Hundreds of thousands of EU citizens were wrongly fined for driving in London’s Ulez clean air zone, according to European governments, in what has been described as “possibly one of the largest data breaches in EU history”.
The Guardian can reveal Transport for London (TfL) has been accused by five EU countries of illegally obtaining the names and addresses of their citizens in order to issue the fines, with more than 320,000 penalties, some totalling thousands of euros, sent out since 2021.
The Liberal Democrats’ transport spokesperson in the London assembly has called for an immediate investigation, saying the issue could damage the UK capital’s reputation as being open to visitors.
Since Brexit, the UK has been banned from automatic access to personal details of EU residents. Transport authorities in Belgium, Spain, Germany and the Netherlands have confirmed to the Guardian that driver data cannot be shared with the UK for enforcement of London’s ultra-low emission zone (Ulez), and claim registered keeper details were obtained illegally by agents acting for TfL’s contractor Euro Parking Collection.
In France, more than 100 drivers have launched a lawsuit claiming their details were obtained fraudulently, while Dutch lorry drivers are taking legal action against TfL over £6.5m of fines they claim were issued unlawfully.
According to the Belgian MP Michael Freilich, who has investigated the issue on behalf of his constituents, TfL is treating European drivers as a “cash cow” by using data obtained illegitimately to issue unjustifiable fines.
Many of the penalties have been issued to drivers who visited London in Ulez-compliant vehicles and were not aware they had to be registered with TfL’s collections agent Euro Parking at least 10 days before their visit.
Failure to register does not count as a contravention, according to Ulez rules, but some drivers have nonetheless received penalties of up to five-figure sums. TfL said the fines were justified because it was unable to confirm whether foreign vehicles had contravened emissions standards if they were not registered.
Some low-emission cars have been misclassed as heavy goods diesel vehicles and fined under the separate low-emission zone (Lez) scheme, which incurs penalties of up to £2,000 a day. Hundreds of drivers have complained that the fines arrived weeks after the early payment discount and appeals deadlines had passed.
One French driver was fined £25,000 for allegedly contravening Lez and Ulez rules, despite the fact his minibus was exempt.
Freilich has asked ministers to raise the issue during the current Belgian presidency of the Council of the EU. “This is possibly one of the largest privacy and data breaches in EU history, but so far no concrete action has been taken while responsibilities are being shunted on to drivers,” he said.
TfL said that despite an absence of individual data-sharing agreements with EU countries, “local laws” allowed authorities to share vehicle owner information with the UK for the enforcement of traffic regulations.
However, EU countries say national laws allow the UK to access personal data only for criminal offences, not civil ones. Breaching Ulez rules is a civil offence, while more risky behaviour such as speeding or driving under the influence of drink or drugs can be a criminal offence. This raises the question of whether Euro Parking can legally carry out its contract with TfL.
Euro Parking was awarded a five-year contract by TfL in 2020 to recover debts from foreign drivers who had breached congestion or emission zone rules.
The company, which is paid according to its performance, is estimated to have earned between £5m and £10m. It has the option to renew for a further five years.
The firm is owned by the US transport technology group Verra Mobility, which is listed on the Nasdaq stock exchange and headed by the former Bank of America Merrill Lynch executive David Roberts. The company’s net revenue was $205m (£161m) in the second quarter of 2023.
In October, the Belgian government ordered a criminal investigation after a court bailiff was accused of illegally passing the details of 20,000 drivers to Euro Parking for Ulez enforcement. The bailiff was suspended in 2022 and TfL initially claimed that no Belgian data had been shared with Euro Parking since then. However, a freedom of information request by the Guardian found that more than 17,400 fines had been issued to Belgians in the intervening 19 months.
TfL then claimed driver details were provided directly to Euro Parking by Belgium’s vehicle licensing agency. It has since told the Guardian they are obtained via a National Contact Point (NCP), a network of official information hubs for use by authorised agencies.
However, the Belgian minister for transport has confirmed that data cannot be shared directly or indirectly for Ulez enforcement. Last month, the Belgian data protection authority began an investigation into how the information was still being obtained.
Campaigners accuse Euro Parking of circumventing data protection rules by using EU-based agents to request driver data without disclosing that it is for UK enforcement.
Last year, an investigation by the Dutch vehicle licensing authority RDW found that the personal details of 55,000 citizens had been obtained via an NCP in Italy. “The NCP informed us that the authorised users have used the data in an unlawful way and stopped their access,” a spokesperson said.
The German transport authority KBA claimed that an Italian NCP was used to obtain information from its database. “Euro Parking obtained the data through unlawful use of an EU directive to facilitate the cross-border exchange of information about traffic offences that endanger road safety,” a KBA spokesperson said. “The directive does not include breaches of environmental rules.”
Spain’s transport department told the Guardian that UK authorities were not allowed access to driver details for Ulez enforcement. Euro Parking has sent more than 25,600 fines to Spanish drivers since 2021.
In France, 102 drivers have launched a lawsuit claiming that their details were fraudulently obtained. Romain Binelli, of the law firm Woog & Associés, who is representing the litigants, said: “The question is who could have accessed the information. Either Euro Parking and TfL have maintained their access to the vehicle database, which should have ended after Brexit, or they are paying someone to get the information. Drivers are receiving packets of 10 or more fines for monstrous amounts all at once, often well after the [deadline] date to contest them.”
TfL, speaking on behalf of Euro Parking, said: “Any company working on our behalf is contractually required to ensure that data is processed in line with the relevant data protection legislation. We work closely with European Parking Collection to ensure all elements of the contract are being adhered to and have mechanisms in place should they not be fulfilled.
“Euro Parking make it clear when they submit requests for keeper data in EU countries that they are acting on behalf of TfL, for enforcement of road-user charging in London, even when they route those requests through a third party. Euro Parking has not been prevented from accessing keeper data for drivers in EU countries.”
Caroline Pidgeon, the Lib Dem London assembly member and transport spokesperson, called for an immediate investigation after the Guardian shared its findings.
“It is extremely worrying to hear that TfL could be collecting its data from drivers unlawfully,” she said. “The extent of fines being issued to visitors from the EU, many incorrectly, demonstrates that the rules are not being communicated clearly to tourists, something which I have raised with TfL in the past only to be brushed off. If this issue is not solved urgently, it risks seriously damaging London’s reputation as being open to visitors.”