Parking penalty charge notices (PCNs) privacy notice

The following privacy notice applies to penalty charge notices (PCNs)

This notice explains how personal information is going to be used, what it is used for, who it might be shared with and why and for how long it is to be kept.

What information is collected?

Your vehicle details are obtained by the Civil Enforcement Officer. Photographic images are taken of the vehicle parking in contravention of the parking regulations.  

Your name and address is obtained from the DVLA if the PCN has not been paid within 28 days from the date of service of the PCN, for postal PCN your information is obtained from the DVLA within 2 days from the date of the PCN being issued.

Your contact details are collected from correspondence you have submitted either via the council's website or via the appeals email. Where grounds relating to health are relied upon when appealing against a PCN, details regarding the medical information may be requested to consider this aspect as part of the appeals process. 

The personal information you provide to the council will be used or processed for the purpose of your appeal. The council will use the information for this purpose and may disclose it to those individuals or organisations referred to below. 

Your personal data may be converted (‘anonymised’) into statistical or aggregated data in such a way as to ensure that you are not identified or identified from it. Aggregated data can’t, by definition, be linked back to you as an individual. This data might be used to conduct research and analysis, including to prepare statistical research and reports

Why do we collect your personal information?

The purpose of processing your personal data is to administer the council’s processing of PCNs and appeals.

We will use your data to process PCNs which are issued to vehicles in respect of off-street parking contraventions. All processes are carried out in line with traffic management / parking related legislation and using secure systems. The information you provide will only be used for the parking related purposes for which it was obtained.

Data Controller

Crawley Borough Council is registered as a Data Controller with The Information Commissioner’s Office (Registration Number Z5327706).

The council (CBC) complies with The Data Protection Act 2018 and the GDPR.

We ensure that your personal data is processed fairly, kept safe and secure and retained for no longer than is necessary.

The Data Protection Officer for CBC is Head of Legal and Democratic Services. 

If you have any concerns or questions about how we look after your personal information please contact the Data Protection Officer.

The legal basis for processing personal data

  • Processing is necessary for compliance with a legal obligation
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

We are relying on GDPR Articles 6(1) (c) & (e) processing is necessary in the exercise of official authority in the data controller, namely the Traffic Management and Civil Enforcement legislation: 

  • Traffic Management Act 2004
  • Civil Enforcement of Parking Contraventions (England) General Regulations 2007
  • Civil Enforcement of Parking Contraventions (England) Representations and Appeals Regulations 2007
  • Civil Enforcement of Parking Contraventions (Guidelines on Levels of Charges) (England) Order 2007
  • Traffic Management Act 2004 (Commencement No. 5 and Transitional Provisions) (England) Order 2007
  • Civil Enforcement of Parking Contraventions (England) General (Amendment) Regulations 2008
  • Traffic Management Act 2004 (Commencement No. 5 and Transitional Provisions) (England) (Amendment) Order 2008, The Civil Enforcement of Parking Contraventions (England) General (Amendment) Regulations 2009
  • Civil Enforcement of Parking Contraventions (England) General (Amendment) Regulations 2015
  • Civil Enforcement of Parking Contraventions (England) General (Amendment No.2) Regulations 2015
  • Operational & Statutory Guidance
  • Tribunals & Courts Enforcement Act
  • Civil Procedure Rules
  • Crawley Borough Council (Off Street Parking Places) (Civil Enforcement & Consolidation) Order 2009 as amended

Where special category data is provided and processed, the relevant legal basis we are relying on is GDPR Article 9(1) (f) as processing is necessary for the establishment, exercise or defence of legal claims or whenever Courts are acting in their judicial capacity.

