Summary of FOI Requests and Communications with Merton Council

Current Status Overview

F21678 (ANPR Scheme) ICO Investigation Pending

(Ref: IC-387135-K8W7)

DPC25-08 (Data Breach) ICO Complaint Submitted

Awaiting Case No.

F21873 (FOI from Breach) Final Chaser Sent

Awaiting Response

F21690 (Surveillance Code) ICO Investigation Pending

(Ref: IC-382963-W2N7)

F21975 (Longthornton Rd) Internal Review Requested

19 June 2025

F22041 (Garfield PS Parking) Acknowledged by Council

Response due ~24 June

This page summarises Freedom of Information (FOI) requests submitted to Merton Council and subsequent communications, based on documents provided up to June 17, 2025. Personal information has been anonymised; "Requestor" refers to the individual submitting the requests/complaints.

1. FOI Request F21678: ANPR Scheme / SW19 Rat Run

Stage: Initial Request

Date: March 17, 2025
Summary: A request was submitted seeking information regarding an ANPR scheme implemented on Pincott Road, High Path, Abbey Road, and Mill Road. Information sought included justification, council communications, contracts, survey data, meeting minutes, and details of legal compliance.

View Anonymised Email Content

Subject: Freedom of Information Request - SW19 Rat Run Traffic Measures
From: Requestor <[Requestor Email]>
To: FOI@Merton.gov.uk
Date: Mon, 17 Mar 2025 13:20:50 +0000

Body:
To whom it may concern,

Under the Freedom of Information Act 2000, I am requesting the following information relating to the traffic measures implemented in connection with the SW19 Rat Run initiative:

1. All communications between Merton Council's Parking Services, local councillors, and residential groups affiliated with or referenced on the sw19ratrun website from January 2022 to present.
2. All communications, contracts, agreements, and correspondence with the providers/suppliers of the ANPR cameras used for this scheme.
3. All data, statistics, traffic surveys, impact assessments, and analytical information used to determine that the implemented solution was the correct approach, including any alternative options that were considered.
4. Minutes, agendas, presentations, and attendance records of any in-person meetings relevant to the SW19 Rat Run traffic measures, including planning meetings, consultation events, and decision-making sessions.
5. Information regarding the legal and procedural requirements that were satisfied to permit the use of ANPR cameras in this area, including any privacy impact assessments, data protection considerations, and authorisations obtained.

If this request is too broad or will exceed the appropriate cost limit, please advise me on how I might narrow it while still obtaining the core information sought.

Please provide the information electronically to [Requestor Email].

Thank you for your assistance with this matter.

Yours faithfully,
Requestor

Stage: Acknowledgement

Date: March 18, 2025
Summary: Merton Council acknowledged receipt of request F21678 and stated its aim to respond within the statutory 20 working day timeframe (by April 14).

View Anonymised Email Content

Subject: Freedom of Information Request F21678
From: [Council Email]
To: "[Requestor Email]" <[Requestor Email]>
Date: Tue, 18 Mar 2025 14:45:37 +0000

Body:
Dear Requestor,

Freedom of Information Act 2000/Environmental Information Regulations 2004 - Information Request
Your reference: F21678

Thank you for your request for information received by us on 17/03/2025.

Your request is being considered and the council aims to provide the information requested within 20 working days, providing that the information is not exempt.

If we cannot provide the information by the 14th of April, we will write to you to explain why before that date. If any of the information you have requested is exempt from disclosure, we will write to you and explain which exemptions under the Freedom of Information Act 2000 apply.

More information about the way we deal with information requests is on our web site at www.merton.gov.uk/foi

If you have any queries or concerns then please contact us at Merton Council, Civic Centre, Morden, SM4 5DX or e-mail [Council Email]

Further information is also available from the Information Commissioner at:
The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Telephone: 0303 123 1113. Website: www.ico.org.uk

Yours sincerely,
Information Governance
Information Team
Merton Council

Stage: Clarification Requested

Date: March 20, 2025
Summary: Merton Council requested clarification regarding the specific roads covered by the term "SW19 Rat Run" used in the request.

View Anonymised Email Content

Subject: Freedom of Information Request F21678 (Clarification required)
From: [Council Email]
To: "[Requestor Email]" <[Requestor Email]>
Date: Thu, 20 Mar 2025 09:45:17 +0000

Body:
Dear Requestor

Thank you for your Freedom of Information Request detailed below

The officer dealing with your request has asked for clarification below:
Could you please go back to the requestee and ask for clarification on the area/roads they refer to as the SW19 Rat Run.

Could you please advise what area or road(s) you would like this information for.

As soon as we receive a response from you, we can continue processing your request.

Yours sincerely
Information Governance
Information Team
Merton Council
[Original Request Quoted]

Stage: Clarification Provided

Date: March 20, 2025
Summary: The Requestor clarified that the roads in question were Pincott Road, High Path, Abbey Road, and Mill Road, also referencing the "Abbey Road Area Neighbourhood team".

View Anonymised Email Content

Subject: Re: Freedom of Information Request F21678 (Clarification required)
From: Requestor <[Requestor Email]>
To: [Council Email]
Date: Thu, 20 Mar 2025 11:23:35 +0000

Body:
Hi,

The roads in question are:
Pincott Road
High Path
Abbey Road
Mill Road

Screenshot showing them on the map attached.

Any correspondence with the council by the residents of this neighbourhood may also be under the name “Abbey Road Area Neighbourhood team” as mentioned in your latest financial report.

Regards
Requestor

On Thu, Mar 20, 2025 at 09:45, [Council Email] wrote:
[Council Clarification Request Quoted]

Stage: Follow-up on Overdue Response

Date: April 14, 2025
Summary: The Requestor contacted Merton Council as the statutory response deadline (April 11) had passed.

View Anonymised Email Content

Subject: Follow-up on FOI Request F21678 - Submitted March 17, 2025
From: Requestor <[Requestor Email]>
To: [Council Email]
Date: Mon, 14 Apr 2025 10:04:17 +0000

Body:
Dear Information Governance Team,

I submitted a Freedom of Information request on March 17, 2025 F21678 regarding traffic measures implemented on Abbey Road.

The statutory response period of 20 working days has now elapsed as of April 11, 2025. I have not yet received a response to my request.

Could you please provide an update on the status of my request and let me know when I can expect to receive a response?

If there are any issues or clarifications needed regarding my request, please do not hesitate to contact me.

Thank you for your attention to this matter.

Yours sincerely,
Requestor

On Friday, 21 March 2025 at 00:29, [Council Email] wrote:
[Council Auto-Reply Quoted]

Stage: Response Delivery Issues & Resolution

Date: April 14-15, 2025
Summary: Merton Council advised that emails containing the response were being rejected by the Requestor's email provider. An alternative email address was provided, and the council agreed to send the response letter and attachments separately, which occurred over multiple emails.

