Automatic number plate recognition (ANPR)

CP Plus seeks to ensure, as far as is reasonably practicable, the security, safety and
the efficient operation of its car parks for all customers, staff, visitors and contractors. ANPR
cameras are only deployed after consultation with the client and agreed terms & conditions
established. ANPR offers a very efficient mechanism in the management of private car parks and
accurate enforcement to meet the client’s terms and conditions of parking, along with balancing the
protection of the public with the rights and legitimate expectations of individual privacy.
In order to ensure that this Policy is adhered to, CP Plus is compliant with the Surveillance Camera Commissioner’s Code of Practice.
The car park terms & conditions along with the operation of ANPR will be clearly displayed on
signage throughout each site to inform all users.
Documented period checks are carried out on the sites with ANPR to ensure serviceability and
appropriate signage is in place to inform visitors to the site.
The enforcement process meets the BPA guidelines and offers an independent appeal process.
To offer additional data from the ANPR monitoring and recording the access and egress to the site
may be utilised for the purpose of crime prevention/prosecution and gathering data of occupancy of
car park to establish footfall & key usage data for the client.
All data is securely retained and managed in accordance with Data Protection Act.
This Policy document has been implemented to ensure that the deployment and control of the ANPR
system is lawful under the terms of the Data Protection Act 1998 and the Information
Commissioner’s Codes of Practice and the Surveillance Camera Commissioner’s Code of Practice.
Operations Director, CP Plus Limited: Ian Langdon
Version 1
Reviewed March 2017
ANPR Policy & Standards March 2017 Version 1
CP Plus Automatic Number Plate Recognition (ANPR) Policy
1. Introduction:
This document details the operating policy and standards for the Automatic Number Plate
Recognition (ANPR) system installed at CP Plus & Ranger Services client sites, in accordance with the
requirements of the Data Protection Act 1998 (DPA) and the Code of Practice issued by the
Information Commissioner.
CP Plus Limited is registered on the Data Protection Register which
is held by the Information Commissioner.
2. System Description:
The ANPR systems installed comprises of fixed cameras at the entrance and exits, specifications are
agreed with the client prior to install. Cameras capture an image of the vehicles number plate on
entry and exit of the car park being monitored. These images are used to calculate the fee charged
for parking within the car park/the time spent within the car park. Specific sites may have cameras
working in conjunction (data matching) to the payment machines situated within the car park area.
A digital server may be situated within each site and is managed by Ranger Services who are the
authorised ANPR service provider. Ranger Services’ employees or representatives are only
authorised to access images on the ANPR system.
3. Purpose of the System:
The purpose of the ANPR system is to enable all car park users a quick and easy payment system,
ensure a better parking experience, reduce costs linked to the current payment systems on sites and
to provide statistics on the use of client car parking facilities, to enhance the services and facilities
offered. It will also be used to ensure that the client’s parking Terms & Conditions, in respect of
payment for parking/or maximum stay are adhered to, and will be used as evidence to produce a
Parking Charge Notice (PCN) to those who breach the Terms & Conditions.
3.1 To offer additional security, data generated by the ANPR system may be utilised for the
purpose of crime prevention/prosecution and gathering data of occupancy of car park to
establish footfall & key usage data for the client.
4. Operating Principles
To ensure compliance with DPA, personal data, including images recorded on the ANPR system,
must at all times be processed in line with the following Data Protection Principles:
 Fairly and lawfully processed;
 Processed for limited purpose and not in any manner incompatible with the purpose of the
 Adequate, relevant and not excessive;
 Accurate;
 Not kept for longer than is necessary Processed in accordance with the individuals’ rights;
 Secure.
5. To Whom this Document Applies:
CP Plus, Ranger Services and their employees or agents who operate, or supervise the operation of
the ANPR system.
6. Policy:
6.1 This Policy applies to all sites that are fitted with Ranger ANPR.
6.2 Images of vehicles and or number plates obtained by the ANPR system may only be used in
connection with the purpose set out in Section 3.
6.3 Where there are breaches of car parking regulations [In accordance with Section 3] or in
case of crime and prevention [in accordance with Section 3.1], data may be passed to a 3rd
party to enforce the car parking terms & conditions and associated charges. Any 3rd party
who receives the data will operate in compliance with the Data Protection Act and be
registered with the ICO (Information Commissioners Office).
