ANPR and personal data

Automatic Number Plate Recognition allows a vehicle to be tracked to its registered keeper. It is clearly a form of identifier linking a car and its movements with a specific individual. It is that person’s personal data. But could it be the personal data of other people as well – such as passengers in the car?

This question bobbed up in the Upper Tribunal’s recent decision in Smith v IC and Chief Constable of Essex Police [2016] UKUT 0455 (AAC). Ms Smith wrote books about crimes such as heists and armed robbery. One day in February 2008, he and a friend followed a cash-in-transit van around Basildon for a while in the friend’s car. Mr Smith explained that this was for research purposes, but – aided by ANPR data – they were nabbed and successfully prosecuted for conspiracy to commit robbery. Mr Smith maintained he was the victim of a police fit-up.

He sought the ANPR data for the friend’s vehicle from the relevant day under FOIA. He received a ‘neither confirm nor deny’ refusal under section 40(5) FOIA, on the basis that confirming or denying would unfairly reveal something about the friend (the registered keeper of the car).

The Upper Tribunal proceedings explored the question of whether the requested information was also the personal data of Mr Smith, the passenger. Viewed in isolation, the answer would be ‘no’. But viewed in context – specifically, by reference to the terms of the request which stated that police had confirmed Mr Smith to be a passenger in that vehicle on that day – it became Mr Smith’s personal data too. The terms of the request provided a bridge, i.e. a link between the ANPR data and Mr Smith, and established that this data identified him too.

The overall outcome was the same (neither confirm nor deny response upheld), but the Upper Tribunal’s analysis of personal data is worth noting, for those who love such things.

Chris Knight and Rupert Paines both appeared.

Robin Hopkins