Facing up to impact of GDPR on transport data collection

In the last issue Rhodri Clark touched on the implications of the new EU General Data Protection Regulations (GDPR) for the transport industry (‘Transport bodies grapple with demanding new data rules’ LTT19 Jan). It is undeniable that data protection impacts on the day-to-day operations of transport data collection companies. 

At Tracsis, data collection and the information generated after detailed analysis is the value added to their clients and end users. Even data that is still gathered using direct manual observation or face–to-face interviews uses a machine interface at some stage to convert the data into a digital format. Most of our work utilises sophisticated digital technology to collect data such as ANPR and video analytics coupled with clever analytics software to produce detailed reports for transport providers, authorities or consultants. 

The investment in these new technologies has resulted in the more accurate, cost effective and faster delivery of projects and the collection of data for any mode of transport including cycling and walking, at any time of day and in any weather condition. 

We are already making use of Artificial Intelligence (AI) to allow the machines to ‘learn on the job’ and improve their effectiveness and efficiency. All this means that data management should be at the core of everything that survey companies do, and if they get the handling of that data wrong it has major consequences for their clients, as well as their own business.

For the past 20 years the UK’s legislation has been based upon the Data Protection Act 1998.  This has served the industry well in the past but the use of algorithms, wireless technology and the speed and volume of data that can be processed has left potential holes in the legislation for the future. GDPR seeks to address the gaps that exist now and in the future.  

GDPR is not only the responsibility of the data controller, who can be either our company or our client but also the data processor, which can include our people out in the field and analysts and project managers back at base. GDPR has meant that we have reviewed all our processes over the last nine months to ensure we are compliant well ahead of the deadline of 25 May 2018. With potential fines of up to 4% of annual turnover, not to mention the reputational impact on our business, we can’t afford to get this wrong.

Our investment has included new data protection senior management roles at our head office in Wetherby and in our London office and staff training in all areas of the business.  Whilst the deadline for compliance is in May, the process for delivering ongoing adherence to the regulations is continuous. For a transport data collection company this means embedding the regulations into our culture, not just our processes. 

Tracsis has adopted an effective tool recommended by the Information Commissioner’s Office to use as part of the process in the form of Privacy Impact Assessments (PIAs). These help a data collection firm identify the most effective way to comply with their data protection obligations and meet individuals’ expectations of privacy. As transport data collection tends to be project-based, the key to success is to complete a PIA early in the life of the project. 

Organisations that are commissioning transport data collection projects should ensure that the data processor (the contractor) is carrying out a risk assessment and has privacy solutions in place before any data is collected. 

The effectiveness of our transport networks relies on good planning based on analysis from accurate data about how people move around our roads, railways and pedestrian areas. The whole transport industry needs to understand the principles and how it effects what they do each day.

Tracsis has made substantial investments in people training, processes and systems, but by engaging early we have probably saved considerable amounts of time and money.