Privacy Notice

A Clean Air Zone (CAZ) is an area where targeted action is taken to improve air quality. The purpose of the CAZ central service is to enable you to find out if you need to pay to drive within a CAZ and, if so, pay a daily charge if your vehicle does not meet emission standards. Full details of the CAZ are available at https://www.gov.uk/guidance/driving-in-a-clean-air-zone.

This notice explains how the Joint Air Quality Unit (JAQU) processes and shares your personal data for the purposes of the CAZ scheme. JAQU is a joint unit of Department of Transport (DfT) and the Department for Environment, Food and Rural Affairs (Defra) established to oversee the UK plan for tackling roadside nitrogen dioxide (NO₂) concentrations. This CAZ privacy notice supplements the general privacy notices available at Defra and DfT.

JAQU is a joint controller of this data with the local authorities who operate a Clean Air Zone. This CAZ privacy notice deals only with personal data in respect of which JAQU is joint controller. High level information on the roles and responsibilities of the various parties with regards to the processing of your personal data is provided below but please refer to the privacy policy of the relevant local authority for further information on how they process your personal data to operate their scheme and enforce their Clean Air Zone charge.

What personal data is being collected and how is it used?

To enable a local authority to operate its CAZ, JAQU is delivering the CAZ Central Service, a digital service that allows the local authority to:

determine whether a vehicle entering a CAZ is compliant with the CAZ Framework
determine if the vehicle is not compliant, whether it is liable to be charged and, if so, how much
enable individuals to pay the charge if one is applicable
provide a first point of contact for the resolution of queries and to support assisted digital users

The local authorities will collect vehicle registration numbers (VRN) entering a CAZ using automatic number plate recognition (ANPR) cameras and provide these to JAQU to determine if the vehicle is liable for a charge.

Your number plate will also be collected if you use the vehicle checker ('Check if you'll be charged to drive in a Clean Air Zone') service accessible at https://www.gov.uk/check-clean-air-zone-charge.

Automated rules will be used to determine whether your vehicle is subject to the charge based on its emission standards. If you have concerns that the vehicle has been wrongly identified as being subject to the charge, or any queries about the information provided by the Drive in a Clean Air Zone service, you can submit an enquiry by using the web form.

Along with your query, you will need to give your name and email address, which will be used to respond to your query. The information you provide will be sent to JAQU (or suppliers acting on their behalf) for the sole purpose of replying to you.

Your personal details may also be used to conduct research on the effectiveness of the service to ensure it is meeting customer needs and expectations and to continuously improve the service. All research is conducted by DVLA on behalf of JAQU.

Alternatively, if you phone the customer contact centre, to make any enquiries concerning the operation of the CAZ, the following information may be requested to help resolve your query:

Name/surname
Address
Previous name and address (if appropriate)
Telephone number
Email address
VRN, make, model and colour of the vehicle

JAQU may also need to share this information with the relevant local authority to assist with your query.

The telephone call may also be recorded for training, appeals or enforcement purposes.

If you phone the customer contact centre requesting a payment confirmation email is resent, the email address you provide and the date and time the email was resent will be stored for 7 years.

All information related to general enquiries is retained for a period of 90 days. After 90 days, only names and email addresses are kept, and the rest of the information is deleted. Names and email addresses are retained for 7 years to enable us to check whether the users have previously submitted an enquiry.

Before the CAZ is operational

Historic VRN data may be used for testing purposes where necessary. This enables the system setup to be tested against expected performance in a controlled environment. This data is deleted once testing is completed.

CAZ local authorities and JAQU jointly use personal data to ensure that people, who are likely to be affected by the introduction of Clean Air Zones, receive a letter giving them advance notice of the zones coming into force. If your vehicle travels through an area that will be designated as a CAZ, your VRN may be collected by ANPR and passed to JAQU. If your vehicle does not meet the current emission standards, an 'Early Notice Letter' may be sent to you using information held by the Driver and Vehicle Licensing Agency (DVLA) informing you that your vehicle will be subject to a charge.

