Oops, says Manchester City Council after thousands of number plates exposed in parking ticket spreadsheet
- Reference: 1620900074
- News link: https://www.theregister.co.uk/2021/05/13/manchester_numberplate_blunder_open_data/
- Source link:
In what appears to be a sincere if misguided attempt to provide public accountability over parking wardens, the council publishes income from parking tickets online in the open data section of its website.
One Register reader, however, spotted a problem: in three of the 20,000-row spreadsheets, published every month between 2018 and early 2021, drivers' number plates were detailed alongside precisely where and when they were hit with parking tickets and which parking warden issued them.
[1]
[2]
[3]
Naughty drivers who picked up parking tickets during April-July 2020 had their identities exposed, thanks to the council forgetting to delete the number plates from the uploaded spreadsheets.
A spokesman for Manchester City Council said: "Data not normally released to the public was in error published to the City Council's website. When made aware of this, steps were taken to swiftly correct this and remove the data."
When The Register politely enquired about the number plate data last week, the council pulled it all offline so quickly that we had to explain to a press officer what happened. Such a speedy reaction generally bodes well.
[4]
The Information Commissioner's Office has previously stated that vehicle registration marks (VRMs, as number plates are formally known) are personal data. In 2019 the agency said, in a decision notice
[5]PDF
on a rejected Freedom of Information Act request: "The Commissioner has previously considered the status of VRMs under the DPA 1998 and decided that where the VRM belongs to a vehicle which is owned by a living individual, the VRM itself will be personal data without associated information being disclosed with it. This is because information identifying the owner of the vehicle is obtainable simply from having access to the VRM."[6]Nine million logs of Brits' road journeys spill onto the internet from password-less number-plate camera dashboard
[7]Manchester, UK seeks IT-slinger: £235m for number-plate-and-fines system to clean up vehicle emissions
[8]ANPR maker Neology sues Newcastle City Council after failing to win 'air quality' snoopcam project bid
It is easy to identify the owner of a car. For a modest fee, you can register yourself as a private parking company with the Driver and Vehicle Licensing Agency and look up anyone's name and address off the DVLA register of vehicle keepers. In theory, doing that would be unlawful but the DVLA has [9]tens of millions of reasons not to look too closely at one of its most highly profitable revenue streams. 637 organisations, ranging from car finance companies to local councils through to man-and-van "private parking solutions" firms, can currently buy names and addresses from the DVLA for £2.50 a pop.
Manchester City Council's spokesman added: "The council is investigating internally as to how this happened and has already changed processes to ensure this does not happen in the future. We are grateful that this was brought to our attention so that this error could be corrected."
During May 2020 alone, the council raked in £377,030 from parking tickets and claimed a further £170,619 had not been paid by motorists. One council operative, identified only as badge number MC1192, issued 5,662 of the council's 14,887 parking tickets for the month, raking in £69,864 with a further £155,266 allegedly outstanding on MC1192's tickets alone by the end of the month. This workrate is the equivalent of 35 tickets issued every working hour of the month, assuming a generous 40-hour working week with no bank holidays or days off. Many of these tickets were issued for driving in a bus lane, but some were also issued for being parked without displaying a ticket. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJ1NIDg2URIFyC2r--BylAAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJ1NIDg2URIFyC2r--BylAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJ1NIDg2URIFyC2r--BylAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJ1NIDg2URIFyC2r--BylAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2614510/fs50787725.pdf
[6] http://www.theregister.com/2020/04/28/anpr_sheffield_council/
[7] http://www.theregister.com/2020/07/07/manchester_seeks_235_million_partner/
[8] http://www.theregister.com/2020/08/17/neology_anpr_bid_fail_lawsuit_newcastle/
[9] https://www.theregister.com/2010/01/20/dvla_data_flog/
[10] https://whitepapers.theregister.com/
Not quite as bad as the US of A though. Where the colo(u)r of your green will allow you to obtain the location of a mobile phone.
You are getting a deal. The NSA tracks the locations of all foreign cell phones free of charge.
It's worse than that for aircraft - anyone can, for free, look up the owner of a UK-registered aircraft from its registration, and there is no mechanism (other than having it owned by e.g. a limited company) for owners to have their details hidden - see https://siteapps.caa.co.uk/g-info/
MC1192
Is that a human or just the number of a mobile unit?
If it's a human, you've got to give them some Kudos. I certainly couldn't write a ticket that quickly and at that frequency.
I certainly couldn't write a ticket that quickly and at that frequency
Yes, especially when you consider that is the average rate.
Re: MC1192
I think it's a 16-pin DIP 4 bit data buffer with enables.
Re: MC1192
Manchester has a lot of fixed bus lane cameras (Mrs Humbug was caught by one when she moved over about ten yards too early in order to turn left at a junction). My guess would be that they are all recorded as MC1192.
I would also guess that some parking areas have automated camera enforcement and 'no ticket displayed' really means 'didn't pay by phone app'.
But this is all just a guess
The Bus lane contraventions are via CCTV. So no superwarden - sorry.
"MC1192" MC=Mobile Camera?
> "MC1192" MC=Mobile Camera?
Or "MC1192", MC = Manchester City, or just plain ManChester?
I have a parking ticket from an Oxford warden, ID OXxxx (numbers removed to preserve anonymity)
I've just looked at some old PCNs I got slapped on my motorbike (while it was parked in the place that an MCC-contracted parking warden told me to park it) and they follow this format, so it's definitely a staff number (though they're not actually employed by the council which obviously means the wardens are on commission = more tickets and the council have a bit of plausible deniability when I take them to court).
