Moving Traffic Offence Enforcement under TMA Part 6 privacy notice

We keep this privacy notice under regular review and it was last updated on 14 August 2024 (v0.4).

Kent County Council (KCC) respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

Who we are

KCC collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018. We are responsible as ‘controller’ of that personal information. Our Data Protection Officer is Benjamin Watts.

Traffic Management Act Part 6

As the Local Transport and Highway Authority, KCC has a statutory duty to ensure the effective discharge of the Traffic Management Act (2004) – its duty of care to help ensure safe passage for all road users and secure the provision of public passenger transport services within the county which would not be met without financial input form KCC.

The introduction of the Traffic Management Act (2004) Part 6 (TMA P6) by the national Government allows Highway Authorities to enforce a variety of moving traffic offences (MTOs) to improve road safety, pollution levels, journey time reliability in locations of low compliance and increase the lifespan of KCC highways road assets. These were powers not previously available to Highway Authorities outside of London after the Traffic Management Act came into force in 2008.

The Department for Transport (DfT) announced in 2020 that they would be fully enacting the remaining elements of the Traffic Management Act, permitting Highway Authorities outside of London to use approved camera devices, under civil law, to enforce moving traffic contraventions.

Moving traffic contraventions relate to traffic controls through signing and lining in the Highway Code and include:

• driving through a 'No Entry' sign
• turning left or right when instructed not to do so
• entering yellow box junctions when your exit is not clear
• driving where motor vehicles are prohibited
• driving a private vehicle on a route for buses only.

KCC's first step, as the Local Transport and Highway Authority, was to apply to the DfT to be included in the list of authorities that can enforce key highway restrictions or prohibitions across Kent.

The enforcement of restrictions will permit the expeditious movement of traffic on the authority’s road network, which will benefit public transport users, residents and road users.

The personal information we collect and use

Information collected by us

In the course of enforcing moving traffic offences we collect the following personal information when you provide it to us:

How we use your personal information

Reasons we can collect and use your personal information

We rely on Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’ as our duty as a Local Transport and Highway Authority under the following lawful basis on which we collect and user your personal data:

• Traffic Management Act 2004.
• Civil Enforcement of Moving Traffic Contraventions Designations and Miscellaneous Amendments Order 2022.
• Civil Enforcement of Road Traffic Contraventions (Approved Devices, Charging Guidelines, and General Provisions)(England)(Regulations 2022).
• Civil Enforcement of Road Traffic Contraventions (Representations and Appeals)(England) Regulations 2022.
• Road Traffic Regulation Act 1984.
• Road Traffic Offenders Act 1986.
• Road Traffic Act 1991.
• The Bus Lane Contraventions (Approved Local Authorities) (England) Order 2005.
• The Bus Lane Contraventions (Penalty Charges, Adjudication and
• Enforcement) (England) Regulations 2005.
• The Tribunals and Enquiries (Bus Lane Adjudicators) (England) 2005.
• The Transport Act 2000 (Section 144).
• Highways Act 1980.
• Tribunal, Courts and Enforcement Act 2007.
• Taking Control of Goods Regulations 2013.
• Taking Control of Goods (Fees) Regulations 2014.
• The Local Authorities Traffic Orders (Procedure)(England and Wales) Regulations 1996.

We rely on Article 9(2)(f) ‘Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity’ and Article 9(2)(e) ‘Personal information clearly made public by an individual themselves’ as the lawful basis on which we collect and use your special categories of personal data.

We rely on the Part 3, Schedule 1, DPA 18: Section 33 - legal claims condition in the Data Protection Act 2018 to process your criminal convictions data, should you voluntarily choose to provide us with as additional information as part of your appeal against a Penalty Charge Notice (PCN).

