Privacy
UK GDPR supplemental privacy statement: clean air zone (CAZ)
A Clean Air Zone (CAZ) is an area where targeted action is taken to improve air quality, in particular by discouraging the most polluting vehicles from entering the zone. No vehicle is banned in the zone, but those which do not have clean enough engines will have to pay a daily charge if they travel within the area.
This CAZ privacy notice supplements Birmingham City Council’s general privacy notice. This supplemental notice explains how the council processes and shares your personal data for the purposes of the CAZ as joint data controller with the Joint Air Quality Unit (JAQU). JAQU is a joint unit of Department of Transport (DfT) and the Department for Environment, Food and Rural Affairs (Defra) established to oversee the UK plan for tackling roadside nitrogen dioxide (NO2) concentrations.
This CAZ privacy notice deals only with personal data in respect of which the council is Joint Controller with JAQU. For information on how JAQU processes and shares your personal data with organisations other than the council please refer to JAQU's own privacy notice.
What personal data is being collected and how is it used?
To enable the council to operate its CAZ, JAQU is delivering the CAZ Central Service, a digital service that allows the council to:
- determine whether a vehicle entering a CAZ is compliant with the CAZ Framework, and if the vehicle is not compliant, whether it is liable to be charged and, if so, how much: and
- provide a first point of contact for the resolution of queries and to support assisted digital users.
The CAZ Central Service also allows individual motorists and fleet operators to pay for entry into the CAZ.
JAQU and the council will be using the council's automatic number plate recognition (ANPR) cameras covering the CAZ to record your number plate ("vehicle registration mark"). Your number plate will also be collected if you use the vehicle checker ("Check if you'll be charged to drive in a Clean Air Zone") service.
JAQU and the Council treat your number plate ("vehicle registration mark") as personal data.
For the purposes of the CAZ Central Service customer contact centre, through which you can make any enquiries concerning operation of the CAZ, and to enable resolution of any queries you may have, JAQU and the council may share your:
- Name
- Surname
- Phone Number
- Email address
- Number plate ("vehicle registration mark")
Before the CAZ comes into operation
If your vehicle travels in a Clean Air Zone, the council's automatic number plate recognition (ANPR) cameras covering that Zone will record your number plate and the council will pass that information to JAQU so that JAQU can determine whether your vehicle meets current emission standards. If your vehicle does not meet these emission standards, DVLA will use your name and address held in their records with your vehicle number plate to send you an Early Notice letter, on behalf of the local authority, informing you that you will likely have to pay a charge if your vehicle travels in that area after Clean Air Zone charging starts.
JAQU and the DVLA will not keep your personal data for the purpose of sending the Early Notice Letter after that letter has been sent to you.
Once the CAZ is in operation
If your vehicle is liable to be charged and travels in the CAZ once it is in operation, you will be able to pay using a credit or debit card, or by Direct Debit. When you enter your bank details to make payment; your payment data will be processed by the CAZ Central Service (using GOV.UK Pay and Go Cardless acting on behalf of JAQU, who will store the payment transaction). The payment date is exchanged with the CAZ Central Service but will not be stored.
An email address will be requested from you to allow a payment transaction receipt to be sent by GOV.UK Notify. The council will be sent confirmation of the payment including the vehicle number plate that has been paid for. The payment information in the CAZ Central Service is matched with the ANPR feed from local authorities to exchange payment status.
The email data is retained on the GOV.UK Notify platform for a period of 7 days and then deleted.
JAQU will retain your payment transactions for a period of 7 years in the service. These include the number plate(s) against which the payment is made. Users will be able to view transaction payment history for up to 18 months of account creation or from when a payment is completed.
JAQU has an access management process that controls who has access to all systems and audits user access on a regular basis to update access rights. Security arrangements are in place to ensure that only authorised personnel can access the data e.g. log in accounts for licensing authorities
What is the lawful basis for processing the personal data?
The legal basis for the processing (use) of your personal data is that the use of your personal data is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in:
- DfT and Defra, as partners in JAQU; and
- the council as operator of the CAZ.