Likely 1192 does foot patrols occasionally but is usually reviewing and verifying the CCTV footage prior to issuing PCNs.
Oops, says Manchester City Council
...And that's another reason why government(s) insist that you don't need privacy: It's very humiliating for bureaucrats to have to apologize to the cattle.
Swiss number plates
Many years ago I remember watching a Jeremy Clarkson TV show about driving around the world. He said that in Switzerland the number plate stayed with the owner for life and that you could look up their address in a public database.
And as a result meant there was little road rage or motoring trouble because you could easily go round to the car owner's house to deal with it later.
Not sure if its true or just Clarkson talking out of his arse as usual.
Re: Swiss number plates
Quite a few countries have licenses tied the owners rather than the car.
Re: Swiss number plates
As it should be!
Also, it is the person who should be insured, not the vehicle!
Re: Swiss number plates
"As it should be!"
How do you then deal with an owner of more then one vehicle and the likes of MoT?
Re: Swiss number plates
You wish. How else can someone who owns 2 or more cars and assorted vehicles be robbed... erm, insured for each?
I own 3 cars, 1 caravan, 1 motorbike, 1 trailer an 1 ATV and I have to pay insurance for each and every one.
Re: Swiss number plates
Just have multiple personal plates.
Re: Swiss number plates
Or multiple personalities.
Re: Swiss number plates
And that would help me how?
BTW, the UE masters have decided that it's one license plate - one insurance, regardless if the vehicle in question in road worthy or not. Greedy bastards!
Re: Swiss number plates
Many years ago, I had a car insurance policy that covered me for any vehicle I owned. Not really sure why because I never asked for that type of cover. It became a problem when I tried to tax my car at the post office (it was that long ago). You had to prove the vehicle was insured to get the tax disc, but because my certificate didn't have a vehicle registration number on it, the clerk refused to accept it as proof of insurance. Having the V5 document didn't help either as register keeper and owner were not the same thing.
I came back the next day with my old insurance certificate for a policy I had cancelled early. The expiry date on it was still in the future but the policy didn't exist any more. The clerk didn't know this and accepted it as proof of insurance. So I couldn't do the honest thing with valid documents, but could with invalid ones.
Re: Swiss number plates
"Also, it is the person who should be insured, not the vehicle!"
Until the person parks the car on a public road and gets out. Later the handbrake slips and the car rolls down the hill and causes an accident. That's the reasoning a lawyer once used to explain to me why in the UK, the vehicle must be insured when in a public place, not the person.
Defaulting to penalty charges
I pay £119 for an annual resident's parking permit in London. If the car needs service or repairs I would normally expect to either have a courtesy car or be provided a rental however my local council refuses to permit me to temporarily transfer the parking permit to another vehicle. Instead they demand that I pay another £119 for a "temporary parking permit" valid for only 30 days. Unfortunately it can take at least 14 days for the temporary permit to be issued and you are not permitted to stick a piece of paper with the application number on your car - parking control officers are 'trained' to disregard any notes left on or in cars. So the way it has to work is like this:
Step 1: Apply for a temporary parking permit (TPP)
Step 2: Stick all the parking tickets you collect somewhere safe (this will be at least 2 per day)
Step 3: After 14 days you will receive an email notification that they have issued a TPP
Step 4: Use that email notification to appeal against all the tickets you have accrued.
Mark Steel's In Town - Lynton and Lynmouth
The BBC Radio comedy program 'Mark Steel's in Town' has comedian Mark Steel vest various towns throughout the British isles*. In the last one I heard he visits Lynton and Lynmouth on the north coast of Exmoor. The towns are so so small and close together that everyone knows each other, and they could not get any of the traffic warders to give their friends parking tickets, so have to import them from 20 miles away or no tickets would be issued.
*I use the term "British Isles" to mean the islands off the coast of Brittany, there is no intention on my part to get into the discussion regarding whether the island of Ireland is 'British' or 'Irish' or deal with the current issues of Brexit and goods traversing the Irish Sea, as Mr Steel did a very funny episode from Derry/Londonderry.
Ohh deary me. I can foresee a legal claims lawyer taking this up and requesting the fines are refunded due to the sheer horror and embarrassment caused to these drivers by having their PII released to the public.
If nothing else, the council may drop your case as the costs of defending a data leak will outweigh the £100 fine revenue
Those on the spreadhseets would need to discover that their details had been on view and then to be able to prove it. Why do you think they were taken down so quickly?
I'm fairly sure that even if the spreadsheets were up for fifteen years and were being sold to crims and actively exploited for something, there wouldn't even be a £100 slap on the wrist.
Lookups
There has been an abandoned car parked on my street, no tags, no inspection stickers, nothing but a sticker from what I take to be a New York parking garage. I was interested to find that for $1 one can get the history of a car, given only its vehicle identification number (VIN). I didn't invest, but I did ascertain that the car was not stolen.
Will Manchester United Council be doing the same?
Sorry, had to be done and I don't even like football.
"you can register yourself as a private parking company with the DVLA"
Data protection legislation emerged from the European Convention on Human Rights, which was envisaged primarily to protect individuals from governments in the aftermath of WW II. It's consequently both strange and disquieting that governments seem to be the least affected by the legislation in practice. Quite apart from individual abuses or failures, the legislation as enacted includes blanket exemptions for government activities
I think the fact that any old arsehole can purchase the details of someone's car, and the only verification is the colour of their money and whether they're on companies house is more shocking than the spreadsheet faux pas.