Publication from Siân Berry: Dealing with privacy considerations in plans for expanded ULEZ

Dear Sadiq,



I am writing to raise concerns about potentially serious omissions I have observed in the consultation and decision‐making process for plans to expand the London Ultra Low Emission Zone (ULEZ) to the north and south circular roads in 2021.

In the process so far I do not believe that issues of privacy, including the collection, retention and sharing of details of vehicle movements, has been dealt with properly, and that there is an urgent need for further impact assessments and consultation on these issues before plans can proceed.



My principal concerns are that Privacy or Data Protection Impact Assessments that should have been carried out were not, and that no mention of the additional data collection, retention and sharing proposed by Transport for London (TfL) as part of the scheme was made in any of the consultation documents.



I also believe that any routine and comprehensive data sharing of this new data with police for non‐national security work should be subject to consultation and a new Mayoral Decision, rather than relying on the decision to share ANPR data from the existing TfL camera network data that was made in 2015. This new decision should also be consulted upon with the public.



In summary, I believe the main issues are:



A) Both the extent and character of data collection is changing



The expanded ULEZ will bring about both a quantitative and qualitative change in the data on vehicle movements being captured.



In particular, the cameras needed to enforce the new expanded zone will take in a large number of mainly residential areas that have not been surveilled in this way before – the TfL ANPR camera network being limited at present to central London, as well as major roads and junctions outside this area, to enforce the existing LEZ.



TfL has said in response to journalist questions that an estimated additional 672 ANPR enabled camera locations will be installed across the expanded zone up to the north and south circular roads, adding to approximately 1,300 existing cameras – more than a 50 per cent increase.



According to a September 2018 MOPAC decision on new data storage procurement, the MPS is expecting to record an additional nine million number plate ‘reads’ per day in future: “chiefly due to the TfL camera strategy.”[1,2]

Most of these new camera locations will be in areas of London where very little of this kind of surveillance has been done before, in contrast to the highly surveilled central Congestion Charging Zone (CCZ), which has had high levels of TfL camera coverage since 2003, when the Congestion Charge was introduced. There is also a much higher population in inner London compared with central London ‐ estimates in the ULEZ consultation supporting information give 209,000 residents in Central London, compared with 3.8 million in the expanded zone.[3]

Londoners who live in the CCZ already had the chance to comment on their journeys to and from home being captured by TfL and shared with and retained by police in the consultation that led to MD1439 in 2015. However, the planned expansion will bring in many more homes and capture many more of Londoners’ daily journeys around their homes and neighbourhoods.



Therefore, the expansion of camera coverage in the expanded ULEZ represents both a significant quantitative change in the amount of data planned to be collected and a qualitative impact on Londoners’ privacy in terms of the types of citizens and types of privacy‐sensitive activities being recorded.



B) A Privacy or Data Protection Impact Assessment should have been carried out



I believe that the extent and nature of new data collection planned under the expanded ULEZ at least required a Privacy Impact Assessment under the Data Protection Act 1998, but that in fact under the new General Data Protection Regulation (GDPR) and Data Protection Act 2018, a Data Protection Impact Assessment was required.[4] The new legislation came into force on 25 May 2018, and the Mayoral Decision to proceed with the expanded ULEZ was made on 6 June 2018.



However, neither assessment was carried out ahead of MD2305, which confirmed the expanded ULEZ to begin in 2021.

The Integrated Impact Assessment (IIA), which was published during the consultation period in December 2017, considers the expanded camera network only in the context of its impact on crime reduction and community safety.[5] It falsely states that the cameras only record ANPR data, when they also record images for enforcement (although only the ANPR data is currently shared with police for crime purposes).



The document concludes that there is a neutral impact on crime and makes no

consideration of privacy at all.

2.2.31 The enforcement infrastructure for the stronger LEZ proposal would primarily be made up of the existing LEZ cameras. The expanded ULEZ will require additional cameras in the Inner Zone, however these are only for number plate recognition and not close circuit television. The additional cameras are therefore not relevant to community safety or crime.



