Rights of data subjects notice - Section 44 Data Protection Act 2018 (accessible version)
Updated 31 December 2021
© Crown copyright 2021
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/national-anpr-service-nas-data-subject-rights/rights-of-data-subjects-notice-section-44-data-protection-act-2018-accessible-version
Version 1.0
May 2020
National Law Enforcement Automatic Number Plate Recognition (ANPR) Capability (NAC)
The National Law Enforcement Automatic Number Plate Recognition (ANPR) capability (NAC) enables the police and other law enforcement agencies (LEA) to benefit from operational use of ANPR. It consists of:
- the National ANPR Service (NAS) which is a single national system comprising standardised functionality to enable use for operational response, investigation and intelligence purposes as well as a single national store of data, and;
- the National ANPR Infrastructure (NAI), which is a network of ANPR cameras, communications links, firewalls and other related supporting components.
Controllers
The joint controllers for the NAS are:
a) The ANPR lead within the National Policing Chief’s Council (NPCC) who is designated as the lead controller
b) Chief officers of police forces in England & Wales (Schedule 1)
c) The Heads of other LEAs (Schedule 1)
d) The Secretary of State for the Home Department (HO) (Schedule 1)
The controllers for the NAI are the chief officer of the police force or LEA that manages the components of the NAI within their organisation.
The HO has established a central point of contact to support and manage data subject enquiries and any requests may be submitted to either anpr@homeoffice.gov.uk or to the police force or LEA directly using contact details as shown in Schedule 1.
Legal basis and Purpose of Processing ANPR Data
The NAC operates under a complex framework of legislation of general application, including the General Data Protection Regulations (GDPR), the Data Protection Act (2018) (DPA), the Surveillance Camera Code of practice issued under the Protection Of Freedoms Act 2012 (PoFA) and Common Law.
The NAC is subject to the Information Commissioner’s Office (ICO) regulatory provisions and regulatory oversight by the Surveillance Camera Commissioner (SCC)
The joint controllers for the NAS and the controllers for the NAI process ANPR data for the Law Enforcement Purposes as defined by Part 3 DPA, namely the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
Personal Data
Data held within the NAC includes:
‘Read records’ – The record of a Vehicle Registration Mark (VRM) including the time and location for that read together with any associated images as recorded by an ANPR camera.
Details within Vehicle of Interest (VOI) lists that will include the VRM, together with any personal details of persons relevant to that interest which may include aspects of ‘sensitive processing as defined by Section 35(8) DPA and also details that may relate to:
a) persons suspected of having committed or being about to commit a criminal offence;
b) persons convicted of a criminal offence;
c) persons who are or may be victims of a criminal offence;
d) witnesses or other persons with information about offences.
e) circumstances of significant public interest and the purposes of public safety (for example vulnerable and missing persons.)
Data Retention
Retention provisions are detailed within National ANPR Standards for Policing (NASPLE) and are as follows:
‘Read Records’ held within NAS are deleted 12 months after they enter the NAS unless they have been preserved under provisions of the Criminal Procedure and Investigations Act 1996 (CPIA) or similar provisions in Scotland.
‘Read Records’ held within the NAI are deleted within 7 days of them being initially entering the system unless transferred to other local systems:
a) they have been preserved under provisions of the Criminal Procedure and Investigations Act 1996 (CPIA) or similar provisions in Scotland, and preservation within NAS is inappropriate or;
b) the data has been assessed in accordance with the requirements of the Code of Practice on the Management of Police Information (MOPI) that has identified that a continued policing purpose for retention of the data remains that can only be satisfied by transfer of the data from NAS.
Data Subject Rights
The DPA establishes data subject rights. A data subject is entitled to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed, and are entitled to request from the relevant controller –
i. access to the personal data held;
ii. rectification of any error within the data;
iii. erasure of data or restriction of its processing.