View Anonymised Email Content (Selection)

Subject: RE: Follow-up on FOI Request F21678 - Submitted March 17, 2025
From: [Council Email] <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Mon, 14 Apr 2025 11:20:34 +0000
Body:
Dear Requestor
The response was sent out via email, we have just received a notification advising us that it has not been delivered. We resent it and have received another notification advising the same thing.
Could you please advise whether or not you have received either email.
Many thanks
Information Governance Information Team Merton Council
Delivery has failed to these recipients or groups: [Requestor Email] ([Requestor Email]) Your message wasn't delivered because the recipient's email provider rejected it.
---
Subject: RE: Follow-up on FOI Request F21678 - Submitted March 17, 2025
From: Requestor <[Requestor Email]>
To: [Council Email] <[Council Email]>
Date: Mon, 14 Apr 2025 11:23:56 +0000
Body:
Hi, I have not received it. Can you send it to [Requestor Alt Email] for now. I will take a look at why my email provider is rejecting emails so it doesn't happen again in future. Regards Requestor
---
Subject: RE: Follow-up on FOI Request F21678 - Submitted March 17, 2025
From: [Council Email] <[Council Email]>
To: Requestor <[Requestor Alt Email]>
Date: Tue, 15 Apr 2025 07:17:09 +0000
Body:
Dear Requestor Yes, another response was sent to you at the different email address you provided. I am wondering if because there were quite a few attachments that went with the response it is not getting through? I can send the response email and then the attachments separately to see if that works. Would you be happy with this. Yours sincerely Merton Council Information Governance Information Team Merton Council
---
Subject: Response (1) FOI Request F21678 - Submitted March 17, 2025
From: [Council Email]
To: Requestor <[Requestor Alt Email]>
Date: Tue, 15 Apr 2025 09:41:04 +0000
Body:
Dear Requestor I will send through your response in parts. Please see below the response letter. The attachments will be sent through one by one shortly.
[Response Letter Content Follows...]

Stage: Substantive Response Received

Date: April 15, 2025
Summary: Merton Council provided a response letter and attachments. The response stated that Parking Services held no relevant communications, directed the requestor to public contract details, provided traffic survey spreadsheets, referred to a Cabinet meeting decision (Dec 16, 2024) and meetings with local schools, and gave general assurances on legal compliance, linking to a list of approved camera types.

View Anonymised Response Letter Content

[Contained within email cited above: Subject: Response (1) FOI Request F21678]

Dear Requestor
Freedom of Information Act 2000 / Environmental Information Regulations 2004 Information request
We have now considered your information request as set out below.

You asked:
[Requestor Clarified Request Quoted]
Pincott Road, High Path, Abbey Road, Mill Road... "Abbey Road Area Neighbourhood team"...

1. All communications between Merton Council's Parking Services, local councillors, and residential groups...
Parking Services have no communications with local councillors and resident groups.

2. All communications, contracts, agreements, and correspondence with the providers/suppliers of the ANPR cameras...
Merton Council has a term contract with the provider which allows us to procure ANPR cameras from them. The communications, contracts, agreements, and correspondence with these providers include details on our existing contract, installation, and maintenance of the cameras, which are not specific to any single scheme. Contract details can be found on the public contract finder website. [Link provided]

3. All data, statistics, traffic surveys, impact assessments, and analytical information used to determine that the implemented solution was the correct approach...
Please see attached Excel spreadsheets for traffic data.

4. Minutes, agendas, presentations, and attendance records of any in-person meetings relevant to the SW19 Rat Run traffic measures...
There have been no planning meetings nor consultation events held. The decision to take forward the scheme was taken in the Cabinet meeting on 16 December 2024, with papers for this are available on the Council’s website here [Link provided]. Officers met with both Merton Abbey Primary School and Harris Academy Wimbledon on 5 and 6 March respectively to make them aware of the proposals.

5. Information regarding the legal and procedural requirements that were satisfied to permit the use of ANPR cameras...
The use of ANPR cameras in this area complies with all relevant legal and procedural requirements. This includes conducting privacy impact assessments, considering data protection implications, and obtaining necessary authorisations. These cameras are approved by the Secretary of State, and their certifications are publicly available here [Link provided]. The cameras are configured to point at the enforcement location, and our cameras are equipped with privacy masking to ensure that details not relevant to the case are discarded from the footage during review.

If you have any queries or concerns about this please contact us.
If you are dissatisfied with the handling of your request... you should request an Internal Review...
[Standard Internal Review/ICO Appeal Information]

Yours sincerely
Information Governance
Information Team
Merton Council

Stage: Internal Review Requested (F21678)

Date: April 15, 2025
Summary: The Requestor asked Merton Council to conduct an internal review of its response. Grounds for review included perceived incompleteness regarding scheme justification (claiming Cabinet papers were insufficient), lack of impact assessments or analysis of alternatives, questioning the statement that no relevant communications existed, and the absence of specific legal/procedural documents like a Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA).

View Anonymised Email Content

Subject: Request for Internal Review - Ref: F21678 - SW19 Rat Run ANPR Scheme
From: Requestor <[Requestor Email]>
To: [Council Email]
Date: Tue, 15 Apr 2025 12:34:36 +0000

Body:
Dear Merton Council Information Team,

I am writing to request an internal review of the response I received on 14th/15 April 2025 to my Freedom of Information request dated 17/03/2025, concerning the traffic measures (ANPR scheme) implemented on Pincott Road, High Path, Abbey Road, and Mill Road, sometimes referred to as the "SW19 Rat Run" initiative.

While I acknowledge receipt of the traffic survey data (Excel spreadsheets) and links to general information, I believe the response provided is incomplete and does not fully address several points raised in my original request. I request a review on the following grounds:

1. Inadequate Response regarding Justification (Point 3 of original request):
   My request asked for "All data, statistics, traffic surveys, impact assessments, and analytical information used to determine that the implemented solution was the correct approach, including any alternative options that were considered."
   While traffic survey data was provided, the response did not include any specific impact assessments (e.g., environmental, equality, privacy) or documented analysis of alternative options considered before deciding on the ANPR scheme.
   The response stated the decision was taken at the Cabinet meeting on 16 December 2024 and directed me to the papers available on the Council's website. However, upon reviewing the public report pack for that meeting (Public reports pack 16122024 1915 Cabinet.pdf), it appears not to contain the substantive report recommending and justifying this specific scheme. Item 11 only references a related capital programme financial adjustment.
   Please provide the specific report(s) and any associated appendices presented to the Cabinet (or relevant committee) that contain the justification, data analysis, impact assessments, and consideration of alternatives that led to the decision to implement this ANPR scheme.
   If the decision was made at a meeting other than 16 December 2024, please provide the relevant documentation from that meeting.

2. Inadequate Response regarding Communications (Point 1 of original request):
   My request asked for communications between Merton Council's Parking Services, local councillors, and specific residential groups from January 2022 onwards.
   The response stated, "Parking Services have no communications with local councillors and resident groups." Given the nature of such schemes and the reference in council documents to groups like the "Abbey Road Area Neighbourhood team" (as mentioned in my clarification), this statement seems potentially incomplete.
   Please review whether communications related to this scheme exist between any relevant council department (e.g., Parking Services, Highways, Transport Planning) and local councillors or resident groups (including the Abbey Road Area Neighbourhood team) within the specified timeframe.

3. Inadequate Response regarding Legal/Procedural Requirements (Point 5 of original request):
   My request asked for information regarding the legal and procedural requirements satisfied, including specific assessments and authorisations.
   The response provided general assurances of compliance and links to generic documents (approved camera types list). It did not provide the scheme-specific assessments requested.
   Please provide the specific Privacy Impact Assessment (PIA) and/or Data Protection Impact Assessment (DPIA) conducted for the implementation of this ANPR scheme on these specific roads.

I would appreciate it if you would conduct an internal review of the handling of my request and provide the specific information and documentation detailed above, which was sought in my original request but not fully supplied in the initial response.

Thank you for your time and attention to this matter.