The task in the public interest is to inform people of new regulations and penalties prior to their coming into effect, and to facilitate the operation of the CAZ. This relates to monitoring and identifying contraventions of Part III and Schedule 12 of the Transport Act 2000 and Parts 2 and 6 of The Road User Charging Schemes (Penalty Charges, Adjudication and Enforcement) (England) Regulations 2013 pertaining to the Clean Air Zone Charging Order relevant to the local authority whose ANPR cameras recorded your number plate.
The ability for charging authorities to introduce a Clean Air Zone is set out in the Transport Act 2000. Part III of the Act empowers local authorities (as “charging authorities”) to make a local charging scheme in respect of the use or keeping of motor vehicles on roads.
The legal bases under data protection legislation for the Joint Controllers to process the personal data with each other are:
- Article 6 (1) (e) of the UK GDPR (Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller); and
- If and to the extent that personal data is within the special categories of personal data, as defined in the data protection legislation, Article 9(2)(g) (Processing necessary for reasons of substantial public interest, on the basis of United Kingdom law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject).
Where processing is carried out under clause Shared Personal Data, the relevant condition for the purposes of DPA 2018 Schedule 1 is "Statutory etc and government purposes", being:
- the exercise of a function conferred on a person by an enactment or rule of law; and/or
- the exercise of a function of the Crown, a Minister of the Crown or a government department.
Will my personal data be transferred outside the UK?
Data will not be transferred outside of the UK.
Who can I contact with any concerns about the CAZ?
The council is a joint data controller in respect of personal data processed for the purposes of the CAZ, and as such you are entitled to contact the council to exercise your rights as a data subject. For full contact details, and an explanation of your rights as data subject, please refer to our main privacy notice.
However, under the arrangement agreed between the council and JAQU, JAQU has been identified as the main point of contact. You can raise any queries about the information provided by the vehicle checker service by using the web form.
Along with your query, you will need to give your name and email address, which will be used to respond to you. The information you provide will be sent by GOV.UK Notify to JAQU (or their agents acting on their behalf) for the sole purpose of replying to you. Your personal information will be deleted after a year.
If you have any questions about how your personal data is processed in relation to the CAZ Central Service, please email the Data Protection Manager for JAQU
What is the arrangement between the joint controllers regarding other matters concerning my personal data?
The Joint Controllers have agreed the following arrangement to determine their respective obligations under the UK GDPR:
- They have jointly prepared this privacy notice.
- They will cooperate with each other in responding to any request each receives from data subjects exercising their rights under data protection legislation in relation to their personal data (a ‘Data Subject Request’). The party which receives the Data Subject Request will fulfil the obligations of the controller to respond to the request in accordance with data protection legislation.
- They will provide reasonable assistance to each other to enable a Data Subject Request to be dealt with in an expeditious and compliant manner.
- Each shall be responsible for fulfilling the controller’s responsibilities under data protection legislation as to security of personal data when that personal data is processed on systems controlled by that party.
- If one Joint Controller discovers a data breach, that party (the ‘Reporting party’) will be responsible for assessing whether the breach constitutes a personal data breach that is required to be notified to the Information Commissioner’s Office and (where applicable) to the data subjects under Articles 33 and 34 of the UK GDPR. The Reporting party shall fulfil the obligations of the controller to give such notice, if it is required, in accordance with data protection legislation.
- They have agreed to provide reasonable assistance to each other in order to facilitate the handling of any data breach in an expeditious and compliant manner.
- In the event of a dispute brought by a data subject or a data protection authority concerning the processing of personal data against either or both of them, the Joint Controllers will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
Irrespective of the above arrangement, you can exercise your rights under the UK GDPR in respect of and against each of the Joint Controllers if you wish.
Where can I find further information about my rights?
You also have the right to lodge a complaint with the ICO (supervisory authority) at any time.
Review
We review our privacy policy regularly. By doing this we will make sure you are always aware of what information we collect, how we use it and under what circumstances (if any) we will share it with other parties.