6.4 The images and records obtained by the ANPR will be treated in accordance with guidance
from the Information Commissioner and the CCTV Code of Practice.
6.5 At all times the operation of the ANPR systems are to be conducted in accordance with the
procedures set out in this document.
6.6 The data Manager is responsible for ensuring that the ANPR system and camera
specifications at the client’s sites comply with the DPA and the CCTV Code.
6.7 Only the approved contractor/internal engineers for Ranger Services may be used to install
or maintain the ANPR systems located at clients sites.
6.8 Changes in the use of the ANPR system may only be implemented in accordance with the
DPA and the CCTV Code. The client & company directors must be consulted before any
changes take place.
7. Operating Standards:
7.1 Processing ANPR Images:
It is imperative that access to, and security of the images is managed in accordance with the
requirements of the DPA and the Data Code. At all times the following standards are to be
7.2 ANPR images are not to be retained for longer than is necessary. Data storage is
automatically managed by the digital server under the control of Ranger Services.
7.3 Provided that there is no legitimate reason for retaining the ANPR images (such as for
processing infringements to parking regulations or use in legal proceedings or crime
prevention/preosecution)) the images will be erased following the expiration of the
retention period of 30 days.
7.4 If ANPR images are retained beyond the retention period [in accordance with 6.3] they are
stored on the secure server, to which access is controlled and a record retained as to why
they have been retained (if not for enforcement purposes).
7.5 A record will be kept of parking history for a period of 2 years in compliance with the BPA
Code of Practice in order to deal with any queries arising from parking charge notice (for
example dealing with any incorrect charges or producing a receipt retrospectively). The
record will consist of registration number, date, time of entry, time of departure and any
payment made. This data retention shall only be used for this purpose and will be destroyed
after 7 years.
8. Quality of Recorded Images:
8.1 Images produced by the recording equipment must be as clear as possible in order that they
are effective for the purpose for which they are intended. The standards to be met under
the data Code are set out below.
8.2 Cameras must only be situated so that they will capture clear images of the registration
plate only. An image of the driver will not be captured. Consideration must be given to the
physical conditions in which the cameras are located i.e. additional lighting or infrared
equipment may need to be installed in poorly lit areas. Cameras must be properly
maintained and serviced to ensure that clear images are recorded and a log of all
maintenance activities kept.
8.3 As far as practical, cameras must be protected from vandalism in order to ensure that they
remain in working order. Methods used may vary from positioning at height to enclosure of
the camera unit with vandal resistant casing.
9. Access to / Disclosure of ANPR Images:
9.1 Request from a Data Subject for Access / Disclosure:
Data Subjects (i.e. persons whose vehicle number plate has been recorded by the ANPR
system) have various rights under the DPA, including the right to be informed that data (i.e.
images of their vehicle number plate) are being recorded and the right to view such images.
Should any person visiting the clients sites have questions concerning the operation of the
ANPR system or their rights with respect to any images of their number plate recorded by
the system, the following procedure must be complied with:
9.2 The Data Subject should be directed to an authorised person at Ranger Services (Data
Manager). It should be noted that images are only retained for a minimum period unless a
breach of client’s car park terms & conditions has been made or there is a reason to retain
the image in the interest of parking enforcement or crime and prevention of crime.
9.3 The Data Manager will liaise with the Client & Company Directors to:
 Determine whether the request should be complied with
 Ensure that the relevant images are located
9.4 Requests from a Third Party for Access / Disclosure:
Unlike Data Subjects, third parties who wish to have access to, or a copy of, ANPR images
(i.e. images not of the person making the request) do not have a right under the DPA to
access, and care must be taken when complying with such requests to ensure that neither
the DPA or the data code are breached. As noted above, requests from third parties will only
be granted if the requestor falls within the following categories:
For the purpose of crime prevention/prosecution and legal representatives of the Data
Subject. The Third Party should be directed to an authorised person (normally the Data
9.5 Any Third Party Request must then be given to the company director to ensure compliance
with the DPA.
The data Manager will liaise with the Directors to:
 Determine whether the request should be complied with
 Ensure that the relevant images are located
9.6 Once the images have been located and the Data Manager and Directors have agreed that a
Third Party Request can be complied with, the Data Manager must provide the Third Party
with a data access request form whom the 3rd Party will submit to Ranger Services.
