Traffic and Transportation - privacy notice

Derby City Council is the local government unitary authority for Derby city. Our address is Council House, Corporation Street, Derby, DE1 2FS. You can contact our Data Protection Officer on 01332 640000 or by email at data.protection@derby.gov.uk.

This privacy notice sets out how Derby City Council collects, uses, and protects personal data to execute its extensive statutory duties regarding the public highway, traffic management, civil enforcement and transportation services.

You can contact the department directly by email at traffic.management@derby.gov.uk.

How do we collect information from you?

We collect information when you use our transport and parking services, visit www.derby.gov.uk, complete online or paper forms, register for or use myAccount and parking applications, make payments, apply for permits, concessions or transport services, and when you contact us by telephone, email, post, online forms, webchat or in person. We may also receive information from third parties, including the Driver and Vehicle Licensing Agency (DVLA), the Blue Badge Digital Service, schools and transport providers, enforcement partners, debt recovery agencies, and other public authorities where this is necessary to deliver services, enforce traffic and parking regulations, or fulfil our legal obligations.

Vehicle Registration Marks (VRMs) and related vehicle information may also be collected through our traffic enforcement camera systems, including Automatic Number Plate Recognition (ANPR) technology, CCTV systems, and other enforcement equipment located across the city. In some circumstances, visual evidence such as Body Worn Video (BWV) recordings and dashcam footage provided by members of the public may also be used to support investigations, enforcement activities, and the administration of transport and parking services, more information can be found in our camera enforcement section.

What types of information do we collect from you?

We obtain data directly from you via application forms, customer portals, written correspondence, phone calls, face-to-face conversations or other electronic communications. We also gather data systematically via automated and monitored enforcement cameras and parking systems.

Details of information obtained from third parties?

We receive data from third parties, which include:

• The Driver and Vehicle Licensing Agency ('DVLA') to identify registered vehicle keepers.
• Police forces and emergency services.
• The Traffic Enforcement Centre ('TEC') at HM Courts and Tribunals Service.
• The Traffic Penalty Tribunal ('TPT').
• The Department for Transport ('DfT') and the Blue Badge Improvement Service.
• Schools, medical professionals, and independent mobility assessors.
• Enforcement agencies for the collection of unpaid debts

When you pay by card for the toilet turnstiles at Derby Bus Station, your payment is processed by a third-party payment partner, Nayax. We do not store or have access to your full card number or security code; we receive only limited transaction details (such as the date, amount, and the last four digits of your card) to confirm payment, fulfil orders and maintain statutory accounting records.

Nayax acts as an independent data controller for the purpose of processing the transaction and clearing funds. To learn more about how they handle your cardholder details, please read their privacy notice.

What is the lawful basis?

The legal basis for data processing we are relying on comes from Article 6 of the UK General Data Protection Regulations (UK GDPR). The following sections apply:

• (b) Contract: Where you enter into a contract for a specific service, such as renting a parking space or commercial licensing.
• (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
• (e) Public task: the processing is necessary for you to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law

For Special Category Data, such as health records for mobility schemes, we process under Article 9, relying on 'Substantial Public Interest' for statutory and government purposes together with the applicable condition in Schedule 1 to the Data Protection Act 2018.

• We rely on the following conditions as per Article 9 (2) of the UK GDPR:
  • (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
  • (g) processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
  • (f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

If we have asked for your consent you will be able to opt out any time by emailing traffic.management@derby.gov.uk.

We may also process your data to fulfil duties, enforce regulations, and execute powers granted under a substantial number of primary legislation. These include, but are not restricted to:

• The Highways Act 1980 
• The Traffic Management Act 2004
• Data Protection Act 2018
• UK GPDR 2021
• Data (Use and Access) Act 2025 (DUAA)
• Localism Act 2011
• Local Government Acts 1972; 2003
• Local Government Act 1974
• The Road Traffic Regulation Act 1984
• The Bus Lane Contraventions (Approved Local Authorities) England (Amendment) (No.2) Order 2006
• The Road Traffic (Permitted Parking Area and Special Parking Area) (City of Derby) Order 2006
• The Road Traffic Act 1988
• The New Roads and Street Works Act 1991
• The Chronically Sick and Disabled Persons Act 1970
• The Equality Act 2010
• The Transport Act 1985 and Transport Act 2000
• The Environment Act 1995 (Derby City Council) Air Quality Direction 2019
• The Clean Neighbourhoods and Environment Act 2005
• The Education Act 1996: For assessing eligibility and providing home to school travel assistance for children and young people.
• The Protection of Freedoms Act 2012: For ensuring all public space surveillance, including CCTV and ANPR, complies with the Surveillance Camera Code of Practice.
• The Civil Enforcement of Road Traffic Contraventions (Approved Devices, Charging Guidelines and General Provisions) (England) Regulations 2022
• The Civil Enforcement of Road Traffic Contraventions (Representations and Appeals) (England) Regulations 2022
• The Digital Economy Act (2017)

How is your information used?

