Clean Air Zone (CAZ) privacy notice

A Clean Air Zone (“CAZ”) is an area where targeted action is taken to improve air quality, in particular by discouraging the most polluting vehicles from entering the zone. No vehicle is banned in the zone, but those which do not have clean enough engines will have to pay a daily charge if they travel within the area.

Portsmouth will be introducing a Class B CAZ. Non-compliant heavy goods vehicles, buses and coaches that are Euro 5 or older if diesel, or Euro 3 or older if petrol, will be charged £50 a day to drive in the zone. Non-compliant taxis and private hire vehicles that also don’t meet those standards will be charged £10 per day to drive in the zone. Vans, minibuses, motorcycles and private cars will not be charged. Please see the Portsmouth CAZ website for more details: Charging Clean Air Zone – Travel Portsmouth

This CAZ privacy notice supplements the Council’s general privacy notice here. This supplemental notice explains how the Council processes and shares your personal data for the purposes of the CAZ as joint data controller with the Joint Air Quality Unit (“JAQU”). JAQU is a joint unit of the Department of Transport (“DfT“) and the Department for Environment, Food and Rural Affairs (“DEFRA”) established to oversee the UK plan for tackling roadside nitrogen dioxide (NO₂) concentrations.

This CAZ privacy notice deals only with personal data in respect of which the Council is a joint controller with JAQU.  For information on how JAQU processes and shares your personal data with organisations other than the Council please refer to JAQU’s own privacy notice.

To enable the Council to operate its CAZ, JAQU is delivering the CAZ Central Service, a digital service that allows the Council to:

• determine whether a vehicle entering a CAZ is compliant with the CAZ Framework, and if the vehicle is not compliant, whether it is liable to be charged and, if so, how much: and
• provide a first point of contact for the resolution of queries and to support assisted digital users.

The CAZ Central Service also allows individual motorists and fleet operators to pay for entry into the CAZ.

JAQU and the Council will be using the Council’s automatic number plate recognition (“ANPR”) cameras to record your vehicle registration number (“VRN“). The cameras will be supplied and operated by Siemens Mobility Ltd as a data processor for the Council. Your VRN will also be collected if you use the vehicle checker to check if you’ll be charged to drive in a CAZ. This service is accessible on the Gov.UK website.

JAQU and the Council treat your VRN as personal data.

For the purposes of the CAZ Central Service customer contact centre, through which you can make any enquiries concerning the operation of the CAZ, and to enable resolution of any queries you may have, JAQU and the Council may share your:

• First Name
• Surname
• Phone Number
• Email address
• Number plate (“VRN”)

We are required to test the performance of our systems before going live with the CAZ service. For this we will be provided with a sample of the DVLA’s vehicle records from 2010 which will be shared between the DVLA and the Council via JAQU. This enables the system to be tested against expected performance under controlled volumes. This data is deleted once testing is completed.

If your vehicle travels in the CAZ, the Council’s ANPR cameras (operated by Siemens)  covering that zone will record your VRN and the Council will pass that information to JAQU so that JAQU can determine whether your vehicle falls within the CAZ scheme and meets the current emission standards. If your vehicle falls within the scheme (detailed at the beginning of this notice) and does not meet these emission standards, DVLA will use your name and address held in their records with your VRN to send you an early notice letter, on behalf of the Council, informing you that you will likely have to pay a charge if your vehicle travels in that area after Clean Air Zone charging starts.

If your vehicle is liable to be charged and travels in the CAZ once it is in operation, you will be able to pay using a credit or debit card, or by Direct Debit. When you enter your bank details to make payment they will be processed by the CAZ Central Service (using GOV.UK Pay and GoCardless acting on behalf of JAQU, who will store the payment transaction). The payment data is exchanged with the CAZ Central Service but will not be stored at all. As appropriate PCC may instruct GoCardless or GOV.UK Pay to refund funds to the account from which payment was made.

An email address will be requested from you to allow a payment transaction receipt to be sent by GOV.UK Notify or GoCardless. The Council will be sent confirmation of the payment including the VRN  that has been paid for. The payment information in the CAZ Central Service is matched with the ANPR feed from local authorities to exchange payment status.

The email content and email address are retained on the GOV.UK Notify platform for a period of 7 days and are then deleted.

JAQU will retain your payment transactions for a period of 7 years in the service. These include the VRN against which the payment is made. Business account users will be able to view their transaction payment history for up to 18 months from the longer of account creation or from when a payment is completed.

JAQU has security arrangements in place to ensure that only authorised personnel can access the data e.g. log into accounts for licensing authorities.

The council will share the VRN data captured by Siemens Mobility (as Data Processor for the council) with JAQU and DVLA for the purpose of determining whether your vehicle meets the CAZ charging criteria and, if so, with JAQU as part of the payment, charge settlement and refund processes.

It may also be necessary to share information with the Police and/or other law enforcement agencies for the purpose of crime prevention or detection.