Regards,
Requestor

Stage: Internal Review Decision Received (F21678)

Date: May 16, 2025
Summary: Merton Council (via South London Legal Partnership) provided the outcome of the internal review. Key points:

The request is considered under Environmental Information Regulations (EIR).
Justification/impact assessments for the scheme are part of an *incomplete Cabinet Member report*, expected by June 2025, and currently withheld under EIR Reg 12(4)(d).
*Further searches are being conducted* for communications (beyond Parking Services) with councillors/resident groups; updates to follow.
One email to local councillors (dated March 3, 2025) regarding the scheme was disclosed (redacted).
The Council states it *does not hold scheme-specific* DPIAs for this ANPR scheme but provided a general "DPIA CCTV and ANPR procurement" document from May 2021 (redacted).
The right to complain to the ICO was reiterated.

Some Information Disclosed / Further Actions Pending

View Anonymised Internal Review Cover Email

Subject: Review of Council's response to F21678
From: [Council External Lawyer Name] <[Council External Lawyer Email]>
To: Requestor <[Requestor Email]>
Date: Friday, May 16th, 2025 at 5:21 PM

Dear Requestor,

Further to your request for an internal review please find attached my review decision, and the
 attachments referred to therein, for your attention.

I do not propose to send a hard copy in the post, however, should you require this, please advise
 accordingly.

Regards,

[Council External Lawyer Name]
Lawyer, Procurement and Information Governance
South London Legal Partnership
Merton Civic Centre, London Road, Morden, SM4 5DX

View Anonymised Internal Review Decision Letter

Date: 16 May 2025
My ref: MMP/F21678

Dear Requestor

Internal Review of Freedom of Information Request F21678

I have been asked by the London Borough of Merton ("the Council") to carry out a review of the Council's response to your Freedom of Information request.
On 17 March 2025 you made the following request... [Original FOI request F21678 quoted]...
On 20 March 2025 the Council requested clarification... You responded... [Clarification quoted]...
On 14 April 2025 the Council responded... [Council's initial response to F21678 quoted]...
On 15 April 2025 you requested an internal review... [Internal review request points quoted]...

Review

I have carefully considered this matter and find as follows:

1. Your information request relates to measures and activities affecting or likely to affect the state of the elements of the environment, namely air quality, therefore is environmental information under regulation 2(1)(a) and 2(1)(c) of the Environmental Information Regulations 2000 (EIR).

2. In your request for a review, you noted that the Council's response did not include any specific impact assessments or documented analysis of alternative options. You also correctly pointed out that the public report pack from the Cabinet meeting on 16 December 2024 did not contain these documents. The Council's response should have stated that information within the scope of this part of your information request is currently being completed by way of a Cabinet Member report and it is envisaged it will be published by June 2025.

3. The Council determines that the incomplete Cabinet Member report is exempt from disclosure under Regulation 12(4) (d) EIR. Regulation 12(4)(d) EIR provides that information comprised of material still in the course of completion is exempt.

4. There is public interest in understanding the Council's decision making and holding the Council to account which supports the disclosure of the incomplete Cabinet Member report This public interest is served by the publication on the Council's website of information relating to the Abbey Road LTN so far including:
    - the Council report on the petition to stop rat running on Abbey Road which states" Council is keen to consider some proposals within a future programme, there are no available resources in this financial year's programme; it is not possible to provide a firm timetable at this stage" - Petitions Nov2023.pdf;
    - LTN information website page including a newsletter to residents informing them of the scheme and the statutory consultation - Low traffic neighbourhoods | Merton Council; and
    - the Council's decision to allocate resources to progress the Abbey Road LTN in the Cabinet meeting on 16 December 2024 - Decision - Period 6 Financial Approvals - Merton Council

5. The public interest in allowing the Council to complete reports and only publish complete reports to enable the efficient and effective running of Council business supports maintaining the Regulation 12(4)(d) EIR exemption.

6. Given that the Cabinet Member report is to be completed and published within weeks I am satisfied, having taken into account the presumption of disclosure under Regulation 12(2) EIR, that in all the circumstances the public interest in disclosure is outweighed by the public interest in maintaining the exemption.

7. In your initial request for information, you asked for all communication between Merton Council's Parking Services, local councillors, and residential groups affiliated with or referenced on the sw19ratrun website from January 2022 to present. In your request for a review, this was widened to include communication with any relevant council department (e.g., Parking Services, Highways, Transport Planning) and local councillors or resident groups (including the Abbey Road Area Neighbourhood team). The Council is in the process of conducting further searches in response to your new request and will provide you with any further information within the scope of your request as soon as the searches are complete. The Council will keep you updated on the progress of the searches.

8. Please see attached information located by Parking Services, an email from Merton Council to local councillors regarding the scheme. Information in the email comprised of third-party personal data has been redacted under Regulation 13 EIR.

9. In your request for a review, you requested the Data Protection Impact Assessment for the ANPR scheme stating the information disclosed in the Council's response "did not provide the scheme-specific assessments requested". The Council does not hold scheme-specific assessments. Further to the information disclosed with the Council's response please see attached the CCTV and ANPR DPIA. Information comprised of third-party personal data has been redacted under Regulation 13 EIR.

10. Whilst the information disclosed in the Council's response and attached are not scheme-specific both cover the overall deployment and use of ANPR technology for traffic enforcement purposes including LTNs. All cameras follow similar configuration and testing procedures. Merton Council utilises static enforcement cameras (ANPR) at designated Low Traffic Neighbourhood (LTN) locations. These cameras are configured to activate only when a vehicle enters the enforcement zone, ensuring that footage is captured solely when necessary. The cameras are precisely aligned to focus exclusively on the enforcement point, minimising the capture of irrelevant surroundings. All footage is reviewed by trained operators, who ensure that any imagery not pertinent to the enforcement purpose is redacted in accordance with data protection principles. Images and video footage are made available to motorists online when a Penalty Charge Notice (PCN) is issued. Footage showing the camera angle and its field of view can be made available for viewing at the Merton Council offices upon request.

11. Subject to the results of the further searches set out in paragraph 7 above, I am satisfied that the Council has disclosed all the information held within the scope of your information request and that the Council continues to withhold the incomplete Cabinet Member report until it is complete for publication.

If you are not satisfied with the outcome of the internal review, you may refer the matter to the Information Commissioner.
The Information Commissioner can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Yours faithfully
[Council External Lawyer Name]
for Assistant Director Corporate Governance
E-mail: [Council External Lawyer Email]

View Disclosed "Email to councillors REDACTED.pdf" Content (Sent March 3, 2025)

From: Merton Council (Traffic and Cycling Engineer)
Sent: 03 March 2025 14:44
To: Councillor [REDACTED]; Councillor [REDACTED]; Councillor [REDACTED]
Cc: Councillor [REDACTED];
Subject: Abbey Road Area-Road Closures-Newsletter

Dear Councillors,

As you may be aware, rat running within the Abbey Road area between Merton High Street and Merantun Way has been an ongoing concern for residents with Abbey, Dane and Mill roads being the roads most effected.

This rat running has led to safety concerns for all road users particularly for pedestrians (school children and the elderly) and the relatively high level of traffic has also contributed to significant air and noise pollution.

In 2008 a consultation for a number of options to reduce vehicles was undertaken but at the time the majority of the residents rejected the proposals mainly due to the negative impact it would have on their own journey times.