Where a data subject wishes to make a request in respect of the NAS or the NAI this may be made in the first instance to anpr@homeoffice.gov.uk or directly to the relevant controller if known (Schedule 1)
On receipt of any application relating to ‘read data’ controllers will undertake enquiries as necessary to confirm that the person making the request is the data subject, who is entitled to that data, in the case of each ‘read’ prior to making any decision in relation that request.
Applicants may be required to provide information to enable that confirmation. This is essential to ensure that data is not inappropriately disclosed.
Controllers will only restrict wholly or partly subject rights where having regard to the fundamental rights and legitimate interests of the data subject, they have assessed the restriction as necessary and proportionate to:
a) avoid obstructing an official or legal enquiry, investigation or procedure;
b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
c) protect public security;
d) protect national security;
e) protect the rights and freedoms of others.
It should be noted that controllers will rarely disclose information that will disclose the exact locations of ANPR cameras.
In normal circumstances, data subjects can expect to receive a decision in relation to any request within 1 month of their application advising of either the grant or refusal of the request.
If the request has been restricted wholly or partly, the data subject will be informed of:
a) that the provision of information has been restricted,
b) the reasons for the restriction,
c) the right to make a request to the Information Commissioner to check if the decision was lawful under provisions of Section 51 DPA.
d) the right to lodge a complaint with the Information Commissioner, and
e) the right to apply to a court under Section 167 DPA.
Example of the considerations and process followed when a subject access request is received
Step 1 – Is the application valid?
-
An organisation makes a system access request. This will be rejected as an invalid application because a request can only be made by an individual i.e. the data subject as described in the guidance above.
-
A keeper/ owner of a car makes a request for ANPR data for the movements of their car.
Being the keeper/owner of the car does not automatically mean you are the data subject. Only the data subject is entitled to request/receive ANPR data.
The keeper/owner needs to demonstrate that they were in the car at the time the car’s number plate was read by an ANPR camera.
The data controller may need to make further enquiries of the applicant to confirm entitlement to the data, this could include requesting a detailed explanation from the applicant of the route taken by the car or other evidence the applicant is able to provide.
Step 2 – Consider whether or not to disclose the information
The applicant provides a detailed explanation of their journey and the controller is satisfied that they are entitled to request the information.
That is not the end of the decision-making process, the controller will now take other factors into consideration. For example, would providing the data requested mean disclosing exact camera locations or reveal information about an ongoing prosecution case? If so, the controller may decide not to disclose that information because it could be detrimental the investigation or to national/public security.
The full criteria a controller will to consider before making a decision whether or not to disclose or retain the data held is contained within Section 45(4) DPA and include:
To avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences, to protect public or national security or to protect the rights and freedoms of others.
What happens next?
If data is disclosed, the data subject may request that the controller deletes the ANPR data for that journey.
Again, the controller will need to assess whether the data should continue to be retained based on criteria within Section 45(4) DPA before making his decision and notifying the applicant.
In summary, each request will be considered on its own merits and if the request is not granted the applicant will be advised in writing together with the reasons and notified of their right to:
- Request that the Information Commissioner to check that the decision is lawful (S51 DPA);
- To lodge a complaint with the Information Commissioner (S48(1)(iii) DPA), and
- The right to apply to a court for a compliance order (S167 DPA)
Contact the ICO
You can contact the Information Commissioner:
- by telephone: 0303 123 1113 (local rate)
- by email: casework@ico.org.uk
- through the ICO website
Alternatively, you can write to:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
The Information Commissioner’s website has more information about data protection and your rights.