We take the following appropriate safeguards in respect of your special category or criminal convictions data when relying on the conditions above:

• We have a KCC Moving Traffic Enforcement Implementation and Enforcement Policy, and KCC Code of practice and policy for the operation of KCC CCTV and overt surveillance systems in place when using your special category or criminal records data.
• This policy is retained throughout the time we use of your data and for 6 months after we cease to use it.
• We have a Retention Schedule which explains how long data is retained.
• We maintain a record of our processing in our ‘Record of Processing Activities’ and record in it any reasons for deviating from the periods in our Retention Schedule.

The provision of video footage and still images, vehicle details, contact details, ownership of vehicle, financial details, additional information in support of challenge against a penalty charge notice, photo identification and date of birth is required from you to enable the Highways Authority (Kent County Council) to enforce moving traffic contraventions under the Traffic Management Act Part 6.

How long your personal data will be kept

We will hold your personal information for:

Who we share your personal information with

We routinely share:

We also share:

For a list of our third-party suppliers refer to the above table under ‘How we use your personal information’. This data sharing enables the Highways Authority (Kent County Council) to enforce moving traffic contraventions under the Traffic Management Act Part 6.

We have a data sharing agreement in place with Marston Holdings Ltd who process your data on our behalf. We will share personal information with law enforcement or other authorities if required by applicable law or in connection with legal proceedings.

We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9(2)(f) where the processing of special category data is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

We transfer your data to the following countries or organisations outside the UK:

Countries within the EU where ParkTrade have an international data sharing agreement and debt recovery process in place for, and only for the purposes of recovery of monies relating to the debt collection for traffic contravention fines debt sold by KCC to Marstons.

KCC uses Microsoft 365 and stores its data on servers based in the UK and in the Netherlands.

Other countries do not necessarily have the same data protection laws as the United Kingdom. If we do transfer information outside of the European Economic Area (EEA), we will make sure that it is protected in the same way as if it was being used in the UK. We’ll use one of these safeguards:

• Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA, which is supported by an ‘adequacy decision’ by the European Commission. Learn more on the European Commission website.
• Put in place a contract or appropriate safeguards with the recipient that means they must protect it to the same standards as the UK.

You can find out more about data protection on the Information Commissioner's website.

In July 2020, the European Court of Justice ruled that the EU-US Privacy Shield (a framework which sets privacy standards for data sent between EU countries and the US) was invalid. As a result, we are reviewing our data processes to ensure that where data is transferred to the US, there are appropriate safeguards in place.

As we transfer your data to the Netherlands (in the EU) we rely on UK GDPR Article 45 which states that this transfer may take place where there are ‘adequacy regulations’ determining that data is adequately protected by the laws in that country. A copy of this decision can be found in section 102 of Schedule 2 of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (2019/419).

As Microsoft is an international organisation based in the United States, where necessary, KCC relies on Article 46 of the UK GDPR and appropriate safeguards being put in place, including standard contractual clauses in its data processing agreement with Microsoft. Read Microsoft’s data protection addendum.

If you would like further information, please contact us (see our ‘how to contact us’ section below).

Your rights

Under UK GDPR you have rights which you can exercise free of charge which allow you to:

• know what we are doing with your information and why we are doing it
• ask to see what information we hold about you (subject access request)
• ask us to correct any mistakes in the information we hold about you
• object to direct marketing
• make a complaint to the Information Commissioners Office

Depending on our reason for using your information you may also be entitled to:

• ask us to delete information we hold about you
• have your information transferred electronically to you or to another organisation
• object to decisions being made that significantly affect you
• object to how we are using your information
• stop us using your information in certain ways

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioners Office on individuals’ rights under GDPR.

If you would like to exercise a right, email data.protection@kent.gov.uk.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Who to contact

Please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk, or write to: Data Protection Officer, Sessions House, Maidstone, Kent ME14 1XQ.

UK GDPR also gives you right to lodge a complaint with Information Commissioner, who may be contacted via the Information Commissioner's website or call 03031 231113.

Read our corporate privacy statement.