However, in September 2023 the ongoing concerns were formally raised again with a petition from residents requesting that action is taken to reduce the rat-running. This petition was received at full council (see attached) and an undertaking was given that the Council would consider a scheme to address rat running. Between 29th November and 5th December 2024, a traffic survey was carried out to determine the level of rat running and volume of traffic. The results have confirmed that there is a high level of rat running along Abbey and Mill roads which also adversely impacts both Merantun Way and Merton High Street junctions. A plan showing the total number of vehicles entering and exiting the individual roads is shown in the attached newsletter.

To address these concerns, it has been agreed to implement road closures at the junctions of Pincott Road/High Path and Abbey Road/Station Road (see newsletter). These closures will be non-physical and will be enforced by Automatic Number Plate Recognition Cameras (ANPR).

The proposed measures will be introduced under an Experimental Traffic Order which will be in place for a maximum of 18 months prior to making a final decision; the statutory consultation itself will be last for 6 months.

This will allow the Council to implement the restrictions during the consultation period whilst allowing the Council to monitor and assess the restrictions and its impact. It will also enable residents and other road users to experience the restrictions enabling them to make informed comments during the statutory consultation.

The road closures are scheduled to be introduced on 14th March 2025, and the newsletter will be sent out first class out to residents in the Abbey Road area on 6th March 2025.

The information will be available on the website, which will be updated accordingly on the projects webpage Low traffic neighbourhoods | Merton Council

Please do not hesitate to contact me if you require any further information.

Regards,

Traffic and Cycling Engineer
LONDON BOROUGH OF MERTON

View Disclosed "DPIA CCTV and ANPR procurement REDACTED.pdf" Summary (Dated May 28, 2021)

Data Protection Impact Assessment - London Borough of Merton
Project: CCTV and ANPR maintenance
Date form completed: 28/05/2021

Summary of Key Points:
- This DPIA is for the procurement and maintenance of CCTV and ANPR systems generally, not a scheme-specific DPIA for the Abbey Road LTN.
- It notes a previous ANPR system DPIA was completed in 2014 and states this procurement wouldn't change data processing methods (p.2).
- Mentions ANPR technology is already on the Council's data register and appropriate signs will be installed at enforcement locations (p.4).
- Details security measures: ANPR System is password protected and restricted to authorised users; data hosted on Council servers (p.5).
- Outlines data quality measures: ANPR technology automatically records registration numbers; rejected data is deleted; quality will be monitored daily by the team reviewing evidence (p.9).
- Retention: Public space CCTV footage has a 31-day retention period before being automatically overwritten. Footage saved for police is held for a maximum of two years in a secure video locker on Merton controlled servers with restricted access (p.9).
- States data is not linked with other systems (p.9).
- Data will be retained in line with Council policies for FOI purposes (p.10).
- Video footage is not subject to Open Data requirements; data relating to PCNs issued will be available through existing systems (p.10).

Stage: Data Breach Identified
Date: April 24, 2025
Summary: Unredacted third-party Vehicle Registration Marks (VRMs), along with timestamps and locations, were discovered in multiple Excel spreadsheet files provided as part of the F21678 response. This issue is detailed further under the Data Breach Complaint section below.
Data Breach Identified

Stage: Complaint to ICO (F21678)

Date: May 16, 2025
Summary: Following the internal review decision, the Requestor submitted a complaint to the Information Commissioner's Office regarding Merton Council's handling of request F21678 and its internal review. The complaint challenges the withholding of the justification report under EIR Reg 12(4)(d), the misapplication of the public interest test, the lack of a scheme-specific DPIA, and the overall lack of transparency. It requests ICO intervention to order disclosure and assess the Council's compliance.

View Anonymised ICO Complaint Submission Text

I am dissatisfied with Merton Council's Internal Review decision (ref: MMP/F21678) for several reasons:

1.  Withholding of Justification Report: The Council continues to withhold the Cabinet Member report containing the justification, impact assessments, and analysis of alternatives for the ANPR scheme under EIR Regulation 12(4)(d) (material in course of completion). I disagree with their application of the public interest test. Given the scheme's apparent implementation in March 2025 and significant public impact, the public interest in immediate disclosure of the scheme's basis outweighs the Council's stated interest in delaying publication until June 2025. This lack of timely transparency on a decision affecting thousands is unacceptable.

2.  Lack of Scheme-Specific DPIA: The Council states it does not hold a scheme-specific Data Protection Impact Assessment (DPIA) for this ANPR deployment, instead providing a generic 2021 procurement DPIA. This is inadequate. A scheme-specific DPIA is crucial for assessing and mitigating data protection risks for this particular high-risk processing, as per UK GDPR Article 35. The absence of such a document, or failure to disclose it if it exists, means there is no transparency on how data protection risks specific to this scheme were considered and addressed.

3.  Overall Lack of Transparency: The combination of withholding the core justification document and the absence of a relevant scheme-specific DPIA means it remains unclear who at the Council decided to implement this scheme and on what evidential basis. This undermines public trust and accountability.

I accept the disclosure of the (redacted) email to councillors and the (redacted) general 2021 DPIA as partial responses, but they do not address the core information requested about this specific scheme's justification and detailed data protection assessment. I am happy for any personal data of junior officials or private individuals to be redacted from disclosed documents.

Stage: ICO Complaint Accepted (F21678)

Date: June 9, 2025
Summary: The Information Commissioner's Office acknowledged the complaint regarding F21678 (Council ref: MMP/F21678). The ICO confirmed the complaint is eligible for investigation and assigned it case reference IC-387135-K8W7. The case will be allocated to a case officer for investigation. (Note: The original ICO letter contained a typo, referencing "Sefton Council", but the case reference and Council reference confirm it relates to Merton Council).
Complaint accepted by ICO (Ref: IC-387135-K8W7)

View Anonymised Email & Letter Content

--- Email ---
Subject: Case Reference: IC-387135-K8W7
From: [ICO Email]
To: Requestor
Date: 9 June 2025

Body:
Dear Requestor

Thank you for your complaint about Merton Council. Please see the attached letter for our response.

Yours sincerely,

[Lead Case Officer Name]
Lead Case Officer
Information Commissioner's Office

--- Attached Letter ---
ICO Logo
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel. 0303 123 1113 ico.org.uk

Case Reference: IC-387135-K8W7
PA's Reference: MMP/F21678
Environmental Information Regulations 2004 (EIR)
Information request to: Merton Council

9 June 2025

Dear Requestor,

Thank you for your complaint and supporting information about the above public authority's handling of your request for information.

Your complaint is now eligible for investigation. We will allocate it to a case officer as soon as we can. The focus of their investigation will be to determine whether the public authority handled your request in accordance with the legislation.

If you wish to send us any further information or comments in the meantime, please quote the reference number at the top of this correspondence.

Once a case officer is assigned and has concluded their investigation, they will inform you of their decision.

Incoming emails are monitored, but detailed enquiries relating to the case can only be addressed once your case is allocated for investigation.

For more general enquiries, please call our helpline on 0303 123 1113 or visit our live chat.

Sent on behalf of
[Group Manager Name]
Group Manager
Information Commissioner's Office

Overall Status (F21678)
Complaint accepted by ICO (Ref: IC-387135-K8W7). Awaiting allocation to case officer.
Internal Review outcome received; some info disclosed, justification report withheld (due June 2025), further searches for communications ongoing.

