License plate recognition in parking lots

Registration Number –  Personal Data or Not

The jurisprudence of Polish authorities and courts is divergent regarding the status of registration numbers. The President of the Polish Data Protection Authority holds the position that they are personal data, while administrative courts (in the vast majority) present an opposing view. It is worth noting that the opinion of the President of the Polish Data Protection Authority is reflected in the approach of most authorities and courts in EU member states. The European Data Protection Board also recognizes registration numbers as personal data. This is confirmed by the example provided by it: „The car is equipped with a video camera that is intended to assist the driver in parking. The GDPR does not apply if the camera is constructed or adapted in such a way that it does not collect any information concerning an identified or identifiable natural person (such as registration numbers or information that could serve to identify pedestrians)”¹.

According to Article 4(1) of the GDPR, personal data is defined as „information relating to an identified or identifiable natural person (»data subject«); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person”. Therefore, if information can be used to identify a specific natural person, it constitutes personal data. This means that the same information may constitute personal data in one case, while in other circumstances it may not. Most often, this will depend on the ability to link that information with other information, resulting in the determination that it pertains to a specific individual.

This is precisely how a registration number can be perceived. A party with a legal interest can easily obtain information about the vehicle owner, even if they only have the registration number at their disposal. The possibilities are significantly reduced for individuals without a legal interest that would entitle them to obtain information from the Central Register of Vehicles and Drivers (CEPiK). They are left only with the information that a car of a certain color, make, and model is marked with that specific registration number. However, in justified cases, they may share this information, for example, with the police, who will be able to identify the vehicle owner.

As rightly noted by the British data protection authority (ICO): “In most cases, a registration mark constitutes personal data. However, this may depend on the context of processing. A registration mark is personal data at the moment of its collection if it is processed within a monitoring system for the purpose of identifying a natural person (for the purpose of taking potential actions, e.g., imposing a parking fine). This is because, although it may not allow for direct verification, the purpose of the system is to find further information. This, in turn, will enable the identification of the driver, the registered owner (of the vehicle – ed. note), or both.”².

Being aware that the approach of Polish courts to the discussed issue is different, for the purposes of this article, we will treat the registration number as a full-fledged personal data.

Automatic Number Plate Recognition – Is it Compliant with Data Protection Regulations?

The operation of the ANPR (automatic number plate recognition) system involves transmitting images from cameras to a server, where the analysis and reading of registration numbers take place. It is no secret that in the Polish context, the topic of automatic number plate recognition primarily arises in the context of charging fees in private parking lots. Data is collected to ensure the possibility of identifying the person who has not paid for parking. However, public entities also utilize this solution. Such a possibility is provided for by legal regulations concerning, among other things, the monitoring of clean transport zones³.

The discussion regarding the admissibility of the use of ANPR systems was reflected in the decision of the Austrian supervisory authority (Datenschutzbehörde; DSB). The DSB was faced with the necessity to assess whether a business could scan license plates for the purpose of charging a fee for garage usage. The authority noted that the processing of license plates is also associated with the processing of data concerning the time and location of the driver's presence. Therefore, it had no doubts about the status of the registration number as personal data.

In ruling on the admissibility of using ANPR to charge a fee for garage usage, the DSB indicated that the use of such systems is not extraordinary. At the same time, it took into account the arguments of the entrepreneur, who cited a legitimate interest. It should also be added that the entrepreneur presented to the authority the technical and organizational measures he implemented to protect his clients' data. Among these was a solution that involved the immediate deletion of data after the fee was settled. As a result, it was difficult to defend the belief that such processing could pose a real threat to the rights and freedoms of clients using the garage.

Will every ANPR system meet the requirements of the GDPR? No. Helpful guidelines on how to achieve the desired state of security can be found on the ICO website. The authority has published a checklist outlining the steps to ensure the compliance of ANPR usage with data protection regulations:

• Verify whether the use of ANPR is indeed necessary to achieve the intended purposes.
• Conduct a Data Protection Impact Assessment (DPIA).
• Minimize the number of ANPR cameras used to ensure that you are using no more cameras than necessary to achieve a specific purpose.
• Ensure that the location and range of the cameras are fully justified, not arbitrary, and do not capture vehicles irrelevant to the intended purposes of using ANPR.
• Implement clear and visible signage informing about the use of ANPR. This should include information on whom to contact in case of questions.
• Ensure appropriate rules for the storage and deletion of all processed data.
• Provide effective means of data recovery in the event of data access requests.
• If you are processing other supplementary data to match the data obtained from cameras, ensure that it is current and relevant in terms of the objectives of the ANPR system⁴.  

ANPR and DPIA

Automatic number plate recognition is an example of processing that utilizes new technologies. Furthermore, it involves large-scale monitoring – often of publicly accessible areas. For these reasons, the data controller implementing this solution should first conduct a Data Protection Impact Assessment (DPIA). This is a set of activities that allows the data controller to determine what data protection risks are associated with the process they are carrying out, as well as to select remedial measures to mitigate potential risks.

A similar position was taken by the Article 29 Working Party, which explicitly stated that ANPR is a process that requires a DPIA⁵.

Retention of Data Collected Using ANPR

Personal data should not be processed longer than necessary to achieve a specific purpose. Therefore, the data controller must first determine the actual purpose of processing personal data. In the case of ANPR, a simple answer arises: primarily for the purpose of establishing, pursuing, and defending claims.

It is again worth considering the observations of the ICO regarding this issue. The British authority notes that shops or service centers set limits on free use of their parking lots (usually 1–2 hours). If a vehicle leaves the parking lot within the designated time, it will be difficult to rationally justify further processing of data collected using ANPR. According to the principle of data retention limitation, such data should be deleted⁶.

A hint in this regard is also expressed by the approval given by the DSB for the solution implemented by an entrepreneur using ANPR to charge for garage use. This entrepreneur deleted personal data after the customer paid for parking.

ANPR Signage

Due to the nature of collecting personal data using ANPR, particular emphasis should be placed on transparency, conciseness, and easy accessibility of information regarding how the data is processed. Monitored individuals will not have time to familiarize themselves with the detailed content of the privacy notice regarding data processing, which includes all elements listed in Article 13 of the GDPR. Therefore, it is necessary to attempt to convey at least the information that is most important from their perspective.

In our opinion, at a minimum, individuals should be informed about:

• the mere fact of using ANPR – the best solution would be to place a graphic symbol (e.g., depicting a camera aimed at license plates) along with the text: “automatic license plate recognition” or similar; the individual should have the option to decide whether they want to be in the monitored area;
• the name, registered office, and contact details of the data controller;
• the possibility and method of obtaining detailed information about data processing.

The signage will serve as the first layer of information. It is advisable to ensure that it is placed in a clearly visible location. It should also be remembered that collecting data via cameras is a method of obtaining it directly from the individual to whom it pertains. This means that the information obligation should be fulfilled.

As a complement to the above, it would be advisable to provide full information about data processing in a location that is easily accessible and obviously linked to ANPR (e.g., in the parking office).

Summary

Based on observations of the global trend in expanding surveillance networks, it can be concluded that lawmakers will increasingly grant local government units or specific authorities the right to obtain data from ANPR (and similar technologies) directly in the regulations. According to Article 14(5)(c) of the GDPR, the data controller is not required to fulfill the information obligation if the acquisition or disclosure of data is clearly regulated by Union law or the law of a Member State.

In the short term, implementing the principle of data minimization and limiting their retention protects the individual from violations of their privacy by the entity using ANPR and by individuals who have access to data collected through this system. In the long term, it serves to reduce the scope of information about the individual that state authorities can obtain.

References: