Statutory guidance

The Air Quality (Taxi and Private Hire Vehicles Database) (England and Wales) Regulations 2019: Statutory guidance

Published 18 July 2019

Applies to England and Wales

1. Introduction

Status of guidance

1.1) This guidance has been issued in order to assist local licensing authorities in the implementation of the Air Quality (Taxi and Private Hire Vehicles Database) (England and Wales) Regulations 2019 (2019 No. 885) (“the Regulations”).

1.2) It provides advice on the data that licensing authorities must provide in relation to all vehicles operating as taxis and private hire vehicles (PHVs) registered by the authority, the format in which it is transferred and the way in which the data will be handled in compliance with the General Data Protection Regulation (GDPR).

1.3) The Secretary of State may use the data to create a Taxi and PHV Centralised Database (“the database”).

1.4) This statutory guidance is issued under section 88(1) of the Environment Act 1995^{[footnote 1]}. Licensing authorities (those defined in regulation 2(1) of the Regulations) are under a statutory duty to have regard to this guidance as set out under section 88(2) of the Environment Act 1995.

1.5) It is for licensing authorities to ensure that they have complied with any data protection legislation when implementing their obligations under the Regulations. This document provides some general guidance for assistance but licensing authorities are advised to seek their own legal advice on how their procedures will comply with data protection requirements.

2. The law in practice

Background

2.1) In 2017, the government published the UK plan for tackling roadside nitrogen dioxide concentrations followed by a supplement in 2018 (together “the plan”). The plan identified 61 local authorities in England showing exceedances which have been required to carry out feasibility studies and if necessary, develop bespoke plans to bring roadside concentrations of nitrogen dioxide within legal limits in the shortest possible time. The Welsh Government is taking the same approach with two local authorities in Wales.

2.2) Clean Air Zones (“CAZs”) will have a key role to play in delivery of a number of these local plans. The Clean Air Zone Framework sets out the minimum requirements for a CAZ and the expected approach to be taken by local authorities when implementing and operating these zones. CAZs are not required to include a charging element. However, where there are no other viable options to reduce air pollution to legally permissible levels in the shortest possible time, some local authorities may decide to introduce zones where vehicle owners are required to pay a charge to enter, or move within, a zone if they are driving a vehicle that does not meet the particular minimum emission standard for their vehicle type in that zone.

The Framework sets out four classes of charging CAZ:

Class A - Buses, coaches, taxis and private hire vehicles (PHVs)

Class B - Buses, coaches, taxis, PHVs and heavy goods vehicles (HGVs)

Class C - Buses, coaches, taxis, PHVs, HGVs and light goods vehicles (LGVs)

Class D - Buses, coaches, taxis, PHVs, HGVs, LGVs, cars (motorcycles and mopeds are optional).

Each vehicle type is expected to reach the following minimum standards:

• Euro 4 for petrol driven vehicles (Euro IV for larger vehicles)
• Euro 6 for diesel driven vehicles (Euro VI for larger vehicles)

Ultra-low emission vehicles with significant zero emission range will never be charged for entering or moving through a CAZ.

2.3) Leeds and Birmingham will be introducing charging CAZs in 2020 (class B and D respectively). A number of other authorities have also consulted on the introduction of a charging CAZ. To implement these schemes, local authorities may need to differentiate between taxis/PHVs and private vehicles. This is because in some cases local authorities will implement CAZs that apply charges to taxis and PHVs and not to private vehicles, or they may wish to set a different level of charge for these vehicles. Licensing authorities only hold information on taxis and PHVs licensed within their own area so are not able to clearly identify and charge a taxi/PHV entering or moving around their charging CAZ which has been licensed by another authority (also known as ‘out of area vehicles’). If local authorities cannot identify all out of area vehicles then this would undermine their ability to effectively operate CAZs where charging of these vehicles has been determined to be necessary.

2.4) The Regulations therefore require all licensing authorities in England and Wales to submit certain information about their licensed taxis/PHVs to the database. Licensing authorities are responsible for ensuring that the data which they provide is accurate, legitimate and up to date.

Duty to provide taxi and private hire vehicle information

3.—(1) A licensing authority must provide information to the Secretary of State in accordance with this regulation.