Once the CAZ is operational

Only vehicles that do not meet emission standards will have to pay a charge when the CAZ starts charging.

Local authorities will use ANPR to capture the VRN of vehicles entering a CAZ. After filtering the data collected through ANPR to account for local exemptions, the remaining vehicle entrant data will be sent to the CAZ central service to determine if the vehicle should be charged.

VRN and time of entry will also be used to check whether a payment has been made.

If your vehicle is liable to be charged and travels in the CAZ once it is in operation, you will be able to pay using a credit card, debit card or by Direct Debit. When you enter your bank details to make payment, your payment data will be processed by the CAZ Central Service, using payment providers who will process the payment transaction. The payment date is exchanged with the CAZ Central Service for reconciliation purposes.

An email address will be requested from you to allow a payment confirmation receipt to be sent to you. The local authority will also be sent confirmation of the payment and the payment status of those vehicles entering their CAZ that are eligible for a charge.

JAQU will retain a record of your payment transaction for a period of 7 years in the central service. The record will include the VRN against which the payment was made. Data relating to your payment may be accessed by the support team or by contact centre advisors in order to assist with any related queries. Users will also be able to view their transaction payment history for up to 18 months from when a payment is completed.

If you do not pay the charge you may get a penalty charge notice (PCN). Details of how to pay or appeal a PCN can be found on the Local Authority site.

You can also open an individual account to manage your vehicles and charges.

An individual account allows you to add or remove vehicles, check and pay for one or more vehicles by card, view payments made in the account previously and add multiple users to manage the account. All users of the account will have the same levels of access.

To use the service, you need to create an account by providing your name, email address, and a password. When an additional user is added to the account, the service will send an email summarising their permissions and a URL for the recipient to confirm they want to be added as a user. When an additional user is removed from an account, the user’s name and email address will be removed.

When uploading a vehicle, you'll need to enter the VRN for your vehicle. The VRNs will be retained whilst your account remains active. If you replace your vehicle, your vehicle history will be retained for 12 months, after which it will be deleted.

A history of previous payments made within the account for any vehicle uploaded to the account can be viewed by all account users. This will include the VRN paid for, payment date, zone, amount, payment reference and payment ID.

Businesses that are the registered keeper of 2 or more vehicles can check and pay charges for multiple UK registered vehicles entering a CAZ by opening a business account.

To use the business account service, you need to be a business and create an account by providing your company name, email address, and a password. The service will verify the email address by sending a secure link to complete the account set up.

You'll then need to enter the VRN for your vehicles. The VRNs will be retained whilst your account remains active. If you replace your vehicle, your vehicle history will be retained for 12 months, after which it will be deleted.

The individual or business account information will be retained by JAQU for as long as the account remains active. If you do not use the individual or business account service for 180 days, your account will become inactive. In this scenario, we'll retain your account information for 7 years after the account becomes inactive.

NO2 evaluation data

In order to understand the extent to which the programme is meeting its stated aim of reducing nitrogen dioxide concentrations to within legal limits in the shortest possible time, a clear understanding of fleet composition (with reference to Euro Standards) before, during and after the implementation of the Local Plan measures, is needed.

Local authorities will therefore be sharing VRN details of vehicles entering the CAZ with JAQU before the CAZ goes live, and then quarterly for the duration of the evaluation period. DfT will match this data with vehicle type and emissions data which will be pseudonymised prior to being returned to the local authority and third parties acting on their and JAQU's behalf to evaluate and provide reports on air quality.

DfT will retain this pseudonymised data (where identifying details are replaced with a key) for no longer than 12 months.

What is the lawful basis for processing my personal data?

The legal basis for the processing of your personal data to operate a CAZ is that it's necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in:

DfT and Defra, as partners in JAQU
local authorities, as operators of the CAZ

The public interest task is to inform people of new regulations and penalties and to facilitate the operation of the CAZ.

Where special category personal data is being processed to determine whether a vehicle is exempt from the charge because it falls within the disabled tax class, this is processed for reasons of substantial public interest under Article 9 of the UK General Data Protection Regulation and for statutory and government purposes under Schedule 1 Data Protection Act 2018.

