Guidance

Local authority transport: how to prepare data before sharing it

Explains what local authorities should do before publishing their data.

From:
Department for Transport
Published
28 March 2023

Establish what data you have

Make a transport data catalogue

You should create a catalogue of your transport data. The catalogue should record what data exists, and who the data owners are. Check what transport data other teams in your authority hold, including the geographical information system (GIS) team, if applicable.

Information you should record includes:

  • why the data is being collected and stored
  • the data sources
  • contact details for the data owner
  • details of the data quality
  • details of what the data set covers
  • the date of the last update and frequency of updates
  • the retention period of the data set
  • what data formats are available and the standards they meet
  • where the data set is stored
  • information about whether or not the data is currently shared or published

It may also be helpful for you to keep a record of data sets that you would find useful, but do not currently have. You should explain why the data would be useful.

Reasons for creating a transport data catalogue

Creating a transport data catalogue could:

  • increase awareness of and transparency about transport data in your local authority – you can share your transport data catalogue in the authority so that staff are aware of your data
  • help you avoid sharing data that should not be shared
  • help to reduce the time spent responding to freedom of information (FOI) requests – increasing awareness about existing data sets and data owners could speed up the time it takes to reply to responses and could also decrease the volume of FOI requests you receive
  • save time and money – for example, it will prevent data sets being purchased twice and could highlight data sets that are still purchased but are no longer used

Maintain your transport data catalogue

Consider creating a group of people who are responsible for maintaining the data catalogue. This group would decide which data sets can be shared.

Many local authorities have successfully implemented such teams. Maintenance of the catalogue is vital to ensure it is up to date and accurate.

Understand who owns internal and contractor data

You might collect your own data or a contractor might collect it for you. If you receive data from a third party, you must check who owns it and if you can share it.

Consider the additional services your supplier can provide

Many contractors can provide extra services relating to data sharing. Talk to your suppliers to find out if there are additional services and data that they can help you access. For example, suppliers with access to CCTV cameras may also be able to help provide traffic count data.

With your permission, some suppliers may be able to share your data. Some suppliers have websites and application programming interfaces (APIs) that they can use to publish data on your behalf. Publication of data is an industry trend and is often part of a service. However, unless you specify or ask your supplier to share data, it may not be done automatically.

To find out if your data suppliers can provide additional help, ask them:

  • if more data is available than is currently supplied and if so, is there an extra cost for accessing it
  • who owns any additional data – generally it should be you, but check Department for Transport’s (DfT’s) guidance on contracts with suppliers
  • what format any additional data is in and what data standards are being used
  • if the supplier will share the data on your behalf
  • if the data be shared by an API and if so is documentation available

Supplier shared data sets

Some suppliers have a national scale and can combine local authority data into a national data set. This increases the attractiveness of data sets to third-party data users.

Understand your data quality

You should check the quality of your data before sharing it.

Data users often cite quality as a barrier to using data sets. The key elements of good quality data are explained below.

Timeliness of data updates

Data must be up to date to be useful. For example, data about proposed roadworks that do not happen at the time specified could lead to sat navs sending drivers on unnecessary diversions. End users will lose trust as a result. One solution is to procure a service to check and validate your data.

The direction of travel is also essential information in some cases.

Availability of data

Third-party services are often required by their customers to be available 24 hours per day, every day of the year. It follows that a constant availability of data is important for many users.

Accurate metadata

Accurate metadata will make it more likely that people find and use your data. Metadata is data that provides information about a data file. See DfT’s advice about metadata.

Confidence level

Provide information about the confidence users can have in your data, if possible. For example, if you can confirm that roadworks have started, this is more useful than telling users that work is programmed.

Examples of good data quality practice

Follow standards and quality requirements

Where applicable, follow industry recognised data standards and data quality requirements. DfT’s guidance on types of transport data provides more advice on data standards.

Validate your data before publishing it

Validation is used to check the quality of data and correct issues if necessary. Examples of validation include carrying out traditional audits and crosschecks, such as:

  • cross-referencing traffic counts and measured speeds using camera information
  • checking flows into and out of a location are approximately equal over time
  • checking if vehicle speeds are realistic

If you are not able to validate your data, let people know it is unvalidated and provide an error-reporting mechanism.

