Thousands of EU citizens ‘wrongly fined for breaching Ulez rules’ in potential record data breach

Several EU countries have accused Transport for London (TfL) of using EU drivers as a “cash cow”, illegally obtaining the names and addresses of their citizens

Hundreds of thousands of EU citizens were wrongly fined for driving in London’s Ultra Low Emission Zone (Ulez), amid claims of a record data breach.

Several EU countries have accused Transport for London (TfL) of illegally obtaining the names and addresses of their citizens to issue the penalties, The Guardian reports.

The paper said more than 320,000 fines - some totalling thousands of Euros - have been sent out since 2021.

Michael Freilich, a Belgian MP, said it was “possibly one of the largest data breaches in EU history” and claimed TfL was using EU citizens as a “cash cow”.

The Liberal Democrats have called for an immediate investigation, warning that the issue could damage London’s reputation as being open to tourists.

The UK has, since Brexit, been banned from automatic access to the personal details of EU citizens and transport authorities in Belgium, Spain, Germany and the Netherlands confirmed to the Guardian that driver data cannot be shared with the UK for enforcement of Ulez.

They claimed registered keeper details were obtained illegally by agents acting for TfL’s contractor, Euro Parking Collection.

Some 100 drivers in France have launched a lawsuit claiming their details were obtained fraudulently while lorry drivers in the Netherlands decided to take legal action against TfL over £6.5m of fines they said were issued unlawfully.

Michael Freilich, a Belgian MP, said it was ‘possibly one of the largest data breaches in EU history’ (PA)

Many of the fines were handed out to drivers who visited the capital in Ulez-compliant vehicles and were not aware they had to be registered with TfL’s collections agent -Euro Parking - at least 10 days before their visit.

According to Ulez rules, failure to register does not count as breaking the rules but some drivers still received penalties of up to five-figure sums, including a French driver who was fined £25,000 for an alleged breach of the rules despite his minibus being exempt.

TfL, speaking on behalf of Euro Parking, said: “Any company working on our behalf is contractually required to ensure that data is processed in line with the relevant data protection legislation.

“We work closely with European Parking Collection to ensure all elements of the contract are being adhered to and have mechanisms in place should they not be fulfilled.

“Euro Parking make it clear when they submit requests for keeper data in EU countries that they are acting on behalf of TfL, for enforcement of road-user charging in London, even when they route those requests through a third party. Euro Parking has not been prevented from accessing keeper data for drivers in EU countries.”

Caroline Pidgeon, the Lib Dem London Assembly member party spokesperson for the party, said:  “It is extremely worrying to hear that TfL could be collecting its data from drivers unlawfully.”

“The extent of fines being issued to visitors from the EU, many incorrectly, demonstrates that the rules are not being communicated clearly to tourists, something which I have raised with TfL in the past only to be brushed off. If this issue is not solved urgently, it risks seriously damaging London’s reputation as being open to visitors.”