(2) The information to be provided is, in relation to every relevant vehicle in respect of which a licence is granted under one of the licensing provisions by that licensing authority—

(a) the vehicle registration mark of the vehicle;

(b) the date from which the licence has effect;

(c) the date on which the licence is due to expire;

(d) a statement as to whether the vehicle is a taxi or a private hire vehicle;

(e) such other information the licensing authority holds in relation to the vehicle that may be relevant for the purposes of ensuring the accurate identification of vehicles, having had regard to any guidance issued by the Secretary of State.

(3) The licensing authority must provide the information at least as frequently as once a week.

(4) For the purposes of this regulation—

“private hire vehicle” means a vehicle licensed under section 48 of the Local Government (Miscellaneous Provisions) Act 1976 or section 7 of the Private Hire Vehicles (London) Act 1998;

“taxi” means a vehicle licensed under section 6 of the Metropolitan Public Carriage Act 1869 or section 37 of the Town Police Clauses Act 1847;

“vehicle registration mark” means the mark assigned to the vehicle under section 23 of the Vehicle Excise and Registration Act 1994.

Database containing the information provided under regulation 3

4.—(1) The Secretary of State may create a database of the information received under regulation 3, in accordance with this regulation.

(2) An entry in relation to a relevant vehicle in a database under paragraph (1) must include only—

(a) the name of any licensing authorities with which the relevant vehicle is licensed; and

(b) the information provided under regulation 3 in relation to that vehicle.

The data licensing authorities will need to provide

2.5) The following diagram shows the taxi and PHV data upload process whilst the table sets out the eight data fields and the rationale as to why the data is required. The database forms part of the wider digital infrastructure that is being developed to support the introduction of charging CAZs.

Figure 1: Flow diagram showing the process for uploading taxi and PHV data

Table 1: The data we will be collecting and why the data is required

Number	Data field	Description	Rationale
1	VRM	Vehicle Registration Mark	The vehicle registration mark is used as the primary way of matching a vehicle CAZ entry to a taxi or PHV licence and thereby identifying the vehicle as a taxi or PHV.
2	Start	The date a taxi / PHV licence is valid from	Start date is required to identify the validity of the taxi licence at the time of entrance to a CAZ. This will help support the appeals process.
3	End	Expiry date of taxi / PHV licence	End date is required to identify the validity of the taxi licence at the time of entrance to a CAZ. Will also support appeals process
4	Taxi or PHV	A field to denote whether the vehicle is a taxi or private hire vehicle e.g. ‘taxi’ or ‘PHV’	Will allow local authorities to operate local exemptions for taxis and or PHVs when used as private vehicles if they so wish
5	Licensing authority name	The name of the submitting licensing authority	This is required in order to allow a vehicle in the Taxi and PHV Centralised Database to be traced to its originating licensing authority. This will support the appeals process.
6	Licence plate number	The unique reference to the licence number granted (by the Licensing Authority) to a vehicle e.g. PCO 1.	The unique reference to identify a specific licence as granted to a licensed taxi or PHV by a licensing authority. This, along with the VRM will aid identification of a vehicle as part of an appeals process.
7	Wheelchair accessible vehicle (flag)	WAV (Wheelchair Accessible Vehicle)	Although not a legal requirement to capture this information, in practice many licensing authorities do record it as they are encouraged to publish a list of WAVs in accordance with the Equality Act Section 167. Licensing authorities should provide a flag, where possible, to indicate whether a Taxi/PHV is a Wheelchair Accessible Vehicle or not.

Format for transfer of data

2.6) There will be two interfaces for licensing authorities to use when uploading Taxi/PHV data:

• Application Programming Interface (API) – Licensing authorities to integrate directly with the central system and send data asynchronously, as and when a data update is made. We would expect licensing authorities to send the data this way and if they are not able to do so then they should plan how this will be achieved over time. We are aware that a fully integrated API solution is unlikely to be achievable by the end of 2019.

• CSV Upload – A secure area will be provided for the upload of data by licensing authorities. The licensing authority will then authorise themselves (credentials will be provided) to gain access to the secure drop zone and upload their taxi and PHV data.

2.7) A draft technical specification for API and CSV upload is available at Annex A. A final version of the technical specification will be made available later in 2019, ahead of the upload of data by licensing authorities, which is envisaged to start from the end of October 2019.

Frequency of data upload

2.8) The Regulations require data to be sent on a weekly basis as a minimum. Where licensing authorities can provide this on a more frequent basis then they should do so.