Date and time format

Ensure dates and times are formatted correctly to ISO 8601 and use Coordinated Universal Time (UTC) rather than British Summer Time (BST). Using BST will lead to confusion.

Timestamps allow users to judge how up to date your data is. For event-based data such as road closures use a ‘valid until’ time.

Location accuracy

Location accuracy is important when sharing data. Providing the incorrect location of a road closure can lead to drivers making poor route choices.

Implied location accuracy

Locations can be referenced in a number of ways but the most useful is latitude and longitude coordinates. These can be measured using satellite navigation devices.

The number of decimal places in a location reference implies the accuracy of your data. If you are using 5 decimal places this suggests your data is accurate to 1.1 metres.

Use 4 decimal places for latitude and longitude coordinates.

Using fewer than 4 decimal places is not accurate enough for most purposes. Only use 5 decimal places if you are confident in your data accuracy.

Number of decimal places Implied accuracy Practical use
2 Accurate to the nearest 1.1 kilometres Very few applications for transport data.
3 Accurate to the nearest 110 metres This accuracy can identify major land uses such as train stations and car parks. Lacks the accuracy for many transport uses.
4 Accurate up to the nearest 11 metres Can identify a parcel of land. Comparable to an uncorrected GPS unit.
5 Accurate to 1.1 metres This accuracy can distinguish between street lamps. It is rare that this can be achieved with GPS units, so it is unlikely you can provide location data with this level of accuracy.

Give locations context

Add a road name or unique street reference number (USRN) as well as latitude and longitude GPS coordinates to provide further context and validation. Using 2 location indicators helps detect errors where the coordinates are incorrect.

Sharing lower quality data

If your data is not high quality, you can still share it as long as you inform users that it is poor quality and provided on a ‘best endeavours’ basis. This means that it is the responsibility of data users to judge the quality of the data.

Understand how your data could be used

Understand what you want to achieve

To ensure the success of opening your data, you need to know what you are hoping to achieve. Ideally, you should start with a use case, so you can monitor whether you achieve your objectives.

Opening transport data delivers a wide range of benefits. The following examples describe some reasons that local authorities have identified for sharing their transport data, with case studies and outcomes.

Improving understanding within your local authority

Internal data sharing is an easy first step towards opening and sharing your data. You can receive feedback on your data that will help you succeed when opening your data. We also have several case studies of data sharing to improve internal understanding.

Many local authorities share transport data with other teams and departments. Often, other departments reciprocate and share their data with transport teams.

Increased internal data sharing can provide operational benefits to the authority. A number of examples are listed below.

Examples of internal data sharing within local authorities

Sharing traffic data can help to avoid congestion and roadworks. This can be used to improve the planning of routes, including social care transport and refuse collection.

Data sharing between the traffic, transport and environmental teams has many benefits. It can lead to a stronger understanding of the links between vehicles and public transport and emissions.

Collaboration with transport planning teams can lead to improved analysis, research and predictions to support infrastructure investment.

Sharing traffic data with asset management teams can help them prioritise road maintenance improvements.

Sharing bus open data can support traffic management activities.

Improving understanding between neighbouring authorities and other public sector bodies

Sharing data with neighbouring authorities can improve understanding of regional issues. This can aid collaborative solutions and provide benefits to the public.

Many local authorities share data with other public sector bodies. These include sub-national transport bodies (STBs), National Highways, DfT and the emergency services.

STBs are responsible for developing regional strategies and prioritising investment in their region. Data is essential for this. Creating regional data sets helps define area-wide strategies and increases the intelligence that can be gained from them.

STBs have taken steps to collect data on behalf of their local authorities and share it with them. This includes traffic volume, urban traffic management and control (UTMC), parking and origin-destination data.

Some STBs buy and share floating vehicle data (FVD) that measures speeds and journey times. By collecting large regional data sets, the STBs increase the attractiveness of the data to end users.

Read case studies of data sharing between neighbouring authorities and other public sector bodies.

Generating economic benefits

You can share your data externally, either by making it available to selected people and organisations or by making it fully open to anyone.

Open transport data has the potential to generate a wide range of economic benefits. You can read case studies of data sharing to generate economic benefits.

