Oops, says Manchester City Council after thousands of number plates exposed in parking ticket spreadsheet
They are personal data, you know. Wait – you did know that, right?
Exclusive Manchester City Council exposed online the number plates of more than 60,000 cars slapped with parking tickets, breaking data protection laws as it did so.
In what appears to be a sincere if misguided attempt to provide public accountability over parking wardens, the council publishes income from parking tickets online in the open data section of its website.
One Register reader, however, spotted a problem: in three of the 20,000-row spreadsheets, published every month between 2018 and early 2021, drivers' number plates were detailed alongside precisely where and when they were hit with parking tickets and which parking warden issued them.
Naughty drivers who picked up parking tickets during April-July 2020 had their identities exposed, thanks to the council forgetting to delete the number plates from the uploaded spreadsheets.
A spokesman for Manchester City Council said: "Data not normally released to the public was in error published to the City Council's website. When made aware of this, steps were taken to swiftly correct this and remove the data."
When The Register politely enquired about the number plate data last week, the council pulled it all offline so quickly that we had to explain to a press officer what happened. Such a speedy reaction generally bodes well.
The Information Commissioner's Office has previously stated that vehicle registration marks (VRMs, as number plates are formally known) are personal data. In 2019 the agency said, in a decision notice [PDF] on a rejected Freedom of Information Act request: "The Commissioner has previously considered the status of VRMs under the DPA 1998 and decided that where the VRM belongs to a vehicle which is owned by a living individual, the VRM itself will be personal data without associated information being disclosed with it. This is because information identifying the owner of the vehicle is obtainable simply from having access to the VRM."
- Nine million logs of Brits' road journeys spill onto the internet from password-less number-plate camera dashboard
- Manchester, UK seeks IT-slinger: £235m for number-plate-and-fines system to clean up vehicle emissions
- ANPR maker Neology sues Newcastle City Council after failing to win 'air quality' snoopcam project bid
It is easy to identify the owner of a car. For a modest fee, you can register yourself as a private parking company with the Driver and Vehicle Licensing Agency and look up anyone's name and address off the DVLA register of vehicle keepers. In theory, doing that would be unlawful but the DVLA has tens of millions of reasons not to look too closely at one of its most highly profitable revenue streams. 637 organisations, ranging from car finance companies to local councils through to man-and-van "private parking solutions" firms, can currently buy names and addresses from the DVLA for £2.50 a pop.
Manchester City Council's spokesman added: "The council is investigating internally as to how this happened and has already changed processes to ensure this does not happen in the future. We are grateful that this was brought to our attention so that this error could be corrected."
During May 2020 alone, the council raked in £377,030 from parking tickets and claimed a further £170,619 had not been paid by motorists. One council operative, identified only as badge number MC1192, issued 5,662 of the council's 14,887 parking tickets for the month, raking in £69,864 with a further £155,266 allegedly outstanding on MC1192's tickets alone by the end of the month. This workrate is the equivalent of 35 tickets issued every working hour of the month, assuming a generous 40-hour working week with no bank holidays or days off. Many of these tickets were issued for driving in a bus lane, but some were also issued for being parked without displaying a ticket. ®