UNIVERSITY CAR PARKING PRIVACY NOTICE
Purpose of this Notice
This Notice explains how we will collect and use your personal data.
We are the Data Controller for the personal data that we process about you.
Throughout this Notice, “University”, “we”, “our” and “us” refers to the University of Leeds. “You” and “your” refers to those data subjects using the University car parks.
Change in the law
Until 24 May 2018 we shall process your personal data in accordance with the Data Protection Act 1998 (DPA for short). From 25 May 2018 we shall process your personal data in accordance with the General Data Protection Regulations, as incorporated into UK law (GDPR for short).
This Notice complies with the requirements under the DPA and the GDPR.
Where does the University get your personal data from?
The University maintains a database of all registered users of its car parks on a system called ParkIt; this is held on a secure University server. The University has also installed Automatic Number Plate Recognition cameras to govern the use of the University car parks. The personal data of users of University car parks is gathered in the following ways:
Automatic Number Plate Recognition (ANPR)
ANPR cameras capture vehicles as they enter the University car parks. These cameras focus on your vehicle’s number plate but may also capture images of the driver, and any pedestrians walking in front of the camera.
The University will contact the DVLA to retrieve the registered owners’ contact details of any vehicle that is parked illegally on the campus; this includes vehicles of registered users and permit holders which are parked, or driven, on campus in contravention of the University’s car parking terms and conditions. The University will also contact the DVLA to retrieve the emissions banding of vehicles registered on the University’s ParkIt database – this information helps to inform the price bracket of an individual’s parking permit.
SAP University HR system
The personal data of registered users and permit holders will be retrieved from the University’s HR system (SAP) at regular intervals. This data include name, address, University username, University email address, payroll and car registration number. The data is held on ParkIt. Salary information will be drawn from SAP for the purpose of determining the price bracket of an individual’s parking permit, this information is not retained on the ParkIt system.
As part of the permit application process, an individual may need to send supporting documentation to the dedicated firstname.lastname@example.org email address (for example, their child’s birth certificate, or a blue badge). Access to the email@example.com email folder is restricted and all users have received personal data protection training.
Where an individual is applying for a temporary parking permit on the basis of a medical condition, supporting documentation from their GP will be sent to a named individual at the University who will have received personal data protection training. The personal data will be anonymised and shared with the committee who determine the allocation of temporary permits.
The purposes for which we process your personal data and the legal basis for that processing
The University has a legitimate interest in processing your personal data to ensure that the University’s Car Parking Terms & Conditions (http://carparking.leeds.ac.uk/wp-content/uploads/2016/10/Parking-Terms-and-Conditions-2017.pdf) are adhered to, and to fairly manage parking on the campus. In addition, it is necessary for the performance of the University’s contractual requirements to process the personal data of registered car park users.
If you do not want your personal data to be used in the manner described then do not park on the University campus.
Parking permits are charged in price brackets according to a user’s salary and the emissions band of their vehicle (http://carparking.leeds.ac.uk/staff-permits-2/)
The process through which a price bracket is determined is a purely automated one (using the information gathered as described above). If you do not want your personal data to be used in this manner then do not apply for a University parking permit.
Who might we share your data with?
As described above, the University may contact the DVLA.
The personal data captured through the ANPR cameras is maintained by the University on a system called iView Solutions Ltd. There is a Data Processing Agreement in place which governs how iView can process your personal data on behalf of the University.
If we issue you with a Parking Charge Notice which is not paid within 56 days we will allow a third party debt recovery service to access your personal data on iView. They will access your DVLA records and may use other sources to ensure that your contact details are correct and will attempt to contact you to recover payment.
If the Parking Charge Notice remains unpaid the University will allow a firm of solicitors to access your personal data on iView in order to take legal action against you.
Your personal data will not be shared with any third parties outside the EU.
The University may contact permit holders to advise them of disruptions to access to the University car parks.
All of your personal data processed though the ANPR system will be stored on the iView system. Your personal data will be safely destroyed after 60 days if there has been no enforcement action taken against you. If enforcement action has been taken your personal data will be safely destroyed 3 years after the contravention took place, or longer if there is outstanding fines or Country Court Judgments.
Personal data will stay on the University’s ParkIt database unless an individual advises the University that they no longer wish to be a registered user of the car park, or if they leave the University and their information is removed from SAP.
Documentation provided to the University in support a parking permit application will be destroyed once a decision has been made. No record will be kept on the ParkIt database of why a permit was provided.
Your rights as a data subject
You have the right to:
access your personal data;
request the rectification or deletion of your personal data;
request the restriction of the processing of your personal data;
object to the processing of your personal data;
receive your personal data in a structured, commonly used format and to;
complain to the regulator (the Information Commissioner’s Office).
Concerns and contact details
If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice please contact, in the first instance, the Support Services Manager (Majid Khan at M.M.Khan@leeds.ac.uk) or the University’s Data Protection Officer, Adrian Slater at firstname.lastname@example.org.
Our general postal address is University of Leeds, Leeds LS2 9JT, UK.
Our postal address for data protection issues is University of Leeds, Room 11.72 EC Stoner Building, Leeds, LS2 9JT.
Our telephone number is +44 (0)113 2431751.
Our data controller registration number provided by the Information Commissioner’s Office is Z553814X.