9.7 If the Third Party has requested to view the images, an invitation to contact the Data
Manager to arrange a viewing of the images during normal working hours is to be arranged.
If the Third Party requests to receive a copy of the relevant images, references to a CD-ROM
ANPR Policy & Standards March 2017 Version 1
being enclosed which contains the relevant images of the Data Subject. This should be
completed in compliance with the data management packs provided.
9.8 If the Data Manager and Directors agree that a Third Party Request cannot be complied with,
the Data Manager must provide the Data Subject with written notice containing the
9.9 The name of the Third Party, the date of receipt of the completed Third Party Request Form,
the reason for refusing to grant access to / supply the images requested (i.e. compliance
with the request would, or would be likely to, prejudice the prevention or detection of
crime, or the apprehension or prosecution of offenders; the images have already been
erased etc.) The name and signature of the Data Manager.
10. Data Management:
Data is retained within the Ranger System for different periods of time based on different scenarios
 ANPR image and movement data where its linked to an enforcement case is
retained for seven (7) years from the date of the contravention
 DVLA data relating to the contravention case is removed six (6) months after the
case has been closed (Paid, Cancelled or Written off )
 ANPR image and movement data where it is not linked to an enforcement case
is retained for 2 years for the purposes of security and crime prevention (our
signage defines that data will be captured and retained for these purposes)
10.1 All incoming data from the following sources is received on an external facing set of
servers, which are secured within a DMZ
 ANPR Cameras
 Permit transactions from Payment terminals
 3rd Party permit / transaction data
10.2 Once data has been checked and verified as being infection free it is pulled from the
quarantine servers into the production server environment
10.3 All data exported externally from Ranger to 3rd parties or the police are encrypted
using a 256-bit key algorithm prior to being transmitted
10.4 Transmissions are carried out via on the following methods based on the client’s
available services
 SFTP ( preferred method )
 Email
11 Data security:
Access to all systems in Ranger Services are secured and require authentication details prior
to access being gained, user access is locked down based on the users role. Authentication
password changes are forced every 90 days, and must meet the following criteria:
 Minimum of 6 characters
 Contain a mixture of uppercase, lowercase alpha numeric characters
 Must contain a non-standard character
11.1 Access to the Server environment is restricted to key IT team members, using
separate user accounts, there are policies in place for the following
 Data access
 Data transmission
 User access
 Data access
 Data retention
12 Disclosure to the Police:
If identified, ANPR footage will be shared with the Police (in accordance with 12.1) to aid
them in the pursuit of an investigation into criminal activity against the premises, personnel
or visitors of the clients’ sites. In all cases the police are to request to view in writing
stipulating the name of the Police Officer and dates & times to be reviewed. Once reviewed
if the Police require a copy then this must be issued in accordance with the data
management pack
12.1 The Company will only make such disclosures on receipt of a Section Data Access
Request Form signed by a Senior Police Officer (inspector or above) and once
satisfied of the following:
 That the purposes are indeed relating to crime
 That failure to release would prejudice the Police investigation
(The directors will have the final decision on the release of data)
13 Monitoring Compliance with the DPA and the CCTV Code:
The ANPR system is monitored 24/7 any defects are highlighted automatically by the system,
remote repairs is the first line of support, if this unsuccessful then engineers are then
dispatched to resolve the defect. Defect trends are highlighted and discussed at monthly
management meetings to look to improve the quality of the service provided and ensure the
systems installed are compliant with the purpose of the scheme and with current legislation.
If the scheme is not achieving its purpose, remedial action must be undertaken to modify
the systems.
14 Complaints Procedure:
Records of all complaints, and any follow up action, will be maintained by the Ranger
Services, in accordance with the companies ISO 9001 2015 Quality Management System.
15 Audits & Management Reviews:
The company carries out annual reviews of all company procedures, policies and standards
at least once a year at the Management Review meeting which is represented at all levels of
the business. Minutes of these meetings are taken and action distributed to relevant
departments. External audits are carried out on the management system annually and any
actions reported to the directors. Should any non-conformities be identified a Non-
Conformity record is produced to document action taken to resolve the non-conformity.