ULEZ Data: Where and by whom is ULEZ data processed by and for how long is it retained
Request ID: FOI-2751-2324 Date published: 27 November 2023
You asked
Dear Transport for London,
I drive in and out of the Congestion Charging, LEZ and ULEZ zones on a daily basis. During this time I pass a number of ANPR cameras which are used for the purposes of enforcing any/all of the above traffic management schemes. I make reference to two publicly available DPIA documents, https://content.tfl.gov.uk/london-wide-ulez-use-of-mobile-anpr-vehicles-dpia-august-2023.pdf, https://content.tfl.gov.uk/ulez-expansion-dpia-april-2022.pdf
To that end I would like to know
1) Where is number plate capture information processed? (Legal Jurisdiction) Specifically, number plate value, time, location, any associated imagery
2) Where is Personally Identifiable Information (PII) (name and address data) processed?
3) Where is the combination of PII and number plat information processed?
4) How long is number plate data and any associated capture information retained for in all cases, separately, noting. where there is no charge payable there is significantly reduced business case for retaining the information on anything other than an aggregate basis vs. where a charge is issued.
5) Any policy or procedural documents detailing the approach to the destruction of data
6) Any policy which describes decisions and justifications for ULEZ data retention in relation to TFLs obligations under the Data Protection Act 2018 (s.39, the fifth principle)
We answered
TfL Ref: FOI-2751-2324
Thank you for your request received by Transport for London (TfL) on 1st November 2023 asking for information about data collected by Automatic Number Plate Recognition (ANPR) cameras in connection with our Road User Charging (RUC) schemes.
Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy.
Your questions are answered in turn below. Please note that the following page of our website provides more detail about how TfL collects and uses the personal information collected for the operation of our Road User Charging schemes, including the various Data Protection Impact Assessments associated with the schemes.
Question 1) Where is number plate capture information processed? (Legal Jurisdiction) Specifically, number plate value, time, location, any associated imagery
Answer: The RUC Information technology system (operated by Capita) is a cloud based Azure solution (hosted in Ireland and the Netherlands). Currently UK data protection law treats the EU and EEA Member States as having ‘adequate’ protection for personal data. Some testing activities take place using remote access to data from overseas locations. This includes locations within the EEA as well as Argentina, India, Israel. Where required, the appropriate International Data Transfer Assessments have been conducted as well as contractual provisions implemented.
2) Where is Personally Identifiable Information (PII) (name and address data) processed?
Answer: See answer to Q1 above.
Question 3) Where is the combination of PII and number plat information processed?
Answer: See answer to Q1 above.
Question 4) How long is number plate data and any associated capture information retained for in all cases, separately, noting. where there is no charge payable there is significantly reduced business case for retaining the information on anything other than an aggregate basis vs. where a charge is issued.
Answer: Please see the link to our website referenced above and in particular the section “Length of time we keep information”. As you can see, the following applies:
• Vehicle images are automatically deleted a maximum of 21 days after payment of the charge has been received and verified or when we have verified that a vehicle is registered for a discount or exemption, or it is otherwise compliant with scheme requirements (eg a vehicle is known to meet the ULEZ emission standards).
• For Autopay customers, ANPR data and images are retained until after the account has been settled, usually a maximum period of 90 days
• Details of a PCN are retained for seven years after payment of the PCN (this will include images of the vehicle)
Question 5) Any policy or procedural documents detailing the approach to the destruction of data
Answer: It is not entirely clear what is meant by “approach to the destruction of data”. However, note the answer to Question 4 above about data retention periods. If you wish to clarify this aspect of your request please do so and we will consider it further.
Question 6) Any policy which describes decisions and justifications for ULEZ data retention in relation to TFLs obligations under the Data Protection Act 2018 (s.39, the fifth principle)
Answer: See the link to our website referenced above and the various Data Protection Impact Assessments found there. As you can see, the page contains a section “Legal basis for using your information” which explains the following:
Under data protection legislation, TfL is only allowed to use personal information if we have a proper reason or 'legal basis' to do so. In the case of Road User Charging, there are a number of these 'legal grounds' we rely on, which are:
• Our statutory and public functions:
• to undertake activities to promote and encourage safe, integrated, efficient and economic transport facilities and services, and to deliver the Mayor's Transport Strategy;
• TfL has specific statutory powers to operate the various Road User Charging schemes in London which include administering the various daily charges as well as the issue and enforcement of Penalty Charge Notices;
• TfL's use of ANPR cameras for the operation and enforcement of Road User Charging Schemes is also recognised under various statutory regulations.
• For the 'performance of a contract':
• for example, where you have opened an account to register for a discount, use the Auto Pay service; or apply to the scrappage scheme or
• you have downloaded the app so we can provide additional services to you
• Where you have given your consent to TfL:
• for example where you have opted in to receive marketing messages from us or asked the contact centre to resolve an issue or complaint for you.
If this is not the information you are looking for please do not hesitate to contact me.
Please see the attached information sheet for details of your right to appeal as well as information on copyright and what to do if you would like to re-use any of the information we have disclosed.
Yours sincerely,
David Wells FOI Case Officer FOI Case Management Team General Counsel Transport for London