2. Data Breach Complaint (DPC25-08 - previously DPC25-07) & Linked FOI (F21873)

Stage: Breach Notification Sent

Date: April 24, 2025
Summary: The Requestor formally notified Merton Council's FOI and Data Protection teams about the data breach (disclosure of unredacted VRMs) identified in the F21678 response. Concerns were raised regarding compliance with UK GDPR/DPA 2018 principles (Lawfulness, Confidentiality, Storage Limitation, Transparency) and the incorrect application of FOIA Section 40(2). Specific actions were requested, including formal acknowledgement, provision of the scheme's DPIA, data retention policy details, evidence of how road users were notified, details of the internal investigation, assurances regarding preventative measures, confirmation of how the disclosed data was handled post-release, and information on whether the data was disclosed elsewhere.

View Anonymised Email Content (Sent to Council FOI & DP)

Subject: Urgent: Data Breach Notification - Improper Disclosure of Personal Data in FOI Response F21678
From: Requestor <[Requestor Email]>
To: [Council Email]; [Council Email]
Date: Thu, 24 Apr 2025 15:33:00 +0000 / 15:38:51 +0000

Body:
Dear Merton Council Information Governance Team / Data Protection Officer,

I am writing with serious concern regarding the response I received on or around 14th/15th April 2025 to my Freedom of Information request dated 17th March 2025 (Ref: F21678), concerning the ANPR scheme on Pincott Road, High Path, Abbey Road, and Mill Road.

While processing the information provided, I discovered that the following documents, supplied as part of the FOI response, contain extensive lists of unredacted third-party Vehicle Registration Marks (VRMs) alongside corresponding timestamps and locations:
[List of 7 .xlsx files]

The disclosure of this raw ANPR data across multiple files constitutes a significant data breach under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Key Concerns:
- Disclosure of Personal Data: VRMs linked with time/location are personal data. Disclosure unlawful under Art 5(1)(a) & 5(1)(f) UK GDPR.
- Incorrect Application of FOIA: Section 40(2) exemption should have been applied. Raw VRMs shouldn't have been disclosed (unlike aggregated data).
- Contradiction with Council Statements: Response claimed compliance including data protection considerations. Disclosure contradicts this.
- Storage Limitation Concerns: Disclosure of Dec 2024 data in Apr 2025 raises questions about Art 5(1)(e) UK GDPR compliance.
- Transparency Concerns: Principle requires individuals to be informed about data collection.

This incident represents a failure to adequately protect the personal data of numerous individuals...

Action Requested:
I request that the Council:
1. Formally acknowledge this data breach notification.
2. Provide the specific Data Protection Impact Assessment (DPIA) conducted for this ANPR scheme, as mentioned but not supplied in the original FOI response.
3. Provide the relevant documentation (e.g., data retention schedule or policy extract) that specifies the defined retention period for the raw ANPR data collected for this specific scheme/survey and justifies this period in line with the storage limitation principle.
4. Provide evidence of how road users were notified about this ANPR survey/trial during its operation (late Nov/early Dec 2024), in line with the transparency requirements of UK GDPR (e.g., copies or photos of signage used, links to relevant online privacy notices active during the survey period).
5. Confirm the steps being taken internally to investigate this incident, including why the data was retained in an identifiable format and subsequently disclosed.
6. Provide assurance regarding the measures being implemented to prevent any recurrence of such improper data disclosures in future FOI responses.
7. Confirm how the inappropriately disclosed data within the specific files listed above has been handled subsequent to its release to me.
8. Advise whether these specific files containing unredacted VRMs were disclosed to any other individual or organisation (e.g., via other FOI requests or data sharing arrangements).

Given the serious nature of this data protection failure, I expect a prompt investigation and response. I reserve the right to report this matter to the Information Commissioner's Office (ICO).

Yours sincerely,
Requestor
(Relevant Legislation Links for Reference: UK GDPR Art 5, FOIA s.40)

Stage: Council Acknowledgement (DPC25-07, later DPC25-08) & FOI Logging (F21873)

Date: April 24, 2025
Summary: Merton Council's Acting Data Protection Officer acknowledged the breach notification, logging it as Data Protection Complaint DPC25-07 (later amended to DPC25-08) and initiating an urgent review. The DPO noted that while the issue required resolution, their initial assessment was that it did not meet the threshold for mandatory reporting by the Council to the ICO, but acknowledged the Requestor's right to report it independently. The Council confirmed it would investigate points 1, 5, 6, 7, and 8 raised in the notification as part of the DPC complaint. Points 2, 3, and 4 (requesting the DPIA, retention schedule, and notification evidence) were separated and forwarded to the FOI team to be logged as a new FOI request (F21873).

View Anonymised Email Content

Subject: Your Data Protection Complaint DPC25-07
From: Data Protection <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Thu, 24 Apr 2025 16:51

Body:
Dear Requestor

Thank you for your email. I am writing to acknowledge this and to advise you we are reviewing it with urgency.

I will write to you with further information regarding the action we are taking as soon as possible. Please note that my initial assessment as the Council's Acting Data Protection Officer, in line with the timescales of the ICO (72 hours), while there is clearly an issue to be resolved here, this matter does meet the threshold for the Council to report it to the ICO.

This does not affect your right to refer the matter to them, but please be advised they are unlikely to accept a complaint until I have furnished you with the outcome of my investigation.

This response addresses points one, five, six, seven and eight of your section “Action Requested” and, as above, the alleged breach will be investigated by me as a Data Protection Complaint (ref DPC25-07). All other points in the “Action Requested” constitute a fresh Freedom of Information Request and I have forwarded it to my team at the FOI inbox to log it as such, these questions will not be answered as part of my investigation into the alleged breach.

I hope this assures you that the Council takes its responsibilities under the Data Protection Act 2018 seriously. I will aim to respond to you complaint in full within one calendar month. Your FOI request will be responded to within 20 working days.

If you are dissatisfied with our management of your concern, then I reiterate that your statutory rights to refer the matter to the ICO via their website at www.ico.org.uk is not affected.

Yours sincerely,
Merton Council (Information Governance & Records Manager)
Corporate Services
Merton Council
Tel: [Council Phone Number]
www.merton.gov.uk

Stage: FOI Acknowledgement (F21873)

Date: April 28, 2025
Summary: Merton Council sent a formal acknowledgement for the new FOI request, F21873 (containing points 2, 3, 4 from the data breach notification). A response was due within 20 working days (approx. May 23).

View Anonymised Email Content

Subject: FOI Request F21873
From: [Council Email]
To: "[Requestor Email]" <[Requestor Email]>
Date: Mon, 28 Apr 2025 09:37:26 +0000

Body:
Dear Requestor

Thank you for your Freedom of Information request.

Please find attached an acknowledgement letter for this request.

Yours sincerely
Information Team - Information Governance
Corporate Services
Merton Council

From: Requestor <[Requestor Email]>
Sent: 24 April 2025 16:33
To: [Council Email]
Subject: Urgent: Data Breach Notification - Improper Disclosure of Personal Data in FOI Response F21678
[Requestor Data Breach Notification Email Quoted]

Stage: Follow-up on Overdue FOI F21873

Date: May 27, 2025
Summary: The Requestor sent an email to Merton Council following up on the overdue response for FOI F21873 (originally due ~May 23).

View Anonymised Email Content

Subject: Overdue Response to Freedom of Information Request F21873 - Data Protection Matters
From: Requestor <[Requestor Email]>
To: foi@merton.gov.uk
Date: May 27, 2025

Dear Merton Council Information Governance Team,

I am writing to follow up on my Freedom of Information request, reference F21873.

