Request ID: FOI-3062-2223 Date published: 10 March 2023
You asked
Dear Transport for London,
Please supply the names of your computer systems that contain personal information. That is which systems contain personal data as defined by GDPR.
That includes
1. Names
2. Addresses
3. Number Plates.
4. Photographs
5. Video
6. Email Addresses
7. Credit Card Numbers
8. IP Addresses
9. Cookies
10. Location information
For each system, what is the purpose for storing the information.
Thank you for your requests received by Transport for London (TfL) on 17th and 21st February 2023, and 8th March 2023, asking for information about ‘computer systems’ that contain personal information.
Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy.
Under case ref FOI-3062-2223 you asked the following:
“Please supply the names of your computer systems that contain personal information. That is which systems contain personal data as defined by GDPR.
That includes
1. Names 2. Addresses 3. Number Plates. 4. Photographs 5. Video 6. Email Addresses 7. Credit Card Numbers 8. IP Addresses 9. Cookies 10. Location information
For each system, what is the purpose for storing the information.”
Under case ref FOI-3072-2223 you asked:
“Please supply a list of computer systems that store personal information that you have outsourced, and the names of the organisations that manage those systems.
Personal data is information that relates to an identified or identifiable individual.
That includes email addresses, telephone numbers, number plates, addresses, names, and id numbers, location information etc.”
Under case ref FOI-3289-2223 you asked:
“For personal data, please tell me what systems you have outsourced and to whom. What personal data do these systems process?”
I can confirm that we hold the information you require. However, I am afraid that it is not possible to provide the requested information within the costs limit for responding to FOI cases, as set out under section 12 of the Freedom of Information Act. Under section 12, TfL is not obliged to provide information if it would cost more than £450 to determine if that information is held, and to then locate, retrieve or extract it from elsewhere. This is calculated at a rate of £25 per hour, equivalent to 18 hours work. Note that where an applicant has made more than one request for the same or similar information then the requests can be aggregated for the purposes of calculating costs. That provision applies in this instance.
The exemption applies because virtually all electronic systems process personal data to some degree, but a complete list of such systems in use at TfL has not previously been compiled and there is no quick or efficient way of doing so given the sheer size and complexity of our business (note that TfL’s responsibilities include - but are not limited to - the London Underground, the London Overground, the Elizabeth Line, the Docklands Light Railway, trams, buses, the licensing of taxis and private hire vehicles, the Thames cable car, river services, cycle and e-scooter hire, managing the ‘red route’ road network and Road User Charging schemes, Dial-A-Ride, the London Transport Museum, as well as all of the administrative and support functions required to provide such services and run a staff group of around 27,000 people). Although ‘computer system’ is a somewhat unspecific term, any reasonable interpretation of its meaning is going to cover a vast number of different systems and applications used across our business, and trying to identify those alone (notwithstanding the other elements of your request) is likely to far exceed the costs limit.
In order to bring your request within the costs limit you may wish to reframe it to narrow its scope, focussing on the information that is of most importance to you. For example, rather than asking for all such information across our entire business you may instead wish to focus on a specific system or systems.
Note further that we proactively publish information on our process for handling personal data, available on our website here:
These web pages provide information on the types of personal data controlled by TfL, the lawful basis and purposes for its use, the use of outsourced processors of that data, the length of time it is kept for and other information.
Finally, on the questions of outsourced systems, note that TfL has not outsourced the management of any computer systems that process TfL personal data. Whilst external suppliers may provide software, support systems or provide services direct to customers, the management of the data in the information systems remains TfL’s responsibility. Details of supplier contracts can be found here: https://tfl.gov.uk/corporate/transparency/
Please see the attached information sheet for details of your right to appeal as well as information on copyright and what to do if you would like to re-use any of the information we have disclosed.
Yours sincerely,
David Wells FOI Case Officer FOI Case Management Team General Counsel Transport for London