Schedule 1 Joint Controllers for NAS
Avon and Somerset Constabulary
Controller: Chief Constable
Data Protection Officer
Data Protection Team Legal Services
Avon and Somerset Police
Police and Fire Headquarters
PO Box 37
Valley Road
Portishead, BS20 8QJ
Email: dataprotection@avonandsomerset.police.uk
Bedfordshire Police
Controller: Chief Constable
Information Rights
Bedfordshire Police HQ
Woburn Road
Kempston
Bedfordshire
MK43 9AX
Email: dataprotection@bedfordshire.pnn.police.uk
Border Force
Controller: Secretary of State for the Home Office
SARU Home Office
40 Wellesley Road
Croydon
CR9 2BY
Email: subjectaccessrequest@homeoffice.gov.uk
British Transport Police
Controller: Chief Constable
Information Governance Unit
2nd Floor
3 Callaghan Square
Cardiff
CF10 5BT
Email: dataprotection@btp.pnn.police.uk
Cambridgeshire Constabulary
Controller: Chief Constable Information Rights
Bedfordshire Police HQ
Woburn Road
Kempston
Bedfordshire
MK43 9AX
Email: dataprotection@bedfordshire.pnn.police.uk
(NB: Shared Service between Bedfordshire, Cambridgeshire and Hertfordshire)
Cheshire Constabulary
Controller: Chief Constable
Data Protection Officer
Information Compliance
Cheshire Constabulary Headquarters
Clemonds Hey
Oakmere Road
Winsford
Cheshire
CW7 2UA
Email: requests@cheshire.pnn.police.uk
City of London Police
Controller: Commissioner
Information Access Office
Information Management Services
Bishopsgate Police Station
London
EC2M 4NP
Email: Foi@city‐of‐london.police.uk
Civil Nuclear Constabulary
Controller: Chief Constable
Disclosures Officer
Civil Nuclear Constabulary
Culham Science Centre
Abingdon
Oxfordshire
OX14 3DB
Email: subject.access@cnc.police.uk
Cleveland Police
Controller: Chief Constable
Cleveland Police Data Protection Unit (Information Rights)
Ash House
Three Acres
Princeton Drive
Thornaby
Stockton
TS17 6AJ
Email: information.rights.requests@cleveland.pnn.police.uk
Cumbria Constabulary
Controller: Chief Constable
Cumbria Constabulary
Police Headquarters
Carleton Hall
Penrith
Cumbria
CA10 2AU
Email: subjectaccess@cumbria.police.uk
Department for Work and Pensions (DWP)
Controller: Secretary of State for Work and Pensions
DWP Data Protection Team
Benton Park View 6
Room BP6001
Mail Handling Site A
Wolverhampton
WV98 1ZX
Email: data.protectionofficer@dwp.gov.uk.
Derbyshire Constabulary
Controller: Chief Constable
Data Protection Compliance Unit
Derbyshire Constabulary
Butterley Hall
Ripley
Derbyshire
DE5 3RS
Email data.protection@derbyshire.police.uk
Devon and Cornwall Constabulary
Controller: Chief Constable
Devon & Cornwall Police
Data Protection Office, Force Headquarters
Middlemoor
Exeter
Devon
EX2 7HQ
Email: dataprotectionalliance@dc.police.uk
Dorset Police
Controller: Chief Constable
Devon & Cornwall Police
Data Protection Office, Force Headquarters
Middlemoor
Exeter
Devon
EX2 7HQ
Email: dataprotectionalliance@dc.police.uk
(NB: Shared Service between Devon and Cornwall Police and Dorset Police)
Driver and Vehicle Licensing Agency (DVLA)
Controller: Chief Executive
DVLA SAR Enquiries
DVRE
DVLA
Swansea
SA6 7JL
Email: SubjectAccess.Requests@dvla.gov.uk
Driver and Vehicle Standards Agency (DVSA)
Controller: Chief Executive
Data Protection Manager
Driver and Vehicle Standards Agency
The Axis Building