This request was formally acknowledged by the Council on April 28, 2025, following its creation from points raised in my data breach notification email dated April 24, 2025 (specifically points 2, 3, and 4 regarding the scheme-specific DPIA, data retention schedule, and evidence of road user notification for the ANPR scheme related to FOI F21678).

The statutory 20 working day period for a response to F21873 has now elapsed (the response was due on or around May 23, 2025). To date, I have not received a substantive response to this request.

Could you please provide an urgent update on the status of my request F21873 and indicate when I can expect to receive the information?

If there are any issues causing this delay, please let me know.

Thank you for your attention to this matter.

Yours sincerely,
Requestor
[Requestor Email]

Stage: Council Apology for Delay (F21873)

Date: May 27, 2025
Summary: Following the chaser email sent on May 27, 2025, Merton Council's Information Governance Officer responded on the same day, apologising on behalf of the service for the delay in responding to FOI F21873. They stated that reminders were being sent to the responsible team, that chase emails would continue from the IG team, and that senior management would be made aware the request was outstanding. A substantive response remained pending.
Response Still Overdue

View Anonymised Email Content

Subject: RE: Overdue Response to Freedom of Information Request F21873 - Data Protection Matters
From: [Information Governance Officer Name] <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Tue, 27 May 2025

Dear Requestor,

Thank you for your email. Please allow me to apologise on behalf of the service for the delay in responding. A reminder has been sent to the team responsible
 for providing the response, reminding them that it is now overdue. Reminders and chase emails will continue to be sent from the IG team until a response is provided.

In addition senior management will be made aware that the request is still outstanding.

Kind regards

[Information Governance Officer Name]

[Information Governance Officer Name]
Information Governance Officer
Information Governance Team
Merton Council
www.merton.gov.uk

Stage: Final Chaser Sent (F21873)

Date: June 17, 2025
Summary: After receiving no substantive response following the apology, a final chaser email was sent to the council. The email outlined the timeline of the overdue request and stated an intention to escalate the matter to the ICO if a response was not received within seven working days.

View Anonymised Email Content

Subject: Final Notice Regarding Overdue Freedom of Information Request F21873
From: Requestor <[Requestor Email]>
To: foi@merton.gov.uk
Date: Tue, 17 Jun 2025

Dear Merton Council Information Governance Team,

I am writing again to request an urgent resolution to my Freedom of Information request, reference F21873, which is now significantly overdue.

To recap the timeline:
* My request was formally acknowledged on April 28, 2025, with a statutory deadline for a response on or around May 23, 2025.
* After the deadline passed, I sent a chaser email on May 27, 2025.
* In response on the same day, your team apologised for the delay and gave assurances that the responsible team was being reminded of their overdue obligation and that senior management would be made aware.

It has now been a further three weeks since that assurance was given, and I have still not received a substantive response. This constitutes a clear breach of your obligations under Section 10 of the Freedom of Information Act 2000.

Please consider this email as a final request for the information. If I do not receive a full, substantive response to my request within the next seven working days (by June 26, 2025), I will be escalating this matter to the Information Commissioner's Office (ICO) for their intervention without further notice.

I trust this will not be necessary and look forward to receiving the requested information promptly.

Yours sincerely,
Requestor

Stage: Council Response to Data Protection Complaint (DPC25-08)

Date: May 23, 2025
Summary: Merton Council responded to the data protection complaint (now ref DPC25-08). Key points:

The Council acknowledged the disclosure of unredacted VRMs.
Their investigation concluded that names/addresses cannot be found from VRMs using publicly available tools.
They stated the disclosure *may be lawful* and not exempt under FOIA s.40.
**The Council did not uphold the data breach complaint.**
As a preventative measure, such data will not be disclosed in similar future FOI responses and will be subject to dual scrutiny.
The Council will redact the information from the F21678 response before public scheme publication.
They confirmed the specific files were not disclosed to others.
The Council requested the Requestor destroy the disclosed unredacted data and confirm this action.

Complaint Not Upheld by Council

View Anonymised Email Content

Subject: Your Data Protection Complaint DPC25-08
From: data.protection@merton.gov.uk <[Council Email]>
To: Requestor <[Requestor Email]>
Cc: data.protection@merton.gov.uk <[Council Email]>
Date: Friday, 23 May 2025 at 08:46

Dear Requestor

Thank you for your email dated 24 April 2025 in which you told us of your concerns regarding third-party Vehicle Registration Marks (VRMs) alongside corresponding timestamps and locations included in the Council's response to your Freedom of Information Request Ref: F21678. Please note the amended reference number of your complaint from DPC25-07 to DPC25-08. This has been reallocated for our own internal administrative purposes.

In my email to you dated 24 April 2025 (below) I confirmed that this response would address points one, five, six, seven and eight of your section "Action Requested". All other points in the "Action Requested" have been logged as a fresh Freedom of Information Request and will be responded to as such. These questions will not be answered as part of my investigation into the alleged breach and this response.

Point 1: - Formally acknowledge this data breach notification.
Your notification of an alleged data breach was acknowledged via email 24 April 2025.

Point 5: Confirm the steps being taken internally to investigate this incident, including why the data was retained in an identifiable format and subsequently disclosed.
The investigation was carried out by reviewing the response to your FOI request and the process by which it was produced with the FOI team and Parking Services. These services have confirmed that unredacted documents were sent to you as part of the response. Parking Services hold this information in identifiable format for the purposes of their business and duties. The information is limited to VRMs and times and dates with other Personal Identifiable Data disclosed. My investigation has concluded that further names and addresses from VRMs cannot be found using any publicly available tools. While this data could be considered indirectly to be Personal Identifiable Info for the purposes of DPA2018, when combined with other pieces of PID, such disclosure of this data may be lawful and not exempt under Section 40 of the FOIA2000. On these grounds, I am unable uphold your complaint about a data breach.

Point 6: Provide assurance regarding the measures being implemented to prevent any recurrence of such improper data disclosures in future FOI responses.
Having reviewed the matter, going forward in the response to any similar FOI request such data will not be disclosed. This will be monitored by both Parking Services, and the Information Governance Team to ensure there is more than one level of scrutiny.

Point 7: Confirm how the inappropriately disclosed data within the specific files listed above has been handled subsequent to its release to me.
This date is recorded internally based on the evidence collected by ANPRs which are passed to the council. The council holds this information in a secure site, with access limited solely to staff who process the LTNs. In this instance the information has been made available to the Information Governance Team exclusively as part of the response to your Freedom of Information Request. The Information Governance Team hold records of FOI requests for three years, although once responses are in the public domain via the Council's publication scheme there is no fixed legislative time period for which that must remain public, provided that the information is still relevant and up to date. In this instance the Council will redact this information from the response prior to publication rendering this point moot.

Point 8: Advise whether these specific files containing unredacted VRMs were disclosed to any other individual or organisation (e.g., via other FOI requests or data sharing arrangements).
I can confirm that these specific files containing unredacted VRMs have not been disclosed to any other individual or organisation via other FOI requests or data sharing arrangements. As above, when the response is published via the Council's publication scheme, redacted versions of these documents will be available on request.

In view of this, under the Data Protection Act 2018 I consider that you are not entitled to retain the VRMs and additional personal identifiable information as defined above, and I am obliged to request that you destroy this, confirm that you have done so, and that you have not shared this information with any third parties, or made it public via any other platform. I will be grateful for your confirmation of this in due course.

