Two EU countries have accused Transport for London’s debt collection agency of breaching data protection laws to obtain the names and addresses of citizens in order to issue fines for driving in the capital.
Motorists from across Europe have been hit with penalties, some totalling thousands of pounds, for driving in London’s Ultra Low Emissions Zone (Ulez). Penalty notices are being sent to foreign motorists who enter the capital without pre-registering their vehicle, and the Guardian has revealed hundreds of drivers have been fined despite driving emissions-compliant cars.
EU governments are warning the data used to identify drivers and send them penalties may have been unlawfully obtained.
According to the Belgian ministry for transport and the Dutch vehicle licensing agency, RDW, there is no legal data-sharing agreement between the two countries and the UK for the enforcement of emissions zones breaches.
RDW told the Guardian the Transport for London (TfL) debt agent, European Parking Collection (EPC), had requested the names and addresses of Dutch citizens linked to number plates through a government agency in Italy, which was not authorised to share that information.
“In response to several complaints from Dutch citizens, we were very concerned on how their data was obtained and started an investigation immediately,” said a spokesperson. “The outcome was that the data was requested by authorised users through the Italian National Contact Point (NCP). The NCP informed us that the authorised users have used the data in an unlawful way and closed the specific accounts.”
The Belgian transport ministry confirmed that the UK had no legal access to the details of Belgian drivers. However, dozens of Belgian citizens have received penalty charge notices (PCNs) for alleged Ulez breaches, according to the Belgian MP Michael Freilich, who has been campaigning on the issue.
“It is completely unacceptable that EPC would use illegal methods to obtain personal data, under the umbrella of TfL,” he said. “I have initiated a complaint with the European Commission, and we won’t hesitate to initiate legal action to reclaim the millions of euros of unjust paid fines.”
Some of the penalties issued by EPC have been posted from an address in Uzbekistan, which is also outside the EU, prompting further questions about data protection.
EPC was awarded a five-year contract worth £5m-£10m by TfL in 2020, with an option to renew for a further five years, to recover debts relating to violations of London’s congestion charge and its various emission zones. The firm is owned by the US transport technology group Verra Mobility, which is listed on the Nasdaq stock exchange and headed by the former Bank of America Merrill Lynch executive David Roberts, who was paid $4.25m in 2022.
EPC and Verra were contacted for a comment.
after newsletter promotion
TfL insisted the personal details of EU citizens were lawfully accessed and used under UK general data protection regulations. It claimed that penalties were sent from the UK via an Uzbekistan sorting hub when strikes or bad weather disrupted Royal Mail services. “All data is accessed through the relevant legislative framework,” said a spokesperson.
Many EU motorists who received the fines say they have not breached emission zone rules and claim the PCNs do not make clear what they have done wrong.
Peter Williams, a Belgian resident, received nine penalty notices totalling £2,400 after driving into London to attend his mother’s funeral and settle her estate. “The fines were sent by EPC from an address in Sweden and with the payment details of a German bank,” he said. “They arrived over five weeks after the date stamp on the PCNs, by which time the fines had tripled and the appeals deadline had passed. I’m now expecting more fines from another visit to London last month, even though my car is a 2020 Hyundai and fully emissions-compliant.”
Other motorists have found their cars have been misclassed as heavy goods diesel vehicles by EPC and accused of breaching the London-wide Low Emissions Zone (Lez), which covers older vehicles over 3.5 tonnes. Penalty charges for Lez breaches are from £500 to £3,000 a day.
Peter van der Schee, who lives in the Netherlands, received a £1,000 fine 10 months after driving into a London suburb to be tested for Covid. “The amount increased to £3,000 if not paid within 14 days,” he said. “It took me weeks to find out what crime I had committed. “The vehicle was fully compliant with the standards required but EPC rejected my objections.”
TfL says vehicles registered overseas should pre-register with EPC to confirm their emissions status. However, many drivers are unaware of the process, which takes up to 10 days to complete and is not prominently flagged on the TfL website. Their cars are therefore deemed non-compliant by default, triggering a fine.
TfL has admitted that failure to register is not a contravention and claims that drivers who can prove their vehicles meet emissions standards on appeal will have their fines cancelled. However, EU residents who have contacted the Guardian report that PCNs arrived in the post weeks after the payment and appeals deadline. The fines triple if not paid or appealed within 28 days. Those who contest the fines are told by EPC that the process takes up to 56 days and some report that their appeal was refused despite providing proof of their car’s emissions.
TfL’s £34m contract with EPC requires appeals to be completed within 15 working days. It also requires EPC to check the emissions status of vehicles before issuing PCNs.
TfL blamed “resourcing challenges” for EPC’s slow response times and the delayed arrival of PCNs. It admitted that the wording of the PCNs could be improved to clarify the contravention and that human error had classed some cars as heavy goods vehicles.
A TfL spokesperson said: “We work closely with EPC to ensure all elements of the contract are being adhered to and have mechanisms in place should they not be fulfilled. Recently, our contractor experienced some resourcing challenges, resulting in delayed responses, but these are being addressed. All data is accessed through the relevant legislative framework.”