Many economic benefits are not cashable but support local authority objectives. For example, third-party apps could use your data to provide information to the public. This could result in reduced congestion, improved safety and a better experience for road users.

Examples of cashable and operational savings include:

Example

A 2017 analysis of Transport for London’s (TfL) open data estimated annual benefits and savings of up to £130m. Smaller local authorities are unlikely to see benefits on this scale.

Supporting innovation and the Future of Transport agenda

Many authorities find that by opening and sharing transport data they can support innovation. Supporting new mobility solutions will create a new environment which is less reliant on carbon-dependent transport and offers improved accessibility. We have several case studies of data sharing to facilitate innovation and the Future of Transport agenda.

Supporting innovation by working with academia and the private sector

Close collaboration with academics can help local authorities to benefit from research. If you take this route remember to request the resulting thesis in return for your data.

Universities and students are often looking for research projects. Open data can provide inspiration and ideas for such projects. Academics often have access to resources that are not available to a local authority.

Open data can encourage innovation in the private sector. This is illustrated by the following TfL example.

Example

TfL have demonstrated that releasing transport data can encourage innovation. Recent estimates suggest their data powers over 600 apps.

However there is little evidence of smaller local authorities seeing a significant amount of private sector innovation as a result of opening their data. Smaller authorities are more likely to work with universities as described above. There could be a role for STBs to support their local authorities to open and share their data. For example, they could aggregate local authority data across their region. This would create larger data sets that data users prefer.

Using data analytics

Data analytics can exploit the potential of open data. Analytics tools can help realise the true value of data. Increases in processing power allow for faster and more efficient analysis.

The power and capability of data analytics has evolved with advances in technology. This has enabled greater insights into the transport network. For example, combining data sets can achieve new insights.

Example

Predictive analytics software helped to reduce road fatalities in Tennessee. This software combines traffic data with other open data sources including weather patterns, event schedules and historic crash data.

Building national data sets

Alternatively, combining regional data sets can build a national picture. There are several projects that combine local authority data to provide national insights. Successful DfT projects include the Bus Open Data Service (BODS) and Street Manager.

Local authority traffic flow, cycle and parking data was collated by DfT throughout the first coronavirus (COVID-19) lockdown. This data has since been expanded to provide national baselining. Regular bulletins are fed back to the local authority sector through the Transport Technology Forum.

Future of Transport applications

Future of Transport (FoT) services include:

  • demand responsive transport
  • micromobility
  • mobility as a service (MaaS)

Open transport data is a prerequisite for many FoT applications. For example, MaaS schemes need open data to provide users with all the information they need to plan their journeys. The Bus Open Data Service (BODS) will be transformational in supporting MaaS. To gain the benefits of FoT applications, you should open and share your transport data.

Cycle, e-cycle and e-scooter hire schemes have an interest in open local authority data. For example, there are several new market entrants who are combining the shared data for the national e-scooter trials with demographic and socio-economic data to improve their analysis of the impact of the trials.

Improving transparency for the general public

Open transport data improves transport network transparency. You can read case studies of data sharing to increase transparency for the general public.

Local authorities releasing their transport data can improve public trust. It can help to influence behaviour by encouraging modal shift and active travel.

A secondary benefit is a reduction in the number of FOI requests.

Understanding your end users

The next step is to understand the needs of users of your transport data. This will allow you to minimise the risk that your data is not used.

Ask your users what they need

Current stakeholders include other departments within your local authority. It also includes external stakeholders, such as existing data users. You could also approach others who might have a use for your data, such as local universities.

The questions you could ask are:

  • what types of data would be useful?
  • what are your uses of the data?
  • what characteristics does the data need to have?
  • what could make our data more useful?

You should consider historic, static and dynamic data types. You can read examples of transport data sets.

You can download a template of questions to ask your data users.

Understanding the needs of your data users will allow you to identify:

  • data sets with the greatest demand
  • data sets with little demand
  • how to ensure your data meets these needs

Choosing which data sets to publish

This section covers the main aspects to consider when deciding which data sets to publish.

Identifying which data sets to publish

You could choose either to publish data that will provide quick wins or that has the most demand.

Quick wins

You could prioritise publishing data sets that are easiest to publish first. Make sure you’re targeting data that there’s some demand for. This will mean you avoid publishing data that’s not used.