Your information is actively used to:

• Administer, assess, and issue parking permits, Blue Badges, and concessionary travel passes.
• Issue Penalty Charge Notices ('PCNs') for parking and moving traffic contraventions.
• Process payments, manage appeals, and execute debt recovery warrants through enforcement agents.
• Monitor traffic flow, investigate road traffic collisions, and analyse journey data to improve road safety and air quality.
• Manage customer enquiries, insurance claims against the council, and recover costs for damage to highway assets.
• Protect front-line staff from abuse using BWV and investigate allegations of fraud, such as Blue Badge misuse.
• Register your support for, or objection to a proposed Traffic Regulation Order under The Local Authorities' Traffic Orders (Procedure) (England and Wales) Regulations 2012.
• Inform you of the outcome of a Traffic Regulation Order under The Local Authorities' Traffic Orders (Procedure) (England and Wales) Regulations 2012.
• Clarify information with you about the nature of an enquiry or complaint you have made.
• Process payments made using MiPermit for cashless parking and permits across the city who re-direct the user to their payment provider, Opayo Ltd to independently process your payment.
• Process payments made directly to the Council for parking and permits when using paper forms.
• Carry out collision recovery investigation for damage to highway assets, where the registered vehicle owner can be established through other Council CCTV and enforcement systems or through other organisations, such as the Police.
• Recover the cost of parking contraventions under Section 4 of the Civil Enforcement of Parking Contraventions (England).
• Your information may be transferred securely to the Traffic Enforcement Centre (TEC) who process warrants for unpaid penalty charge notices.
• Inform you of any changes to cycling activities either you or your child has been booked onto.
• Keep a register of attendance of children taking part in the council’s Bikeability courses.
• Inform you of any relevant cycling courses if you have previously taken part in one of Cycle Derby’s activities.
• Process any request made by you under section 50 of the Highways Act 1980.
• Process any Temporary Traffic Regulation Order required by you under The Local Authorities' Traffic Orders (Procedure) (England and Wales) Regulations 2012.
• Transport entitled students using contracted transport under the Education Act 1996.
• Transport looked-after children or young people to Court-directed contact visits, as detailed in Court Orders.
• Carry out enhanced Disclosure Barring Service checks under the Safeguarding Vulnerable Groups Act 2006 where required.
• Contact debtors and recover money owed for parking and/or traffic contraventions.
• Council Civil Enforcement Officers may photograph any vehicle found in contravention of a parking restriction and uploaded to the Council’s Case Management System, Chipside.
• Vehicle registration marks data will be used to establish the engine type and size of vehicles travelling through Derby, this will be used to predict changes to air quality which will be used in national and local air quality monitoring.
• Journey data will be used in statistical analysis to inform highway network management and transport planning for example the impact of planned road closures.

Research and statistics

Anonymised and pseudonymised data may be used for research and statistical purposes. Any data collected may be used for research and statistical purposes that are relevant and compatible with the purpose that the data was collected for.

Who has access to your information?

To fulfil our statutory obligations, we routinely share data with:

• Internal council departments, including legal, finance, social care, and corporate fraud teams.
• Central government systems, including the national Blue Badge Digital Service.
• Judicial bodies, including the TEC, the TPT, and the Magistrates Court.
• Contracted third parties, such as IT software providers, cashless parking operators, printing and mailing houses, and debt recovery enforcement agents.
• Statutory emergency services, to assist in the prevention and detection of crime.
• Other local authorities for the fulfilment of cross-boundary statutory duties, such as the prevention and detection of Blue Badge fraud or Blue Badge applications.
• Your information will be shared with MiPermit if you use our cashless parking and permit payment options across the city. This will also include Ecom6, who are the integrated merchant service provider and payment gateway. They act as independent Data Controllers of the personal data you provide to them to process any payments.  You can view their privacy policy at Ecom6 Limited - Privacy Policy.
• Derby City Council is a data controller for the MiPermit account and activity data held for stays within Derby. We can use this information for the purpose of debt recovery under GDPR, where necessary, using exemptions provided within the Data Protection Act 2018 and Digital Economy Act 2017.
• We may share with external organisations and administration systems, such as vehicle leasing companies, for the purpose of recovering debts.

We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes.

What are your rights?

• Access – you can request copies of any of your personal information that is held by the Council.
• Rectification – you can ask us to correct any incorrect information.
• Deletion – you can ask us to delete your personal information. The Council can refuse to delete information if we have a lawful reason to keep this.
• Portability – you can ask us to transfer your personal data to different services or to you.
• Right to object or restrict processing – you have the right to object to how your data is being used and how it is going to be used in the future.
• Right to prevent automatic decisions – you have the right to challenge a decision that affects you that has been made automatically without human intervention, for example an online form with an instant decision.

How long will we keep your information for?

We keep and dispose of all records in line with our record retention schedule. We will comply with Data Protection legislation.

What security precautions are in place to protect the loss, misuse or alteration of your information?

We are strongly committed to data security and will take reasonable and appropriate steps to protect your personal information from unauthorised access, loss, misuse, alteration or corruption. We have put in place physical, electronic, and managerial procedures to safeguard the information you provide to us. However, we cannot guarantee the security of any information you transmit to us. We recommend that you take every precaution to protect your personal information.

Keeping your data up to date

We want to ensure any information we hold is accurate. You should check and update your personal information through Employee Self-Service or by promptly informing us of any changes to the information we hold about you.

Under 13

If you are accessing online services and are under the age of 13, please get your parent or guardian's permission beforehand whenever you provide us with personal information.

Cookies

Cookies are small text files which identify your computer to our servers. They are used to improve the user experience. View what cookies we use and how you can manage them.

IP addresses

Internet Protocol (IP) addresses are collected when our site is used:

• for statistical and analytical purposes
• to identify any malicious activity

Complaints

If you would like to make a complaint regarding the use of your personal data, you can contact our Data Protection Officer:

• by post: Information Governance, Council House, Corporation Street, Derby, DE1 2FS
• by phone: 01332 640000
• by email: data.protection@derby.gov.uk

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner's Office (ICO):

• by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• by phone: 0303 123 1113 (local rate) or 01625 545 745 (if you prefer to use a national rate number)

Alternatively, visit ico.org.uk or email casework@ico.org.uk.