2.9) Requests to the API will be limited to 20,000 vehicle details per request. For consumers who wish to supply vehicle data which exceeds this limit, please contact the project team at [email protected] for further information.

Memorandum of Understanding

2.10) A Memorandum of Understanding (MoU) (see template at Annex B) will be needed between Defra (as the data controller) and the licensing authority before any data can be received. Licensing authorities should sign the MoU and return to [email protected] as soon as possible.

Appeals against Penalty Charge Notices

2.11) The appeals process is the responsibility of the local authority operating the charging CAZ and must be managed in line with the Traffic Management Act 2004. Licensing authorities may be approached by the local authority who has issued a Penalty Charge Notice (PCN) in relation to a taxi or PHV they have licensed. For example, to check suspension details.

Suspensions

2.12) Where a taxi or PHV licence is suspended, licensing authorities must ensure that data provided to the database is accurate, legitimate and up to date. This includes removing records of those vehicles which have been suspended or revoked by the licensing authority as soon as is practically possible.

2.13) In the case of appeal of a PCN the onus is on the registered keeper to provide proof of the suspension, using the locally issued ‘suspension notice’.

3. Data governance

3.1) Licensing authorities are responsible for informing those whom they license of the use of their data. It is for authorities to seek their own legal advice to ensure that their procedures comply with data protection requirements including providing fair processing information to individuals at the point that their personal data is collected. Licensing authorities will need to review their policies on this. This could include written communication with existing licence holders and a change in application forms for new applicants.

3.2) Licensing authorities may wish to consider the use of a statement setting out their policy. This statement should cover the following (and any other information that the licensing authority determines is necessary) –

• whether information on licensees is already publically available
• if data subjects have been informed their information will be shared and how this has been done. This could be by placing a statement in the application form or a privacy notice. Further information can be found at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-be-informed/
• a statement noting applicants’ personal data will not be disclosed except in certain circumstances, such as where required by law e.g. in relation to sharing of data to the database
• if applicants have been informed of how their data will be processed as a result of their licence application and ongoing licensing
• date of the last data protection legislation review and when the next review is due

Data management

3.3) In line with the GDPR, Defra will be the Data Controller with responsibility to determine the purpose for which and the manner in which any personal data are, or are to be processed.

3.4) As a minimum the following data management concept must be followed by licensing authorities to ensuring high data quality and comprises five key points:

1. Data quality

a. They must ensure all data collected is completed in a clear and uncontaminated manner.

b. Data collected will be accurate and collected legitimately

2. Privacy, security and compliance

a. Privacy, the requirements of the UK’s data privacy legislation will apply to all aspects of data processing activities completed by them

• They will complete the MoU (see template at Annex B)

• Data will not be transferred outside of the UK

• The Law Enforcement Directive (LED) as identified within the Data Protection Act 2018 will be used for enforcement purposes

• Data retention – data will be retained for a period of seven years, for revenue purposes. Aggregated data may be retained for historic scientific analysis.

• Aggregated data means information which has been collated for monthly reports.

• Historical aggregated data will be retained indefinitely for scientific purposes.

• Data Subject access requests / FOI to be processed by licensing authority records to be sent to Defra

b. Security

• All administration passwords will be changed on installation and unique to the licensing authority

• Passwords will be reset as per industry standards (ISO 27001)

• All CCTV data storage systems will be penetration and vulnerability tested at least annually, using an Architectural Targeted Operating Model approach.

• Anti-virus software will be up to date at all times

• Authorised user levels will be identified and documented

3. Master data Management

a. Licensing authority will document all processes related to the Regulations. Processes will include, training requirements, administration levels as well as certification to cyber essentials as a minimum, DBS checks for staff working on the system

b. Training in data protection will be completed annually for all staff. Training records held by each licensing authority.

c. Audit and review, will be completed annually, audit reports to be sent to the Defra data protection team at [email protected]

4. Data Stewardship

a. Defra Data Protection Officer (DPO), Data Protection Manager (DPM) and the Data Protection Subject Matter Expert (SME) may provide guidance from time to time.

5. Data architecture

a. All new hardware will be updated as per manufacturers requirements

b. Software patches will be no more than one version behind the newest issue

1. The functions under s.88 (1) of the Environment Act 1995 are exercisable by the Welsh Ministers by virtue of Section 2 and Schedule 1 of The National Assembly for Wales (Transfer of Functions) Order 1999. ↩