A company operating Automatic Number Plate Recognition (ANPR) in their car parks asked us whether the vehicle registration numbers they were collecting with the equipment amounted to personal data under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018).
The company advised that if their car park regulations were breached, they would take enforcement action against the offenders, using the vehicle registration numbers captured by the ANPR equipment to trace them.
As a first step in finding the individuals responsible, the company had an arrangement with the DVLA which enabled them to access the DVLA records to obtain the registered keeper details of the vehicles concerned.
Under the GDPR personal data is any information that can identify an individual either directly or indirectly. Identifying someone indirectly means combining information you already have with other information available to you or which you obtain from another source.
In this situation, the company operating the ANPR equipment could ascertain who the registered keepers of the vehicles were by accessing the DVLA database.
Therefore, whilst the vehicle registration numbers alone would not amount to personal data, when in the hands of the ANPR company, they would become personal data, as they could match the vehicle registration numbers with the registered keepers by accessing the DVLA records.