112 Upper Parliament Street
Nottingham
NG1 6LP
Email information.handling@dvsa.gov.uk
Durham Constabulary
Controller: Chief Constable
Information Rights and Disclosure Unit
Business Innovation Department
Durham Constabulary Headquarters
Aykley Heads
Durham
DH1 5TT
Email: data.protection@durham.pnn.police.uk
Dyfed-Powys Police
Controller: Chief Constable
Disclosure Team
Dyfed-Powys Police
Police Headquarters
PO BOX 99
Llangunnor
Carmarthen
Carmarthenshire
SA31 2PF
Email: dataprotection@dyfed-powys.pnn.police.uk
Y Tîm Datgelu
Heddlu Dyfed-Powys
Pencadlys yr Heddlu
BLWCH POST 99
Llangynnwr
Caerfyrddin
Sir Gaerfyrddin
SA31 2PF
Ebost: dataprotection@dyfed-powys.pnn.police.uk
Environment Agency
Controller: Chief Executive
Freedom of Information (FOI) and Environmental Information Regulations (EIR) requests
PO Box 544
Rotherham
S60 1BY
United Kingdom
Email: enquiries@environment-agency.gov.uk
Essex Police
Controller: Chief Constable
The Information Rights Team
Essex Police Headquarters
PO Box 2
Chelmsford
CM2 6DA
E Mail: info.rights.of.access@essex.pnn.police.uk
Food Standards Agency (FSA)
Controller: Chief Executive
Information Management and Security
Floors 6 and 7, Clive House
70 Petty France
London
SW1H 9EX
Email: informationmanagement@food.gov.uk
Gangmasters and Labour Abuse Authority
Controller: Chief Executive
Data Protection Officer
Gangmasters and Labour Abuse Authority
PO Box 10272
Nottingham
NG2 9PB
Email: dataprotection@gla.gov.uk
Gloucestershire Constabulary
Controller: Chief Constable
Information Disclosure
Gloucestershire Constabulary
Police HQ
1 Waterwells Drive
Waterwells
Quedgeley
GL2 2AN
Email: DPO@gloucestershire.pnn.police.uk
Greater Manchester Police
Controller: Chief Constable
Information Compliance and Records Management Unit
Greater Manchester Police
Openshaw Complex
Lawton Street
Manchester
M11 2NS
Email: subjectaccess@gmp.police.uk
Gwent Police
Controller: Chief Constable
Information Disclosure Unit
Gwent Police Headquarters
Croesyceiliog
Cwmbran
NP44 2XJ
Email: dataprotection@gwent.pnn.police.uk
Uned Datgelu Gwybodaeth
Pencadlys Heddlu Gwent
Croesyceiliog
Cwmbrân
NP44 2XJ
e-bost: dataprotection@gwent.pnn.police.uk
Hampshire Constabulary
Controller: Chief Constable
Public Access Office
Hampshire Constabulary
Mottisfont Court
Tower Street
Winchester
Hampshire
SO23 8ZD
Email: public.access@hampshire.pnn.police.uk
Hertfordshire Constabulary
Controller: Chief Constable
Information Rights
Bedfordshire Police HQ
Woburn Road
Kempston
Bedfordshire
MK43 9AX
Email: dataprotection@bedfordshire.pnn.police.uk
(NB: Shared Service between Bedfordshire, Cambridgeshire and Hertfordshire)
HM Revenue and Customs (HMRC)
Controller: Chief Executive
Fraud Investigation Service Complaints Team
5th Floor, Trinity Bridge House
Manchester
M3 5BS
Email: complaints.si@hmrc.gov.uk
Home Office
Controller: Secretary of State
SARU Home Office
40 Wellesley Road
Croydon
CR9 2BY
Email: subjectaccessrequest@homeoffice.gov.uk
Humberside Police
Controller: Chief Constable
Humberside Police
Information Compliance
Police HQ
Priory Road
Hull
HU5 5SF
Email: subjectaccess@acro.pnn.police.uk
Immigration Enforcement
Controller: Secretary of State for the Home Office
SARU Home Office
40 Wellesley Road
Croydon
CR9 2BY