Demand-driven

You could prioritise publishing data sets with the most demand. Demand includes internal data requests, academics, partners, external bodies or freedom of information (FOI) requests. You could also use community engagement to dictate priority data sets for publication.

Producing an open data publication plan

You will not be able to publish all your data sets at the same time. An open data publication plan will set out your publication aims. This details the data sets for publication, as well as details of how and when.

The Open Data Handbook contains guidance to help develop an open data publication plan. An open data publication plan demonstrates your commitment to open data. Your plan could be a page on a website, or a document shared with relevant stakeholders.

It should feature contact details so that data users can make suggestions. This will allow users to provide feedback and suggest priority data sets for publication.

Writing a business case – if you need one

A business case provides justification for undertaking work. It evaluates the benefit, cost and risk of alternative options and provides a rationale for the preferred solution. You will probably need to write a business case if you are requesting investment to open your data. This section addresses how you can build a business case for opening transport data.

The Open Data Institute (ODI) provide guidance about creating a business case for open data, and a public services business case canvas.

Projects that require government approval must use the transport analysis guidance (TAG) and it should be used as best practice guidance for other projects. TAG contains guidance on how to create a business case and perform the economic appraisal.

Understanding your local authority’s objectives and goals

To identify a business case, you must understand the goals, aims and objectives of your local authority. These goals will often encompass wider social, economic or environmental issues.

You should also consider the operation of your local authority in the future. Questions to consider include:

  1. Are you able to use the opportunities that open data presents to meet your aims and objectives?
  2. What benefits will open transport data deliver to your local community?

Developing potential solutions

You now need to identify and describe how potential open data solutions will help your local authority to meet these goals.

First, understand uses of transport data in areas that open data could improve operations.

To achieve this, you should understand the existing demand for your transport data. There are many routes through which your data is currently shared and used. These may include:

Next, talk to colleagues in internal departments to find out how they use your data. You should also try to understand the data shared between your data users. There may be efficiencies or savings that opening your data can achieve.

You should also aim to understand issues with your current data sharing model. Highlight any issues that reduce the benefits users receive from your data. You may find it helpful to identify other data that would aid your local authority if it was available.

For example, consider sharing real time parking data to improve the user experience by helping drivers find empty parking spaces. This can contribute towards reducing emissions and has an economic benefit which can be quantified.

Choosing the right business model

You should choose the best open data business models for your local authority. The choice of solution will affect how you estimate the costs and benefits of your solution.

A business model describes the rationale of how an organisation creates, delivers and captures value. This can be in economic, social, cultural or other contexts.

Using open data for downstream benefits

Local authorities can choose to open their data for the downstream benefits. These could be the benefits expected as a result of encouraging innovation in the private sector and through academic research. Some authorities (for example, TfL and TfWM) share their data without having a clear picture of the benefits, assuming that others will find ways to use their data. The risk of this is that the data remains unused. More often, the data is opened with an objective in mind.

The introduction of sub-national transport bodies (STBs) has resulted in significant new levels of regional transport data sharing to help develop region-wide transport policy and delivery. This provides downstream benefits for the authorities. National Highways shares significant data through the Traffic England site and plans to expand data sharing through a new open data site. Their data is used by a range of organisations including sat nav providers who use it to improve their driver information.

There are good examples of local authorities who have followed this business model of opening data for downstream benefits.

Example

Oxfordshire County Council opened journey time information by different transport modes on the OxBike website to promote cycling and encourage active travel.

Example

Harrogate Borough Council opened their parking space occupancy data that the public can view in a parking app. This has generated revenue as well as improving congestion.

If you are considering opening your data for downstream benefits you should consider:

  1. What are the desired outcomes from sharing data? Examples include internal data sharing, economic benefits or a public behaviour change.
  2. Which users want the data? It is difficult to predict who will access the data and TfL’s model does not scale well to smaller local authorities. Satellite navigation companies prefer to deal with national or regional feeds rather than individual local authority data.
  3. Is the data quality high enough?

Collaborative data sharing – free of charge

This business model involves local authorities sharing their data in exchange for data from others. This results in benefits for both parties.

Example

Local authorities provide a connected vehicle data supplier with their traffic information feeds and the supplier provides access to their live traffic and incident updates.