I hope that this response assures you that the council takes its obligations under the DPA2018 and FOIA2000 seriously, and that your complaint has been robustly investigated and that suitable corrective measures have been deployed. As above all other points in your email dated 24 April 2025 have been logged and will be responded to as a separate FOI.

While this may also not be the response that you desired, the response does not affect your statutory right to refer the matter to the Information Commissioner's Office as you have indicated is your intention. You can do this via their website www.ico.org.uk, and the Council is happy for you to furnish the ICO with a copy of this email. Should the ICO contact my office regarding the matter, I shall be happy to respond to them as appropriate.

Yours sincerely
Merton Council (Information Governance & Records Manager)
Corporate Services
Merton Council

Stage: Complaint to ICO (DPC25-08)

Date: May 24, 2025
Summary: Following Merton Council's decision not to uphold the data breach complaint (DPC25-08), the Requestor submitted a formal complaint to the Information Commissioner's Office. The complaint challenges the Council's interpretation of personal data in the context of VRMs, the lawfulness of the original disclosure, their refusal to acknowledge a data breach despite implementing corrective measures, and their overall handling of the incident. The Requestor asks the ICO to determine if a breach occurred and if the Council's response was adequate, and to recommend appropriate actions.

View Anonymised Text Submitted to ICO (Summary of Arguments)

Short Summary to ICO:
Merton Council disclosed unredacted third-party Vehicle Registration Marks (VRMs) with associated times and locations in response to my FOI request F21678. I reported this as a data breach (their ref: DPC25-08). On 23/05/2025, the Council responded,
stating they did not uphold my data breach complaint. They argued that names/addresses cannot be found from VRMs using public tools and that disclosure may have been lawful/not exempt under FOIA s.40. This contradicts data protection principles for personal data and their own actions to redact such data in future and requesting I destroy it. I am complaining about their failure to uphold the breach and their flawed justification.

Additional Relevant Information to ICO:
Merton Council's DPC25-08 response is contradictory: they do not uphold the breach yet admit they will redact such data in future and request I destroy it. Their interpretation of VRMs (with time/location) not being definitively personal data if the recipient cannot immediately identify individuals is flawed and contrary to UK GDPR and ICO guidance. The data disclosed relates to potentially thousands of vehicle movements. This complaint (DPC25-08) is linked to my FOI F21678 (about the ANPR scheme itself), for which a separate complaint has also been submitted to the ICO regarding withheld information. The council's reference for the related ICO case regarding FOI F21690 (same ANPR scheme) is IC-382963-W2N7.

Overall Status (DPC25-08 & F21873)
Data Protection Complaint DPC25-08 submitted to ICO. Awaiting ICO acknowledgement/case ref. (Council had previously not upheld the complaint).
FOI F21873 response overdue. Final chaser sent (June 17, 2025); awaiting response.

3. FOI Request F21690: ANPR Compliance with Surveillance Camera Code

Stage: Initial Request

Date: March 21, 2025
Summary: A request was submitted seeking specific documentation relating to the Abbey Road ANPR system's compliance with the Surveillance Camera Code of Practice, issued under the Protection of Freedoms Act 2012 (POFA 2012). Information sought included the operational requirement, Privacy Impact Assessment (PIA), evidence of public notification, data handling policies, system reviews, and the justification for using ANPR surveillance.

View Anonymised Email Content

Subject: Freedom of Information Request - ANPR Camera Compliance with Surveillance Camera Code of Practice
From: Requestor <[Requestor Email]>
To: [Council Email]
Date: Fri, 21 Mar 2025 00:28:53 +0000

Body:
Dear Merton Council,

Under the Freedom of Information Act 2000, I am requesting information regarding the Automatic Number Plate Recognition (ANPR) cameras recently implemented in the Abbey Road Area, specifically in relation to compliance with the Surveillance Camera Code of Practice as required under Section 33(5) of the Protection of Freedoms Act 2012.

With reference to this Code of Practice, please provide the following information:
1. Please provide a copy of the operational requirement document...
2. Please provide the privacy impact assessment conducted prior to implementation...
3. Please provide evidence of public notification and engagement...
4. Who is the single point of contact nominated to oversee all surveillance systems...
5. Please provide copies of the council meeting minutes where this ANPR implementation was discussed...
6. What technical standards does the ANPR system meet, and has certification... been considered...
7. When was the most recent review of this ANPR system conducted...
8. Please provide the council's policy regarding the criteria used to determine when and whether a vehicle should be included in the ANPR reference database...
9. Please provide the council's policy on how long ANPR information remains in the reference database...
10. Please provide evidence of the council's compliance self-assessment against the 12 guiding principles...
11. What pressing need and legal justification was identified for the use of ANPR surveillance...

If you require any clarification regarding this request, please don't hesitate to contact me.
I look forward to your response within the statutory 20 working days.

Yours faithfully,
Requestor

Stage: Acknowledgement

Date: March 21, 2025
Summary: Merton Council acknowledged receipt of request F21690 and stated its aim to respond within 20 working days (by April 22).

View Anonymised Email Content

Subject: Freedom of Information Request F21690
From: [Council Email]
To: "[Requestor Email]" <[Requestor Email]>
Date: Fri, 21 Mar 2025 08:34:35 +0000

Body:
Dear Requestor,

Freedom of Information Act 2000/Environmental Information Regulations 2004 - Information Request
Your reference: F21690

Thank you for your request for information received by us on 21/03/2025.

Your request is being considered and the council aims to provide the information requested within 20 working days, providing that the information is not exempt.

If we cannot provide the information by the 22nd of April, we will write to you to explain why before that date. If any of the information you have requested is exempt from disclosure, we will write to you and explain which exemptions under the Freedom of Information Act 2000 apply.

More information about the way we deal with information requests is on our web site at www.merton.gov.uk/foi

If you have any queries or concerns then please contact us at Merton Council, Civic Centre, Morden, SM4 5DX or e-mail [Council Email]

Further information is also available from the Information Commissioner at:
The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Telephone: 0303 123 1113. Website: www.ico.org.uk

Yours sincerely,
Information Governance
Information Team
Merton Council

Stage: Substantive Response Received

Date: April 17, 2025
Summary: Merton Council responded, stating that the Surveillance Camera Code of Practice did not apply to the ANPR cameras in question. The reason given was that the cameras are type-approved for traffic enforcement under the Road Traffic Offenders Act 1988 (RTOA 1988), are used exclusively for that purpose, and allegedly have "no capability" for other surveillance functions.