In order to assess how successful the programme is, an understanding of the type of vehicles travelling within the zone before, during and after implementation of the scheme is needed. The Council will be sharing VRN details with JAQU before the CAZ goes live, and then quarterly for the duration of the evaluation. DfT will match this data with vehicle type and emissions data which will be anonymised (data that does not allow an individual to be identified), before being sent back to  the Council and 3^rd parties (Ricardo Energy and Environment and Ipsos MORI) for further evaluation and reporting.

Neither the Council nor JAQU will retain the VRN data, but DfT will retain pseudonymised data (where identifying details are replaced with a key) for no longer than 12 months.

• The legal basis for processing your personal data falls under Article 6(1)(e) of the UK General Data Protection Regulation where it is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in DfT and Defra, as partners in JAQU; and
• the Council as the operator of the CAZ.

The task is in the public interest to inform people of new regulations and penalties prior to them coming into effect and to facilitate the operation of the CAZ. This relates to monitoring and identifying contraventions of Part III and Schedule 12 of the Transport Act 2000 and Parts 2 and 6 of The Road User Charging Schemes (Penalty Charges, Adjudication and Enforcement) (England) Regulations 2013 pertaining to the Clean Air Zone Charging Order relevant to the Council whose ANPR cameras recorded your VRN.

The ability for charging authorities to introduce a CAZ is set out in the Transport Act 2000. Part III of the Act empowers local authorities (as “charging authorities”) to make a local charging scheme in respect of the use or keeping of motor vehicles on roads.

The legal bases under data protection legislation for the joint controllers to process the personal data with each other are:

• Article 6 (1) (e) of the UK GDPR (Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller); and
• If and to the extent that personal data is within the special categories of personal data, as defined in the data protection legislation, Article 9(2)(g) of the UK GDPR (processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the Data Protection Act 2018 Act);

Where we process special category personal data, the relevant condition for the purposes of the Data Protection Act 2018 Schedule 1 is “Statutory etc and government purposes”, being:

• the exercise of a function conferred on a person by an enactment or rule of law; and/or
• the exercise of a function of the Crown, a Minister of the Crown or a government department.

Data will not be transferred outside of the UK and the European Economic Area.

If you have concerns, contact the following:

1. JAQU as main point of contact regarding the CAZ.
2. The Council at CAZHelpDesk@portsmouthcc.gov.uk or the Council’s Data Protection Officer at DataProtection@portsmouthcc.gov.uk. The Council is a joint data controller for the purposes of the CAZ and as such you are also entitled to contact it to exercise your rights as a data subject. Please refer to the main privacy notice.
3. Data Protection Manager for JAQU by email at: data.protection@defra.gov.uk if you have any questions about how your personal data is processed in relation to the CAZ Central Service.

Along with your query, you will need to give your name and email address, which will be used to respond to you. The information you provide will be sent by GOV.UK Notify to JAQU (or their agents acting on their behalf) for the sole purpose of replying to you. Your personal information will be deleted after a year.

If you have any questions about how your personal data is processed in relation to the CAZ Central Service, please contact:

Data Protection Manager for JAQU by email at: data.protection@defra.gov.uk

The joint controllers have agreed the following arrangement to determine their respective obligations under the UK GDPR:

• They have jointly prepared this privacy notice.
• They will cooperate with each other in responding to any request each receives from data subjects exercising their rights under data protection legislation in relation to their personal data (a ‘data subject request’). The party which receives the data subject request will fulfil the obligations of the controller to respond to the request in accordance with data protection legislation.
• They will provide reasonable assistance to each other to enable a data subject request to be dealt with in an expeditious and compliant manner.
• Each shall be responsible for fulfilling the controller’s responsibilities under data protection legislation as to security of personal data when that personal data is processed on systems controlled by that party.
• If one joint controller discovers a data breach, that party (the ‘reporting party’) will be responsible for assessing whether the breach constitutes a personal data breach that is required to be notified to the Information Commissioner’s Office and (where applicable) to the data subjects under Articles 33 and 34 of the UK GDPR. The reporting party shall fulfil the obligations of the controller to give such notice, if it is required, in accordance with data protection legislation.
• They have agreed to provide reasonable assistance to each other in order to facilitate the handling of any data breach in an expeditious and compliant manner.
• In the event of a dispute brought by a data subject or a data protection authority concerning the processing of personal data against either or both of them, the joint controllers will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

Irrespective of the above arrangement, you can exercise your rights under the UK GDPR in respect of and against each of the joint controllers if you wish.

A list of your rights under the General Data Protection Regulation, the Data Protection Act 2018 (DPA 20182), is accessible here on the ICO website.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) the UK’s independent body set up to uphold information rights) at any time. Should you wish to exercise that right full details are available on the ICO website.

We review our privacy policy regularly. By doing this we will make sure you are always aware of what information we collect, how we use it and under what circumstances (if any) we will share it with other parties.