Example

The Safety Related Traffic Information (SRTI) Ecosystem: Data for Road Safety involves reciprocal sharing of road safety data between industry partners and governments. The system aims to improve road safety by informing drivers of roadworks or incidents. Work is ongoing to secure a centralised national access for this data and information will be available on the Transport Technology Forum (TTF) website.

If you are considering opening your data through collaborative data sharing you should consider:

Are you willing to share your data with third parties in return for other data sets?

Public private partnership

This model involves a collaboration between a local authority and a private sector organisation. The agreement is to deliver a service that benefits the authority.

Example

Local authorities pay a service provider to clean their street and roadworks data. The provider produces an internal dashboard for each local authority and a public-facing web interface for residents.

They aggregate the data into a national database. Due to the scale of this data set sat nav companies use it.

As an additional benefit local authorities have found that improved roadworks information reduces road worker abuse.

If you are considering opening your data through a public private partnership, you should consider:

Do you think that the cost of procuring a service is worth the benefits generated?

Sharing data for revenue generation

This final business model consists of selling transport data to generate revenue. Some authorities share data on request for a fee. Another option would be through a brokerage service.

Example

The Convex mobility data exchange service allowed local authorities to share their data, with the option to charge a fee. Transport for West Midlands (TfWM) made several transport data feeds available through Convex.

This business model is still in its infancy for transport data. Several investigations have highlighted little potential to monetise local authority transport data. While some data sets have commercial value, sales are infrequent and do not generate large revenues. These data sets include traffic counts that are of interest to developers.

If you are considering selling your data you should consider:

  1. What is the value of the data and will users be willing to pay?
  2. Is the data quality sufficiently high?

Appraising the costs and benefits

Your economic appraisal should follow the TAG guidance. To evaluate the publication of open data, you should consider the associated whole-life costs. This includes the ongoing costs of opening your data. Some costs to consider include:

  • converting data to an open format
  • web hosting plus creation of a portal – if necessary
  • time and cost of promotion and advertising
  • update and maintenance costs

Note that the explicit cost of each of these will vary depending on the size of the local authority and the quality and quantity of data.

You should also quantify the benefits. You can read examples of the benefits of sharing open data. Benefits may include:

  • cashable savings – for example, a reduction in FOI requests or efficiency savings
  • economic benefits – for example, congestion, emissions and safety improvements

It can be difficult to estimate costs and benefits. It might help to:

  • request quotes from suppliers for systems and equipment costs and maintenance
  • estimate how many days per month someone spends on a certain activity and convert this into a cost of employing them
  • follow TAG guidance about estimating economic benefits
  • use sensitivity testing to investigate the impacts with a range of values (for example, low, medium and high) where there’s any uncertainty

There might be valuable but non-quantifiable benefits. For example:

  • health and well-being improvements through encouraging active travel
  • encouraging innovation in the local economy
  • increased levels of accountability and transparency
  • increased levels of community engagement

Your business case should make clear where non-quantifiable benefits support your authority’s strategic priorities.

Note that TAG guidance can be skewed towards vehicles, which can undermine your strategic priorities to encourage public transport and active travel. In this case document how opening your data supports your strategic priorities and why this is important.

Example business cases for opening local authority transport data

In 2019, DfT held a funding competition for local authorities to open their transport data. Completed bids included a business case for the proposal, outlining the context of the investment and costs. A number of bids and business cases are available to view online from:

Getting additional help and support

Opening data requires a wide range of expertise. This section details some sources of support that are available.

Internal support

Your first option for resources is internal staff in the transport team. They will understand the nuances of transport data. You should identify the capabilities and skills of your staff. This will allow you to use the staff who are best placed to make the publication of your data a success.

Senior management

Seek support and backing from senior management. Open data is becoming a policy priority for local authorities. Support from senior management can ensure that your open data project receives support. For example, it can help with resource allocation and the resolution of issues. You can also read about why you should share your transport data.

IT or data team

Contact your IT or data team within your local authority for specific data support. They may be able to upskill project staff, providing a downstream benefit to the project team.

Data security or cyber team

Approach your data security or cyber team if you have specific security issues. If sharing geographical data, you should include GIS specialists in your discussions.