As such, there is unlikely to be an increased level of surveillance that could deter illegal driving and other antisocial behaviour, nor would the implementation of the combined proposal be likely to cause any increase in crime or fear of crime. As such, health effects associated with crime and community safety are not expected to change as a result of implementation of the stronger LEZ and extended ULEZ.|

C) No information was given on data collection or retention as part of the consultation



I have examined all the information provided as part of the consultation, and the only mention of the use of cameras I can find is on page 13 of the Supporting Information Document (reference 3), which simply says data will be checked but nothing about its retention or sharing:

“Cameras will read vehicle number plates as they are driven into and within the zone to check against a database and establish whether or not a vehicle is compliant with the requirements of the scheme.”

None of the organisations asked to take part in the consultation were ones concerned with human rights or privacy, so it is not surprising that none responded. None of the questions in the consultation related to the collection of data in new areas of London or from a significantly expanded camera network, so it is not surprising that Londoners themselves did not raise concerns either.



Some of the organisations that responded, including some borough councils, appear from the Report to the Mayor to have asked questions about cameras and enforcement, but no details are given and no answers provided other than a comment about ‘design work’ being needed.[6]



D) Data sharing with police is an additional consideration and may require a separate Mayoral Decision



Currently, images and data on vehicle movements are only kept by TfL for up to two months,[7] however, in a 2015 Mayoral Decision (MD1439), made after a public consultation that included a Privacy Impact Assessment, it was agreed to share all the ANPR data (not images) with the Metropolitan Police Service (MPS), which would store it for a further two years.[8,9]



There is no mention in any of the consultation documents for the expanded ULEZ that the data from the new cameras would be shared with police in the same way and kept for two years. From the information above in the IIA it is clear this is the assumption made by the assessors, and when TfL was asked about this by the Mayorwatch website, a spokesperson said it is a ‘working assumption’ the data will be shared in the same way.[10]



I believe there is therefore also a second, separate question of whether a further Mayoral Decision and impact assessment would be needed to authorise the new extent of data sharing with police for general crime purposes.

Next steps



As you know, I am passionate about protecting Londoners from filthy air and a strong supporter of the ULEZ scheme – in fact my group has asked for it to be expanded even further and brought forward.



I am also concerned that decisions about data collection and retention are made properly, without unnecessary intrusion on privacy or sharing, and with the utmost transparency and care for Londoners’ privacy. As a member of the Oversight Committee I took part in an investigation into these issues in 2017 and heard from TfL that it was also committed to these principles.[11]



However, without further action from you I am concerned that the decision to proceed with the expanded ULEZ with data issues unexamined will not be sound and could be challenged.



This should include:

• looking at details of data collection and sharing
• full transparency and impact assessments
• further public consultation specifically on these matters.

I urge you to rectify these omissions as soon as possible, and make any alterations to data collection and sharing plans that are necessary.



This need not cause any delay to the project. The details of data retention and sharing could be reviewed and decided now rather than having been decided upon at the same time as the wider principles of how the scheme works. Changes to these aspects of the scheme need not involve changes to infrastructure and would simply involve back‐end alterations to the storage and sharing of data.



Without action, however, there would be a grave risk of the ULEZ being challenged and this essential measure to protect Londoners’ health not being brought in as soon as it is needed.



I hope you will consider this request and write back to me with your views and any action planned as soon as possible.



Yours sincerely,

Sian Berry

Green Party Member of the London Assembly



[1] Transport for London expects to take 21m ANPR images each day to enforce the Congestion Charge and expanded Ultra‐Low Emission Zone, MayorWatch, Sept 2018 https://www.mayorwatch.co.uk/transport‐forlondon‐expects‐to‐take‐21m‐anpr‐images‐each‐day‐to‐enforce‐the‐congestion‐charge‐and‐expanded‐ultralow‐emission‐zone/

[2] PCD450 decision document, MOPAC, Sep 2018 /sites/default/files/pcd_450_part_1_anpr_nas_management_server.pdf

[3] Changes to Low Emission Zone and Expansion of the Ultra Low Emission Zone ‐ Supporting information document for consultation phase 3b, November 2017 https://consultations.tfl.gov.uk/environment/air‐qualityconsultation‐phase‐3b/user_uploads/ulez‐consultation‐appendix‐i.pdf