Who we share data with

We pass data to:

  • Internal departments
  • Other local authorities (education, social care children and relevant housing and employment and other services)
  • Central Government
  • Other third-party organisations, as allowed by law, these include our nominated Enforcement Agents
  • Other partner agencies that provide services on our behalf
  • Agencies with whom we have a duty to co-operate, such as the police
  • Housing Associations
  • Benefits Agency
  • HM Court Services
  • Traffic Enforcement Centre
  • Traffic Penalty Tribunal

We may share personal data with other organisations in the following circumstances:

  • For  law enforcement, regulation and licensing, criminal prosecutions and court proceedings
  • for the purposes of prevention and detection of fraud (partner agencies and other local authorities within West Sussex involved directly in parking management and the police)
  • In dealing with appeals against PCN (Traffic Penalty Tribunal, Traffic Enforcement Centre, the Courts and enforcement agents and agents providing services to the Borough and District Councils in carrying out their role in pursuing unpaid PCNs)
  • If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of the prevention and detection of fraud).

We will not share data with third-parties for marketing purposes.

Transfer outside the European Economic Area

If your data needs to be transferred we will make sure that an adequate level of protection is in place.

Retention periods

Personal data will not be retained for longer than necessary in relation to the purposes for which they were collected.

Record
Retention period
Civil Enforcement Officer pocket books
2 years where pocket books are used (e.g. Blue Badge Enforcement) unless required for longer investigation purposes.
Penalty charge notices
6 years
Incident reports
4 years unless case involves child (then to be minimum of 4 years until 18th birthday)
Hand held computer downloads
1 year from the case being closed
Photos of vehicles parked in contravention
1 year from the case being closed
DVLA Records
System should redact data 3 years from case being closed
Automatic number plate recognition (ANPR) - photos of vehicle number plate
System automatically rewrites information after 28/31 days
Subscriber details on Pulsar
Removed once permit/concession has expired
Test tickets
No legal requirement to keep
Warrant/debt write offs
6 years
6 years
2 years from data collection date or 1 year from date of expiry
Dispensations, waivers and suspension applications
2 years from data collection date. Destroy after application processed
Banking summary sheets
Minimum of 3 years as per finance regulations
Newsletters, press articles, minutes of meetings, leaflets
No legal requirement to retain for a specified period. Minutes to be kept for as long as necessary.
Permit waiting list 
1 year. Remove details once they have been issued with a permit.
Season ticket waiting list
1 year after expiry
Season ticket application forms and correspondence
1 year
Market concessions / event parking application forms
4 years (insurance requirements relating to events)
Validation deal application form
No legal requirement to keep, however can be kept as long as may be useful. Keep application forms for 6 months.
Window cleaner application form
No legal requirement to keep, however can be kept as long as may be useful. Destroy once application has been processed. Personal details will be kept for 1 year on the system.
Business badge application form
No legal requirement to keep, however can be kept as long as may be useful. Destroy once application has been processed. Personal details will be kept for 1 year on the system
Refund documentation
6 years
Staff permit list
1 year
Accident/injury forms
6 years
Car parks operational handover paperwork
Statute of limitations
CCTV and body worn/dash cam video camera footage
Images stored for 28/31 days unless required for investigation
Blue Badge enforcement reports/footage
1 year unless required for investigation
E-mail and customer correspondence
3 years

Rights

You have the right to:

  1. Be informed of data processing (which is covered by this privacy notice)
  2. Access your personal information (known as a Subject Access Request)
  3. Have inaccuracies corrected
  4. Have information erased
  5. Restrict processing
  6. Data portability
  7. Intervention in respect of automated decision making/profiling
  8. Withdraw Consent (see below)
  9. Complain to the Information Commissioner’s Office (See below)

To exercise any of these rights please contact the Data Protection Officer.

Withdrawal of consent

The lawful basis upon which CBC process personal data is that it is necessary in order to comply with its legal obligations and to enable it to perform tasks carried out in the public interest.  However, where personal data is solely processed on the basis of consent, you will have the right to withdraw that consent.

Where can I get advice?

If you have any worries or questions about how your personal information is handled please contact our Data Protection Officer.

For independent advice about data protection, privacy and data rights, you can contact the Information Commissioner’s Office (ICO):

  • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire DK9 5AF
  • Tel:  0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number
  • Visit ico.org.uk
  • Email casework@ico.org.uk