Open data champion – if applicable

Many local authorities have an open data champion who is responsible for making open data projects a success. They are also responsible for promoting open data within an organisation. If your local authority has an open data champion they are an important contact. They will be able to share experiences and best practice from prior open data projects.

External support – if required

If you are unable to find the help or support that you require internally there are some external bodies you can contact.

Sub-national transport body

If you are lacking skills within your authority, you may be able to approach your sub-national transport body (STB) for support. STBs can help their local authorities to better inform residents. They can provide support to deliver services that benefit the public.

In some regions STBs have provided support and upskilling to their local authorities. For example, within England’s Economic Heartland data mature local authorities have provided support to less mature ones.

Some STBs operate their own data platforms. They might be able to host your open data.

Contact pages for the 7 STBs are:

Other resources

There are other transport bodies that might be able to provide support, such as combined authorities, city or regional transport bodies or neighbouring local authorities.

Outside of local government, you can speak to your local Open Data Institute (ODI) node. The ODI has national and international nodes that provide open data support. Nodes provide open data training and encourage networking within the open data community. The ODI have produced a map of their local nodes

Close collaboration with academics can increase access to resources. Academics are often happy to collaborate on projects. They often have access to resources unavailable to a local authority.

Example

The ODI node in Bristol facilitated the creation of Bristol is Open. This is a joint venture between Bristol City Council and the University of Bristol. They opened their energy and aggregated it to support the development of Bristol as a smart city. The project has achieved its 20% energy reduction target.

Procurement of services – if required

You can work with third-party suppliers if you need further support and resources. Before approaching new suppliers, it’s a good idea to discuss your needs with current suppliers. They may be able to provide support or resources tailored to your needs. For example, urban traffic management and control (UTMC) systems can be managed and developed to open and share a range of traffic management data.

When working with third-party suppliers it is vital to be aware of what you have and what your specific needs are. Your specification should accurately describe your requirements.

Crown Commercial Services procurement frameworks

If you need help with procurement you could contact Crown Commercial Service (CCS). CCS provide tailored support to local authorities about purchasing goods and services.

CCS has a general account manager for every local authority. This is your initial point of contact to pinpoint your needs and requirements. This conversation will also explore how CCS can provide support. Your account manager can navigate you through CCS frameworks and provide bespoke advice. If you have queries about a specific framework then the Commercial Agreement Manager (CAM) and their team will be able to help.

If you are unsure who your general account manager is contact the CCS contact centre.

There are a number of CCS frameworks relevant to transportation. The main frameworks are detailed in the below table.

Framework Details End date
G-Cloud 12 Purchase cloud-based computing services such as hosting, software and cloud support, including many off-the-shelf, pay-as-you-go cloud solutions. 27 Sept 2022
Research Marketplace Dynamic Purchasing System Services for social, economic and market research available, 15 Feb 2022
Spark Dynamic Purchasing System Buy emerging technology products and services, including Internet of Things (IoT), AI and automation, simulated environments, wearables and new improvements in security. 15 Apr 2023
Transport Technology and Associated Services (TTAS) This framework will replace TMT ii. It will provide a route to market for the same services, and has specific areas for the supply and distribution of data. This framework has an estimated start date of 06/11/2021. 5 Oct 2023

If you are procuring intelligent transport systems or traffic technology there is existing guidance from the Transport Technology Forum (TTF). It helps you through the procurement process and includes guidance and case studies for procuring data services.

Other frameworks

Your combined authority or STB might have a procurement framework that you could use if it applies to you. Some have procurement frameworks for specialist services.

For example, Midlands Connect has a Specialist Technical Framework. This framework is for the procurement of services and goods in technology and transportation.

Considerations when procuring transport data

You need to ensure you receive good quality data from suppliers. You can do this with service-level agreements (SLAs) featuring quality requirements. You can read guidance on data quality. Ensure there is an error reporting mechanism and that you have a contact for issues or errors.

You must also ensure you understand who owns the data and establish your right to share it.

Include clauses in contracts with suppliers to make sure that you have the rights to share and use the data held on your behalf in your system. For example, urban traffic control (UTC) system data.

However, remember that some externally sourced data may have restrictions on open use for commercial reasons. For example, suppliers of real-time speed data from floating vehicles do not allow it to be shared openly in real time because it would impact their ability to sell the data to others.

