The names and addresses of thousands of EU drivers were unlawfully accessed by Italian police and shared with the company that collects Ulez penalties on behalf of Transport for London (TfL), investigators believe.
The Italian data protection authority is investigating claims by Belgium’s government that an unnamed police department misused official powers to pass the personal details of Belgian drivers to Euro Parking Collections, which is employed by TfL to issue fines to enforce London’s low emission zone (Lez) and ultra-low emission zone.
Authorities in the Netherlands and Germany have stated that their databases were also illegally accessed by an agent in Italy in what one Belgium MP has called “the biggest data and privacy breach in EU history”.
TfL denies the claims. It said Euro Parking confirmed it had not used an Italian police department to access driver details.
The fines are alleged to have been issued illegally because since Brexit, national laws allow the UK to access the personal data of EU citizens only for criminal offences, and breaching Ulez rules is a civil contravention.
Britain’s departure from the EU means there are now questions about how TfL can enforce compliance with London’s clean air rules for foreign vehicles.
The allegations come less than two years after a court bailiff in Belgium was suspended on suspicion of unlawfully accessing the Belgian vehicle database on behalf of Euro Parking.
The issue could tarnish London’s international standing, according to the Liberal Democrat London assembly member Caroline Pidgeon. She has demanded that TfL stop using Euro Parking to issue fines to EU citizens until it can be sure the company’s methods are legally compliant.
“This is yet another worrying testimony calling into question the practices being used by TfL and its partner to collect drivers’ information from inside the EU,” she said.
“If this data is not being collected lawfully it would represent an extremely serious data breach that would seriously damage the reputation of London as a world-leading tourist destination, in addition to the reputation of the mayor of London and TfL.”
An investigation by the Guardian last month revealed hundreds of thousands of British immigrants and EU nationals had been wrongly issued with Ulez fines, according to European governments, with some amounting to thousands of pounds, since the Brexit transitional period ended in December 2020.
Euro Parking has issued more than 330,000 penalties, some totalling thousands of euros, since 2021.
Many of the drivers were fined after omitting to pre-register emissions-compliant vehicles before driving into London. Others were ordered to pay £2,000 for each day they visited the capital after their cars were wrongly classed as heavy diesel vehicles and triggered charges under the separate Lez scheme.
In 2022, a court bailiff in Belgium was accused of exploiting its official access to the country’s national vehicle database to pass the names and addresses of more than 20,000 drivers to Euro Parking. The bailiff is now subject to disciplinary proceedings and faces a possible criminal investigation.
TfL initially claimed that no fines had been sent to Belgian residents since March 2022 when it was informed of the investigations. However, a freedom of information request (FoI) by the Guardian revealed that more than 17,000 fines were issued to Belgian drivers between March 2022 and October 2023.
TfL, in its response to the FoI, said: “We are aware that the Belgian National Chamber of Judicial Officers issued a notice on 23 March 2022 that stopped the country’s [vehicle registration agency] DIV sharing data with companies who were passing it on to foreign authorities. [Euro Parking] have not used this method to obtain Belgium keeper details since the ruling. However, the ruling does not prevent [Euro Parking] from obtaining keeper details directly from the DIV which has been the method used for PCNs [penalty charge notices] issued to Belgium registered vehicles after 23 March 2022.”
The Belgian transport ministry has confirmed DIV is not permitted to share data with Euro Parking or TfL for UK civil enforcement and says it has since found evidence that the company has been obtaining the information via an Italian police force. The force has been accused of exploiting official EU data-sharing systems without disclosing that the information was for UK enforcement.
Italy operates four national police forces with different responsibilities and Belgian officials have not disclosed which force or officers are being investigated.
The Belgian transport minister, Georges Gilkinet, said: “It is unacceptable that privacy laws were not respected. The investigations are still ongoing, but I have asked my department to take all necessary steps against intermediaries who illegally consulted the Belgian registration database.”
The transport ministry has written to the European Commission demanding new safeguards to prevent privacy laws being abused by rogue operators. Meanwhile, Belgium has ordered its London embassy to raise the issue of illegal data gathering with TfL executives.
TfL, which speaks on behalf of Euro Parking, has claimed it stopped requesting Belgian driver details for Ulez and Lez enforcement last September. A spokesperson said: “Any company working on our behalf is contractually required to ensure that data is processed in line with the relevant data protection legislation. We work closely with EPC to ensure all elements of the contract are being adhered to and have mechanisms in place should they not be fulfilled. EPC have confirmed that they have not used an Italian police department to access driver details.”
