Hundreds of thousands of EU nationals have been unfairly fined for driving in London's Ureshreen Air Zone in what European governments say is “probably one of the biggest data breaches in EU history”. It is said that he was punished.
The Guardian reports that Transport for London (TfL) has been accused by five EU countries of illegally obtaining the names and addresses of citizens in order to issue fines since 2021, totaling more than 320,000 cases. A fine of 1,000 euros has been imposed. .
The London Assembly's Liberal Democrat transport spokesperson called for an immediate investigation into the matter, saying it could damage the UK capital's reputation as open to tourists.
Since leaving the EU, the UK has been prohibited from automatically accessing the personal information of EU residents. Transport authorities in Belgium, Spain, Germany and the Netherlands have confirmed to the Guardian that driver data cannot be shared with the UK due to the implementation of London's Ultra Low Emission Zone (Ures), and registered The driver's details were illegally obtained by police agents. TfL contractor Euro Parking Collection.
In France, more than 100 drivers are suing over claims their details were fraudulently obtained, while truck drivers in the Netherlands are suing TfL for more than £6.5 million in illegally imposed fines. is filing a lawsuit against.
According to Belgian MP Michael Freilich, who investigated the matter on behalf of his constituents, TfL is making Europe's drivers a “cash cow” by using ill-gotten data to impose unwarranted fines. It is said that it is treated as such.
Many of the penalties were imposed on drivers who visited London in Urez-compliant vehicles and were unaware that they needed to register with TfL's collection agency, Europarking, at least 10 days before their visit. .
According to Urez rules, failing to register is not considered an offense, but some drivers are still facing fines of up to five figures. TfL argued that the fine was justified because it could not check whether foreign cars were in breach of emissions standards if they were not registered.
Some low-emission vehicles are incorrectly classified as heavy-duty diesel vehicles and can be fined under a separate Low Emission Zone (Lez) scheme, with fines of up to £2,000 per day. Hundreds of drivers complained that fines arrived weeks after early payment discounts and appeal deadlines had passed.
A French driver has been fined £25,000 for breaking the Les and Urès rules, even though his minibus was exempt.
Mr Freilich called on ministers to raise this issue during Belgium's current EU Council Presidency. “This is probably one of the biggest privacy and data breaches in the history of the EU, but so far no concrete action has been taken as the responsibility has been shifted to the driver,” he said.
TfL said that despite there being no separate data sharing agreements with EU countries, “local law” allows the authority to share vehicle owner information with the UK for traffic enforcement purposes. Ta.
However, EU countries argue that domestic law only allows the UK to access personal data for criminal offenses, not civil ones. Violating Urez regulations is a civil offense, but more dangerous acts such as speeding and driving under the influence of alcohol or drugs can be a criminal offense. This raises questions about whether Europarking can legally enforce its contract with TfL.
Europarking was awarded a five-year contract by TfL in 2020 to recover debts from foreign drivers who breach congestion and emission zone rules.
The company's revenue, which is based on performance, is estimated to be between £5 million and £10 million. He also has the option to renew for five years.
The company is owned by Vera Mobility, a U.S. transportation technology group listed on the Nasdaq stock exchange, and is headed by former Bank of America Merrill Lynch executive David Roberts. The company's net revenue for the second quarter of 2023 was $205m (£161m).
In October, the Belgian government ordered a criminal investigation after a court bailiff was accused of illegally passing the details of 20,000 drivers to Europark to crack down on Ures. The bailiff was suspended in 2022, and TfL initially claimed that no Belgian data had been shared with Europarking since then. However, a Freedom of Information request by the Guardian revealed that more than 17,400 fines had been issued to Belgians in the last 19 months.
TfL then claimed that the driver's details were provided directly to Europarking by the Belgian Vehicle Licensing Authority. The company subsequently told the Guardian that it obtained this information via the National Contact Point (NCP), a network of official information hubs used by certification bodies.
However, Belgium's Transport Minister acknowledged that data cannot be shared directly or indirectly for the Ures crackdown. Last month, Belgium's data protection authority launched an investigation into how the information was still being obtained.
Activists say Europarking is circumventing data protection rules by using EU-based agencies to request driver data without disclosing that it is for UK law enforcement. I'm blaming.
Last year, an investigation by the Dutch motor vehicle licensing authority RDW revealed that the personal information of 55,000 citizens had been obtained through Italy's NCP. “NCP has informed us that an authorized user has used the data in an illegal manner and access has been terminated,” the spokesperson said.
German transport authority KBA claimed that Italy's NCP was used to obtain information from its database. A KBA spokesperson said: “Euro Parking obtained the data by illegally exploiting an EU directive to facilitate the cross-border exchange of information on traffic violations endangering road safety.” “This directive does not include any violation of environmental regulations.”
Spain's Transport Ministry told the Guardian that British authorities were not given access to driver details due to the Ures crackdown. Europarking has issued more than 25,600 fines to Spanish drivers since 2021.
In France, 102 drivers filed a lawsuit alleging their details were fraudulently obtained. Romain Binelli of the law firm Hoog & Associé, who represents the litigants, said: “The question is: Who had access to that information? Do Europarking and TfL maintain access to their vehicle database, which was supposed to end after Brexit, or do they have to pay someone to get the information?” Either they're paying it. Drivers are receiving 10 or more exorbitant fines at once, often long after the fines have been issued. [deadline] Set a date to fight them. ”
TfL said on behalf of Euro Parking: “Companies working on our behalf are contractually obliged to ensure that data is processed in accordance with relevant data protection laws. Ensure that all elements of the policy are complied with and have mechanisms in place in case of non-performance.
“Euro Parking will act on behalf of TfL for the enforcement of road user charges in London when submitting a request for controller data in an EU Member State, even if the request is submitted through a third party. We are clear that Europarking is not prevented from accessing the controller data of drivers in EU countries.”
Liberal Democrat London MP and transport spokeswoman Caroline Pidgeon called for an immediate investigation after the Guardian shared its findings.
“I am deeply concerned to hear that TfL may be illegally collecting data from drivers,” she said. “The extent of fines imposed on visitors from the EU, many of which are set incorrectly, shows that the rules are not clearly communicated to tourists, and I have raised this issue with TfL in the past. “We raised this issue, but it was ignored. If this issue is not resolved quickly, London's reputation as a tourist destination risks being seriously damaged.”