Ideally, the supplier should supply a fully documented application programming interface (API) to publish data for external sharing. An API allows two programmes to talk to each other. The API should publish data in the correct standard. DfT’s guidance on data standards has more details.

The API should come with security provisions via user logins and passwords that you can control. You should ensure that your supplier provides support for use of the API and that the data set has suitable metadata. If your supplier is unable to provide an API at the very least they should provide a means for downloading data over the internet.

Use the guidance on tender wording to ensure data access and API requirements produced by the London Office of Technology and Innovation (LOTI).

Considering privacy and security

Privacy and security concerns are a barrier to open data sharing. This section includes guidance to minimise these barriers.

Deciding whether your data includes personal data

You should check whether it is likely that your data set will include processing of any personal data.

Personal data is defined by UK GDPR Article 4 (1) as “any information relating to an identified or identifiable natural person”.

Personal data includes:

  • an identifier – for example, a name, email address or phone number
  • personal identification numbers – for example, bank account or national insurance number
  • factors specific to an individual’s physical, physiological, genetic, mental, economic, cultural or social identity
  • location data – data that has any kind of geographic position attached to it. For example, data collected by wireless networks, swipe cards and smart mobile devices that provide location tracking or vehicle registration numbers
  • online identifiers – for example, mobile device IDs, browser cookies or IP addresses

Special Categories of Data (UK GDPR Article 9) are those which are more sensitive, relating to race, ethnicity, political opinion, sexual orientation and genetic or health related data. These need more protection. They are unlikely to be relevant to transport data that you want to share.

The Information Commissioner’s Office (ICO) provides detailed guidance on personal data and special category personal data.

Most types of transport data are unlikely to include personal data.

You can find information about the most common transport data types that you might want to share. It shows whether each data set is likely to include personal data. The types of transport data most likely to include personal data are those which reveal the locations of individuals. This includes CCTV, Bluetooth, ANPR or GPS locations.

The ICO provides specific guidance about requirements for video surveillance .

If you are sure that your system does not process personal data, then you do not need to be concerned about data privacy. However you must remember to review this if the situation changes.

If you are not sure, contact your authority’s data protection officer (DPO) who will be able to help you find out. If you are unable to find out if your system processes personal data, you should complete a data protection impact assessment (DPIA).

Data privacy

If you are collecting, processing, storing, sharing or deleting personal data there are statutory requirements you must follow.

You must implement ‘appropriate’ technical and organisational measures as part of the design of your data protection systems. For details see DPA 2018 S57 and UK GDPR Article 25. You must also consider various data protection principles and safeguards as set out in DPA 2018 S34-42.

Completing a Data Protection Impact Assessment (DPIA)

You can use a DPIA to assess the impact of processing operations on the protection of personal data. The DPA 2018 states that you must complete a DPIA where a “type of processing is likely to result in a high risk to the rights and freedoms of individuals”.

It is good practice to complete some form of DPIA for all data sharing activities if they use any personal data.

You should also complete some form of DPIA if you have been unable to ascertain if a system processes personal data.

The DPA 2018 provides information about DPIAs and what they must contain. The ICO and UK GDPR Article 35 provide more detailed information about DPIAs including when a DPIA is required. The ICO provides a DPIA template which you can use as is or tailor to your needs.

A DPIA is a live document that you should review regularly.

Examples of good DPIAs

Example

TfL have recently launched TfL Go, which is a travel app to help Londoners plan their journeys on public transport around London. TfL have produced two DPIAs for TfL Go. One covers the pre-launch Beta trial and the other covers the public launch of the app.

Example

Warrington Borough Council have produced a DPIA for the installation of new CCTV cameras in their fleet of taxis.

Example

Watford Borough Council have produced a DPIA for the introduction of a demand responsive transit (DRT) solution to their region.

What to do if you are planning to share personal data

If you are planning to share personal data you must take steps to ensure that you protect this data.

In addition, the collection, use, storage and deletion or archiving must adhere to the data protection principles and safeguards stated in DPA 2018 S34-42 and UK GDPR Article 5 and Article 9.

You as a data controller must ensure that you take ‘appropriate’ security measures to meet your statutory requirements to protect privacy data.