[4] Guidance on Data Protection Impact Assessments from the Information Commissioner’s Office:

https://ico.org.uk/for‐organisations/guide‐to‐data‐protection/guide‐to‐the‐general‐data‐protectionregulation‐gdpr/accountability‐and‐governance/data‐protection‐impact‐assessments/

And from the Surveillance Camera Commissioner: https://www.gov.uk/government/publications/dataprotection‐impact‐assessments‐for‐surveillance‐cameras

[5] Ultra Low Emission Zone ‐ Further Proposals. Integrated Impact Assessment. Jacobs, December 2017

https://consultations.tfl.gov.uk/environment/air‐quality‐consultation‐phase‐3b/user_uploads/ulezconsultation‐appendix‐j.pdf

[6] Report to the Mayor, Theme J, Implementation, June 2018

/sites/default/files/appendix_b1_consultation_report_‐_june_2018.pdf

[7] Data retention public information on road user charging, TfL, accessed May 2019

https://tfl.gov.uk/corporate/privacy‐and‐cookies/road‐user‐charging

[8] Mayoral Decision MD1439 Delegation to Transport for London (TfL) to grant the Metropolitan Police Service

(MPS) direct access to Automatic Number Plate Recognition (ANPR) data, Jan 2015

/decisions/md1439‐delegation‐transport‐london‐tfl‐grant‐metropolitan‐policeservice‐mps‐direct‐access

[email protected] 020 7983 4391 @sianberry facebook.com/sianberrygreen

[9] MD1439 Privacy Impact Assessment

/sites/default/files/gla_migrate_files_destination/Appendix%20B%20‐%20Metropolitian%20Police%20‐%20ANPR%20Privacy%20Impact%20Assessment.pdf

[10] Transport for London expects to take 21m ANPR images each day to enforce the Congestion Charge and

expanded Ultra‐Low Emission Zone, MayorWatch, Sept 2018 https://www.mayorwatch.co.uk/transport‐forlondon‐expects‐to‐take‐21m‐anpr‐images‐each‐day‐to‐enforce‐the‐congestion‐charge‐and‐expanded‐ultralow‐

emission‐zone/

[11] Letter to the Mayor. Personal data in the GLA Group. London Assembly Oversight Committee, November

2017 /sites/default/files/personal_data_in_the_gla_group_‐_letter_from_chair_to_mayor.pdf

Dear Sian,



Thank you for your letter of 7 May about privacy considerations in the plans for the· expanded Ultra Low Emission Zone (ULEZ). I apologise for the delay in responding to you.

I would like to reassure you that both Transport for London (TfL) and I take very seriously our responsibilities to protect personal information and to ensure compliance with the General Data Protection Regulation (GDPR) and associated data protection legisla ion. A range of robust policies, processes and technical measures are in place to control and safeguard access to, and use of, personal information associated with all the Road User Charging schemes. Full details of how personal data is handled are made available on TfL's Privacy Page at: https://tfl.gov.uk/corporate/privacy-and-cookies/road-user-charging



I know you support the ULEZ, and I am pleased to have your backing for this important project. In the few months following the launch of the world's first ULEZ we have already seen a significant impact on the types of vehicles driving in the centre of our capital and polluting our air. These were big changes, and vital ones - our toxic air is an invisible killer responsible for one of the biggest national health emergencies of our generation.



An expanded ULEZ and tighter standards for buses, coaches and lorries across London, in conjunction with the central London ULEZ, will further transform the air that millions of Londoners breathe.

General Data Protection Regulation (GDPR)



The GDPR came into force on 25 May 2018. It makes conducting a Data Protection Impact Assessment (DPIA) mandatory for the processing of any personal data that is likely to result in a high risk to individuals' rights and freedoms. It also requires consultation with the Information Commissioner's Office (ICO) where any such high risk is identified and there are no measures identified that would either eliminate that risk or mitigate it to an acceptable level.



