Environmental Information Regulations (EIR) and our information access policy. We do hold the information you require. However, even if TfL were to disclose any ULEZ camera records for the vehicles you specified, information regarding the associated camera locations would be excepted from release in order to protect the ULEZ enforcement infrastructure from vandalism (noting that release of information under the EIR is considered to be to the world at large rather than the individual applicant). The information is therefore being withheld under Regulation R12(5)(a) – “international relations, defence, national security & public safety” (in this instance specifically public safety); regulation 12(5)(b) – “the course of justice, the ability of a person to receive a fair trial or the ability of the public authority to conduct and inquiry of a criminal or disciplinary nature” (in this instance specifically the course of justice); and regulation 12(5)(e) – “confidentially of commercial or industrial information where such confidentiality is provide by law to protect a legitimate economic interest.” The rationale for this is explained in more detail in a published response to a previous information request which is available on our website here: https://tfl.gov.uk/corporate/transparency/freedom-of-information/foi-request-detail?referenceId=FOI-0970-2324If this is not the information you are looking for, or if you are unable to access it for any reason, please do not hesitate to contact me.Please see the attached information sheet for details of your right to appeal as well as information on copyright and what to do if you would like to re-use any of the information we have disclosed. Yours sincerely,David WellsFOI Case OfficerFOI Case Management TeamGeneral CounselTransport for London 