Congestion charges, congestion charge permits and parking permits privacy notice

How we collect, store and process your data.

Data protection and access to information

Oxfordshire County Council ("the council") is the data controller for personal information processed for congestion charges, parking permits and enforcement activities in Oxfordshire. The Civil Enforcement Team is responsible for managing this data. The council is registered with the Information Commissioner's Office (ICO) and complies with all relevant data protection legislation.

For more information on how the council handles personal information, please see our corporate Privacy Notice.

Your data is collected for the following purposes:

to validate applications and determine if you qualify for a congestion charge permit or on street parking permit
to issue, renew, or revoke permits as required
to monitor compliance with traffic and parking regulations, and to issue Penalty Charge Notices (PCNs) where necessary
to facilitate secure payments and refunds for permits
to assist with appeals against PCNs and respond to statutory challenges.
to fulfil obligations under relevant laws and regulations
to conduct anonymised research and statistical analysis to improve council services

What data we collect

We collect and process the following types of personal information to administer congestion charge and permit schemes:

personal identification details: full name, full address and postcode, email address, telephone number(s), age or date of birth, gender
vehicle information: registered keeper details, vehicle registration number, vehicle make and model
financial information: payment details for processing charges and refunds via our secure payment provider (Access Paysuite)
correspondence: communications with the council regarding applications, appeals or complaints

We only collect data that is necessary for the administration and enforcement of the relevant schemes.

We may also receive and process special category data relating to health and disabilities where you provide us with information relating to your application, such as identifying a Blue Badge concession or health and care requirements.

Legal basis for processing personal data

We process your personal information under the following legal bases:

UK GDPR Article 6(1)(c): processing is necessary for compliance with a legal obligation (in this case, the highway and traffic and enforcement requirements)
UK GDPR Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

Where we process special category data, we rely upon the following conditions:

UKGDPR Article 9(2)(b): employment, social security and social protection law (where we provide or extend a benefit to you)
UKGDPR Article 9(2)(h): the provision and management of health or social care information or systems, or care
Data Protection Act 2018: Schedule 1 for public interest considerations

Relevant legislation

Our processing activities are governed by the following legislation:

Traffic Management Act 2004
Transport Act 2000
Road Traffic Regulation Act 1984
Civil Enforcement of Road Traffic Contraventions (Approved Devices, Charging Guidelines and General Provisions) (England) Regulations 2022
Civil Enforcement of Road Traffic Contraventions (Representations and Appeals) (England) Regulations 2022
Road User Charging Schemes (Penalty Charges, Adjudication and Enforcement) (England) Regulations 2013

Processing is carried out in the public interest and in the exercise of official authority in relation to the enforcement of traffic regulation orders and charging schemes by the council. Other applicable statutory instruments and government guidance as are in force from time to time or may be enacted may apply. We will communicate or update this notice as appropriate.

Article 5 UKGDPR Principles

The council has systems, procedures and securities in place to ensure the data protection principles are maintained throughout the processing for these services.

we ensure that processing is lawful, fair and transparent
we ensure the purposes data is processed for the given purpose, and where it is joined to other purposes, these are proportionate and aligned
we ensure that the information collected and processed is relevant, adequate and limited to what is necessary
we ensure that the information is kept up to date and accurate
we ensure that the information is not kept longer than necessary
we ensure that we take the appropriate organisation and technical measures to keep the information secure
we ensure that we are accountable for these principles and the data processing as the data controller

Recipients of the data

We may share your personal information with:

other teams within the council involved in permit administration, enforcement, and appeals
regulatory and statutory bodies, such as the Traffic Penalty Tribunal, the Traffic Enforcement Centre, Enforcement Agencies, DVLA, only when necessary for appeals or legal challenges
law enforcement agencies, where required by law or for the prevention and detection of crime

Our processing supply chain includes:

Unity 5 - Permit Management System provider, which includes Zatpermit
Paysuite - Congestion charging scheme payment processing
OCC internal Customer Service Centre
Videalert - ANPR camera provider
Trellint - for processing of penalty charge notices
DVLA – for vehicle look up
and for contravention administration, Oxfordshire County Council's internal civil enforcement team

We will not share your personal information with third parties for marketing purposes. Data sharing is strictly limited to what is necessary for the stated purposes and is governed by formal contracts and data sharing agreements.

Information security

The council applies appropriate technical and organisational measures to the collecting, processing, sharing, storage and retention of the information involved in the operation of these services. This includes ensuring systems are secure, access to the systems and the information is controlled, appropriate firewalls and electronic securities and physical securities are in place; and that we maintain the same appropriate measures with our supply chain partners. Your personal information is processed in the UK.

How long we keep your data (retention)

We retain your personal information for a period of 2 years from the date of your permit application. This retention period is in line with the council's data retention policy for Penalty Charge Notice data. After the retention period, your data will be securely deleted or anonymised for further processing or retention, such as analysis of business performance or trends. Finance information will be kept for 6 years.

Your rights

You have the following rights under data protection law:

right to be informed about how your information is used
right of access: to request a copy of your personal information held by the council
right to rectification: to have inaccurate or incomplete information corrected
right to restrict processing: in certain circumstances, to limit how your information is used
right to object to the processing of your information in specific situations
right to data portability: to receive your information in a structured, commonly used format (where applicable)
right to be notified of data breaches if your information is compromised and your privacy or rights may be at risk

To exercise your rights, please contact the council using the details below.

Who can I contact with any questions or complaints?

You may contact the council's Data Protection Officer as follows:

Information Management Team
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

dataprotectionofficer@oxfordshire.gov.uk

You can also complete the online complaints form.

You also have the right to appeal to the Information Commissioner's Office, which is the UK regulatory authority for data protection issues:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.org.uk