Email: subjectaccessrequest@homeoffice.gov.uk
Kent Police
Controller: Chief Constable
Public Disclosure Unit
Kent Police
Cold Harbour
London Road
Aylesford
Kent
ME20 7SL
Email: Public.disclosure@kent.pnn.police.uk
Lancashire Constabulary
Controller: Chief Constable
Data Protection Office (subject access)
Lancashire Constabulary
PO Box 77
Hutton
Preston
PR4 5SB
Email: subjectaccess@lancashire.pnn.police.uk
Leicestershire Constabulary
Controller: Chief Constable
Data Protection and Information Security
Leicestershire Police Force Headquarters
St John's
Enderby
Leicester
LE19 2BX
Email: data.protection@leicestershire.pnn.police.uk
Lincolnshire Police
Controller: Chief Constable
Data Protection Office
Lincolnshire Police
PO BOX 999
Lincoln
LN5 7PH
Email: dataprotection@lincs.pnn.police.uk
Medicines and Health Care Products Regulatory Agency (MHRA)
Controller: Chief Executive
Data Protection Officer
MHRA
10 South Colonnade
London
E14 4PU
Email: dataprotection@mhra.gov.uk
Merseyside Police
Controller: Chief Constable
PNC and Data Access
Disclosure Unit
PO Box 59
Liverpool
L69 1JD
Email: Dataprotection@merseyside.pnn.police.uk
Metropolitan Police Service
Controller: Commissioner
MPS Information Rights Unit
PO Box 313
Sidcup
DA15 0HH
Email: SARonlineapplications@met.pnn.police.uk
Ministry of Defence Police
Controller: Chief Constable
MOD Police Data Protection Officer
MDPHQ
Wethersfield
Braintree
Essex
CM7 4AZ
Email: MDP-FOI-DP@mod.gov.uk
National Crime Agency (NCA)
Controller: Director Intelligence
Public Information Compliance Unit
National Crime Agency
Units 1-6 Citadel Place
Tinworth Street
London
SE11 5EF
Email: PICU.Enquiries@nca.gov.uk
NAFN Data and Intelligence Services facilitating Local Authority Trading Standards investigations
Controller: Head of Service
NAFN Data and Intelligence Services
Tameside MBC
Tameside One,
Market Place,
Ashton-under-Lyne,
Tameside
OL6 6BH
Email: anpr@nafn.scn.gov.uk
National Vehicle Crime Intelligence Service (NaVCIS)
Controller: Chair National Police Chiefs’ Council (NPCC)
NaVCIS
1 Leamington Road
Ryton-on-Dunsmore
CV8 3EN
Email: acpo.request@foi.pnn.police.uk
Norfolk Constabulary
Controller: Chief Constable
Data Protection Team
Norfolk Constabulary
Operations and Communications Centre
Jubilee House
Falconers Chase
Wymondham
Norfolk
NR18 0WW
Email: dataprotection@norfolk.pnn.police.uk
North Wales Police
Controller: Chief Constable
Information Standards & Compliance
North Wales Police
Glan-y-Don
Abergele Road
Colwyn Bay
LL29 8AW
Email: dataprotectionenqs@nthwales.pnn.police.uk
Manylion Cyswllt
Safonau Gwybodaeth a Chydymffurfiad
Heddlu Gogledd Cymru
Glan-y-Don
Ffordd Abergele
Bae Colwyn
LL29 8AW
Ebost: dataprotectionenqs@nthwales.pnn.police.uk
North Yorkshire Police
Controller: Chief Constable
Data Protection Officer
Information Management
North Yorkshire Police HQ
Alverton Court
Crosby Road
Northallerton
North Yorkshire
DL6 1BF
Email: dataprotectionofficer@northyorkshire.pnn.police.uk
Northamptonshire Police
Controller: Chief Constable
The Data Protection Office
Northamptonshire Police
Force Headquarters
Wootton Hall
Northampton
NN4 0JQ
Email: dataprotection@northants.pnn.police.uk
Northumbria Police
Controller: Chief Constable
Information Compliance
Northumbria Police