The legal powers underpinning the CAZ scheme are Part III and Schedule 12 of the Transport Act 2000 and Parts 2 and 6 of The Road User Charging Schemes (Penalty Charges, Adjudication and Enforcement) (England) Regulations 2013 pertaining to the Clean Air Zone Charging Order relevant to the local authority whose ANPR cameras recorded your number plate.

The legal basis for processing your personal data to conduct research on the effectiveness of the service is consent. You do not have to provide your consent and you can withdraw your consent at any time.

Who will my personal data be shared with?

Your personal data may be lawfully shared with:

suppliers working with or on behalf of JAQU
other government departments
local authorities
Transport Scotland, for the purpose of checking if a vehicle is compliant with a Low Emission Zone
Scottish Local Authorities, for the purpose of enforcement action for non- compliance within a Low Emission Zone

Will my personal data be transferred outside the UK?

Data relating to UK registered vehicles will not be routinely transferred outside of the UK.

Data held within the CAZ central service may be accessed by IT support teams in Australia and Singapore to help resolve an urgent technical issue. However, there are Standard Contract Clauses adopted by the commission in place to ensure comparable protection for the data.

Who can I contact with any concerns about the CAZ?

You can raise any queries about the information provided by the vehicle checker service by using the web form available at https://contact.drive-clean-air-zone.service.gov.uk.

If you have any questions about how your personal data is processed in relation to the CAZ Central Service, or are interested in exercising any of your rights under data protection law in relation to that processing, please email the Data Protection Manager for JAQU at data.protection@defra.gov.uk

Contact details for the local authorities can be found in the links at the beginning of this notice.

What is the arrangement between the joint controllers regarding matters concerning my personal data?

The roles and responsibilities of the joint controllers (JAQU and the local authorities), that operate the scheme, with regards to the processing of your personal data are as follows:

JAQU has prepared this privacy notice in consultation with the local authorities who are also responsible for publishing their own privacy notices to reflect the processing they undertake for CAZ.
The parties will cooperate with each other in responding to any request received from data subjects exercising their rights under data protection legislation in relation to their personal data (a 'Data Subject Request'). The party receiving the Data Subject Request will fulfil the obligations of the controller to respond to the request in accordance with data protection legislation.
They will provide reasonable assistance to each other to enable a Data Subject Request to be dealt with in an expeditious and compliant manner.
Each shall be responsible for fulfilling the controller's responsibilities under data protection legislation as to security of the personal data processed on systems controlled by that party.
If JAQU becomes aware of a data incident within the central CAZ service, Defra, as the 'Reporting Party', will be responsible for assessing whether the breach constitutes a personal data breach that is required to be notified to the Information Commissioner's Office and (where applicable) to the data subjects under Articles 33 and 34 of the UK GDPR. The reporting party shall fulfil the obligations of the controller to give such notice, if it is required, in accordance with data protection legislation.
The parties have agreed to provide reasonable assistance to each other in order to facilitate the handling of any personal data breach in an expeditious and compliant manner.
Where the local authority becomes aware of a data incident relating to its processing of personal data for CAZ, it will be responsible for assessing and reporting any personal data breaches arising.
In the event of a complaint or dispute brought by a data subject or a data protection authority concerning the processing of personal data within the central CAZ service, Defra will act as the initial contact point but all parties will provide all reasonable assistance in helping to investigate and resolve the matter.
All complaints or disputes relating to the use of ANPR or the enforcement of the CAZ charge should be directed to the relevant local authority.

Irrespective of the above arrangement, you can exercise your rights under the UK GDPR in respect of and against each of the joint controllers if you wish.

Where can I find further information about my rights?

More information on your rights is available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

You also have the right to lodge a complaint with the ICO and, should you wish to exercise that right, full details are available at https://ico.org.uk/make-a-complaint/your-personal-information-concerns/.

Review

We review our privacy policy at least annually. By doing this we will make sure you are always aware of what information we collect, how we use it and under what circumstances (if any) we will share it with other parties.

Cookies on Clean Air Zones