At the time of the consultation on expanding the ULEZ there was no obligation under the GDPR or other applicable data protection laws to have undertaken a DPIA, either at the consultation stage or at my decision to confirm the Variation Order. This is because no processing of personal data or special categories of personal data was involved at either stage.



Although the consultation material made no specific mention of additional personal data collection, it was implicit in the consultation proposals that an expanded ULEZ would involve the systematic monitoring of new publicly accessible areas on a larger scale which would require further cameras for enforcement purposes. In addition, the consultation materials did not include detailed proposals for Tfl's camera strategy, including locations and numbers of additional cameras; this was not available and to include this level of detail would have been premature.

The consultation was extensive and encouraged responses from as many individuals and organisations as possible. An Integrated Impact Assessment was carried out for both the consultation and the Mayoral decision. That level of assessment was appropriate to the level of proposals and decisions being taken and was in compliance with requirements regarding personal information under the GDPR and data protection law applicable at the time.



Data Protection Impact Assessment (DPIA)

A DPIA is appropriate and necessary as Tfl develops its plans for the implementation of the expansion and begins to plan its camera strategy. Tfl has already commenced preparations for carrying out a DPIA.

The DPIA will help to ensure operational decisions made on the locations and numbers of additional cameras that may be installed for an expanded ULEZ, take account of privacy and data security concerns - and identify mitigations for any privacy and data security risks. The DPIA will also consider the increased volumes of personal data processed as a result of the expanded ULEZ and any increase in camera numbers and locations where they are installed. Tfl will liaise with the ICO and take advice as to whether a wider stakeholder or public consultation is appropriate. I expect the initial DPIA to be available for publication before the finalisation of the camera strategy.



Protecting_ privacy



All existing ULEZ enforcement cameras capture an alpha-numeric feed of a vehicle's registration mark using Automatic Number Plate Recognition (ANPR) plus a still photographic image, to enable vehicle recognition and to determine whether the vehicle is compliant or required to pay the charge in question (CC, LEZ or ULEZ). The data collected is "personal data' within scope of the GDPR. Images of the registration plate which also show a view of the vehicle are captured to provide contextual information, such as vehicle location or colour, make, model. Such details have been used at times to confirm that the vehicle captured was in fact using a false, cloned number _plate.



The camera system we will be using is focused on number plate capture and will adhere to both data protection legislation and surveillance camera best practice; for example Tfl voluntarily complies with the 12 principles set out in the Surveillance Camera Code of Practice issued by the Home Office and which applies to local authorities and police forces in England and Wales. Cameras will not be directed on people's driveways, fronts of houses or other buildings or on individual people (whether inside or outside a vehicle). In order to meet the GDPR principle of 'data minimisation', we must be able to demonstrate that Tfl is capturing the minimum possible data to achieve the purpose (including both minimum number of ANPR and photographic image captures and the minimum possible amount of physical infrastructure). Evidence of this will be captured through the DPIA.



Data sharing with the Metropolitan Police



A Mayoral Decision (MDl 439) was approved in 2015 by the previous Mayor to share ANPR data with the Metropolitan Police. The purpose of this MD was to enhance the Met's ability to detect and prevent crime by enabling them to make use of existing camera infrastructure in London.

A PIA (privacy impact assessment, the fore-runner of a DPIA) was undertaken at the time and involved wide public consultation as well as direct engagement with the ICO and representatives from civil liberties groups. The PIA was appended and considered when the MD was approved. MDl 439, and its delegation and direction to Tfl, remains in place and is still applicable and current.



In principle, the nature and purpose of the data stored are unchanged by the volume collected or geographic area covered by the expanded ULEZ. It is Tfl's current working assumption that the data captured in the expanded ULEZ will be subject to the same sharing arrangements with the Met. However, the DPIA that Tfl will undertake will consider whether current arrangements are adequate and compliant with GDPR requirements, including whether those approved under MD 1439 remain appropriate and reflect ICO guidance and best practice.



As always, I am committed to addressing concerns, including those relating to privacy, which will help to inform the implementation of the ULEZ.



Thank you again for writing to me.



Yours sincerely,



Sadiq Khan

Mayor of London