Bedlington Police Station,
Schalksmuhle Road
Bedlington
Northumberland
NE22 7LA
Email: data.protection@northumbria.pnn.police.uk
Nottinghamshire Police
Controller: Chief Constable
Information Management Office
Nottinghamshire Police, Force Headquarters
Sherwood Lodge
Arnold
Nottingham
NG5 8PP
Email: Data.protection@nottinghamshire.pnn.police.uk
Police Service of Scotland
Controller: Chief Constable
Information Management
Police Scotland
Queen Street
Aberdeen
AB10 1ZA
Email: dataprotectionsubjectaccess@scotland.pnn.police.uk
Scottish Environmental Protection Agency (SEPA)
Controller: Scottish Environmental Protection Agency
Data Protection Officer
Scottish Environment Protection Agency (SEPA)
Strathallan House
Castle Business Park
Stirling
FK9 4TZ
Email: dataprotection@sepa.org.uk
Services Police (Army, Navy and RAF)
Controller: Provost Marshall (Army)
Service Police Subject Access Request Coordinator
Headquarters Provost Marshal (Army),
2nd Floor Zone 5, Ramillies Building,
Marlborough Lines,
Monxton Road, Andover,
Hampshire SP11 8HJ
Email: ArmyPM-RMPEnquiriesMailbox@mod.gov.uk
South Wales Police
Controller: Chief Constable
The Chief Constable
Data Protection Office
Police Headquarters
Bridgend
CF31 3SU
Email: DataProtection@south-wales.pnn.police.uk
South Yorkshire Police
Controller: Chief Constable
South Yorkshire Police
Information Compliance Unit
Unit 20
Churchill Way
Sheffield 35a Business Park
Chapeltown
Sheffield
S35 2PY
Email: subjectaccess@southyorks.pnn.police.uk
Staffordshire Police
Controller: Chief Constable
Central Disclosure Unit (Right of Access)
Staffordshire Police Headquarters
Weston Road
Stafford
ST18 0YY
Email: rightofaccess@staffordshire.pnn.police.uk
Suffolk Constabulary
Controller: Chief Constable
Data Protection Team
Suffolk Constabulary
Martlesham Heath
Ipswich
Suffolk
IP5 3QS
Email: dataprotection@suffolk.pnn.police.uk
Surrey Police
Controller: Chief Constable
Information Access
Surrey Police
PO Box 101
Guildford
Surrey
GU1 9PE
E Mail: subjectaccess@surrey.pnn.police.uk
Sussex Police
Controller: Chief Constable
Subject Access Team
Sussex Police Headquarters
Church Lane
Lewes
Sussex
BN7 2DZ
Email: Subject.Access1@sussex.pnn.police.uk
Thames Valley Police
Controller: Chief Constable
Public Access Office
Thames Valley Police Headquarters
Oxford Road
Kidlington
Oxfordshire
OX5 2NX
Email: publicaccess@thamesvalley.pnn.police.uk
Warwickshire Police
Controller: Chief Constable
Information Compliance Unit
Warwickshire Police
PO Box 55
Hindlip
Worcester
WR3 8SP
Email: Freedom.Information@warwickshire.pnn.police.uk
West Mercia Constabulary
Controller: Chief Constable
Information Compliance Unit
West Mercia Police
PO Box 55
Hindlip
Worcester
WR3 8SP
Email: information@westmercia.pnn.police.uk
West Midlands Police
Controller: Chief Constable
The Civil Disclosure Unit
West Midlands Police
PO Box 52
Birmingham
B4 6NQ
Email: dataprotection@west-midlands.pnn.police.uk
West Yorkshire Police
Controller: Chief Constable
Disclosure Unit
West Yorkshire Police
PO Box 9
Laburnum Road
Wakefield
WF1 3QP
Email: dp@westyorkshire.pnn.police.uk
Wiltshire Police
Controller: Chief Constable
Subject Access
Force Disclosure Unit
Wiltshire Police Headquarters
London Road
Devizes
Wiltshire
SN10 2DN