If you have pseudonymised your personal data you should still treat it as personal data (UK GDPR recital 26).

If you collect or process personal data the data subject has statutory rights. This allows the person to request a copy of their information and request the deletion of their data. To understand the rights of the data subjects refer to UK GPDR Article 12-22.

Privacy when sharing personal data

You have a statutory obligation to protect the rights of a data subject. You must remove personal identifiers from the data set.

Once you have anonymised or pseudonymised a data set it should not be possible to identify an individual.

If it is possible to identify (or make an assumption about the identity of) an individual, you must implement further security measures.

There are some other considerations. Ask your DPO if you are unsure about them.

You must not process personal data further than the “specific, legal and legitimate” purposes for collection – UK GDPR Article 5 (1).

If you transfer personal data you must consider DPA 2018 S73-76 and UK GDPR Article 44. These explain the principles for transfer.

If you are transferring personal data, you must also consider UK GDPR Article 13 and Article 14. These dictate the information that a data controller needs to inform a data subject of.

If a supplier is sharing data for you they are classed as a data processor. You must ensure that they follow DPA 2018 S60 and UK GDPR Article 29. This states that they must not process the data for any reason except “on instruction from the controller, or to comply with a legal obligation”.

Purpose limitation

You must ensure that personal data is only processed for purposes not incompatible with the purpose for which it was obtained. See ICO Principle (b) for further information.

Record of processing activities

You must create a record of processing activity (ROPA). This is a live record of the details of your processing of personal data and needs to be updated in the event of any changes.

The ICO and UK GDPR Article 30 detail the requirements for the creation and maintenance of a ROPA. This includes the information requirements for compliance with legislation. The ICO provides ROPA templates for data controllers and for data processors.

You may choose to include data types which do not include personal data.

Data retention

You must not retain personal data for “longer than is necessary for the purposes for which the personal data are processed” UK GDPR Article 5 (1)(e).

Security

The National Cyber Security Centre (NCSC) wrote the connected places cyber security principles to raise local authority awareness of security considerations to do with smart cities.

UK GDPR Article 25 requires that you ensure the security of your system if you collect, process, retain or transfer personal data. In your role as a data controller you must build data protection into the design of data processing. This is applicable when data processing is either internal or external (by a third party).

Regulatory standards

Industry-recognised regulatory standards include ISO27000, NIST800, Cyber Essentials or the PSN code of connection.

You should follow at least one of these standards. They will help you quantify whether your systems are suitable to keep data secure and protect privacy data. This will help you to be compliant with your statutory requirements.

Security when sharing personal data

If you want to share data that includes personal data you must do the following things. These are good practices even if you are not sharing personal data.

Take security measures

You must perform a risk evaluation of the security of your data and implement ‘appropriate’ security measures.

UK GDPR Recital 78 describes “appropriate technical and organisational measures”.

You could use anonymisation, pseudonymisation, encryption or other cryptographic controls. You may need to upgrade your technology if it does not provide adequate security for processed data.

Transfer and share data securely

When transferring or sharing data internally or externally you should follow the ICO’s Data Sharing Code of Practice.

To ensure you implement ‘appropriate’ security measures, contact your IT and cybersecurity teams. This will protect personal data at rest and in transit.

When transferring personal data externally you must ensure the transfer is secure. You should check that the external party implements ‘appropriate’ security measures.

There are special requirements if you want to transfer personal data to a third country. This could be if you are sharing data with international partners or if your suppliers use data servers outside of the UK. You should contact your DPO if you want to do this.

Use a secure method of deletion

In line with DPA 2018 S90 and UK GDPR Article 5 (1)(e) you must designate a retention period for personal data. Once the retention period has passed you must either securely delete the data or archive it. You must have a justifiable reason to archive your data instead of deleting it.

Your risk evaluation should include potential risks relating to the deletion process.

Anonymise or pseudonymise your data

You must anonymise or pseudonymise data to an ‘appropriate’ level.

You must also implement other ‘appropriate’ security measures to prevent a breach of your systems due to the opening of your data. You should discuss this with your IT and cybersecurity teams.

If a supplier is sharing your data for you, you should satisfy yourself that they take the ‘appropriate’ security measures.

Published 28 March 2023
Contents

Related content