View Anonymised Email Content

Dear Requestor,
Freedom of Information Act 2000 / Environmental Information Regulations 2004 Information request
We have now considered your information request as set out below.
You asked:
Under the Freedom of Information Act 2000, I am requesting information regarding the Automatic Number Plate Recognition (ANPR) cameras recently implemented in the Abbey Road Area, specifically in relation to compliance
with the Surveillance Camera Code of Practice as required under Section 33(5) of the Protection of Freedoms Act 2012.
With reference to this Code of Practice, please provide the following information:

1. Please provide a copy of the operational requirement document completed for the Abbey Road ANPR system, which identifies and specifies the desired capabilities of the system as outlined on page 3 of the Code.
2. Please provide the privacy impact assessment conducted prior to implementation of the ANPR system, as required by Principle 2 on page 5 of the Code.
3. Please provide evidence of public notification and engagement regarding this surveillance system, including details of signage and consultation undertaken as required by Principle 3 on page 5 of the Code.
4. Who is the single point of contact nominated to oversee all surveillance systems in the local authority, including this ANPR system, as recommended on page 4 of the Code?
5. Please provide copies of the council meeting minutes where this ANPR implementation was discussed and approved, as implied by the governance requirements in Principle 4 on page 6.
6. What technical standards does the ANPR system meet, and has certification against the surveillance camera code of practice been considered, as outlined in Principle 8 on page 7?
7. When was the most recent review of this ANPR system conducted (as per Principle 10's requirement for at least annual reviews) and what were the findings?
8. Please provide the council's policy regarding the criteria used to determine when and whether a vehicle should be included in the ANPR reference database, as required by Principle 12 on page 9.
9. Please provide the council's policy on how long ANPR information remains in the reference database, as required by Principle 12 on page 9.
10. Please provide evidence of the council's compliance self-assessment against the 12 guiding principles as mentioned on page 4 of the Code.
11. What pressing need and legal justification was identified for the use of ANPR surveillance in the Abbey Road Area, given that the Code specifies on page 3 that "blanket licensing policies... are not acceptable and there must be a pressing need and legal justification for the use of surveillance"?

If you require any clarification regarding this request, please don't hesitate to contact me.

Our response:
Regarding compliance with the Surveillance Camera Code of Practice as required under Section 33, traffic enforcement cameras are excluded from any camera system with relevant type
approval of a prescribed device, under Section 20 of the Road Traffic Offenders Act 1988. These cameras are used exclusively for enforcement purposes, capturing and retaining an image only when the relevant offence is detected, with no capability to be used
for any surveillance purpose.
If you have any queries or concerns about this please contact us.
If you are dissatisfied with the handling of your request or wish to appeal against the decision to exempt any
part of your request, you should request an Internal Review at foi@merton.gov.uk or write in to Freedom of Information team, Merton Council, Civic Centre, Morden, SM4 5DX.
If you escalate to the Information Commissioners Office (ICO) without following the council’s internal review
process, the ICO will refer you back to the council to enable the correct process to be followed.
You can also appeal to the Information Commissioner at:https://ico.org.uk/make-a-complaint/official-information-concerns-report/official-information-concern/
There is no charge for making an appeal.
Yours sincerely
Parking Services
(Head of Service: Merton Council)
Environment, Civic Pride & Climate
London Borough of Merton
www.merton.gov.uk/parking

Stage: Internal Review Requested (IR575)

Date: April 17, 2025
Summary: The Requestor asked Merton Council for an internal review (Ref IR575) of its decision, challenging the interpretation that RTOA 1988 approval negates the applicability of the POFA 2012 Code. Arguments included that ANPR technology is inherently surveillance, the claim of "no capability" needed justification, the principles of the Code should still be considered, and transparency regarding justification (e.g., via a PIA) was lacking. The review requested a reassessment of the Code's applicability and the provision of the requested information or specific, justified exemptions.

View Anonymised Email Content

Subject: Request for Internal Review - Freedom of Information Act 2000 / Environmental Information Regulations 2004 - Information Request Regarding ANPR Cameras in Abbey Road Area (Ref: [F21690])
From: Requestor <[Requestor Email]>
To: [Council Email]
Date: Thu, 17 Apr 2025 12:54:39 +0000

Body:
Dear Sir/Madam,

I am writing to formally request an Internal Review of the decision provided by Merton Council's Parking Services (Head of Service: Merton Council) dated 17/04/2025. This decision was in response to my information request submitted under the Freedom of Information Act 2000 (FOIA 2000) and potentially the Environmental Information Regulations 2004 (EIR 2004) on 21/03/2025.

My original request sought specific information regarding the Automatic Number Plate Recognition (ANPR) cameras recently implemented in the Abbey Road area. I specifically asked for documentation demonstrating compliance with the Surveillance Camera Code of Practice ('the Code'), which is issued under the Protection of Freedoms Act 2012 ('POFA 2012').

Summary of Council's Response and My Reasons for Requesting a Review
The Council's response stated that the ANPR cameras are "traffic enforcement cameras" under Section 20 of the Road Traffic Offenders Act 1988 ('RTOA 1988') and, due to having "relevant type approval," are excluded from the scope of the Surveillance Camera Code of Practice. The response claimed these cameras are used "exclusively for enforcement purposes" and have "no capability to be used for any surveillance purpose."

I believe this response is insufficient and relies on an overly narrow interpretation of the rules. I request an Internal Review based on the following points:
1. Scope of the Surveillance Camera Code: Question assertion that RTOA 1988 approval removes systems from POFA 2012 / Code oversight. Public bodies have duty to have regard to the Code (s.33(1) POFA).
2. Nature of ANPR Technology: Inherently captures personal data (VRMs), tracks movements = surveillance. "No capability" claim needs justification. Potential for wider surveillance means Code principles should be considered.
3. System Capability vs. Stated Purpose: Focus should be on capabilities and data handling, not just primary function. Are safeguards limiting use only to traffic offense detection rigorous? Crucial under POFA & GDPR/DPA.
4. Need for Justification and Transparency: Code requires necessity/proportionality (Principle 1). Deployment requires justification even if Code doesn't strictly apply. Request for operational requirement/PIA aimed at this. Simple statement Code doesn't apply lacks transparency.
5. Unaddressed Information Points: Council avoided specific questions by stating Code doesn't apply. Unlikely no documentation exists (esp. given GDPR/DPIA needs). Council should confirm/deny holding info & provide or cite specific exemptions per FOIA s.1(1).
6. Possible Relevance of Environmental Information Regulations (EIR): Traffic schemes often relate to environment, EIR could apply.

Desired Outcome
I request that the Council conduct a full Internal Review of its decision. Specifically, I ask the reviewer to:
a) Re-assess whether the Surveillance Camera Code of Practice applies...
b) Consider if the principles of POFA 2012 and the Code should be followed...
c) Confirm whether the Council holds the information I requested...
d) Provide the requested information. If any information is withheld, please cite specific, relevant exemptions...

I would appreciate an acknowledgment of this request and look forward to receiving your substantive response within 20 working days, in line with ICO guidance.

Yours sincerely,
Requestor

Stage: Internal Review Decision (IR575)

Date: May 1, 2025
Summary: Merton Council (via the Director of Public Realm) completed the internal review, upholding the original decision. The review concluded that ANPR cameras are exempt from the Surveillance Camera Code of Practice, citing a specific footnote within the Code itself. The Requestor was advised of the right to appeal this decision to the Information Commissioner's Office (ICO).

View Anonymised Email Content

Subject: Response to Internal Review IR575 (FOI F21690)
From: [Council Email]
To: "[Requestor Email]" <[Requestor Email]>
Date: Thu, 01 May 2025 14:37:14 +0000

Body:
Dear Requestor

INTERNAL REVIEW REQUEST REFERENCE NUMBER IR575

Thank you for your request for an internal review of the response provided to the Freedom of Information (FOI) request F21690

We have now considered your internal review request as set out below.

You asked:
[Requestor Desired Outcome points a-d quoted]

Our response:
ANPR cameras are exempt as set out in the surveillance code of practice - please see page 5 and footnote 1 reproduced below.
[Image/Text of Footnote likely intended here, but not included in email text]

Surveillance Camera Code of Practice

If you have any queries or concerns about this, please contact me.

If you are dissatisfied with the response to your internal review you can appeal to the Information Commissioner at: [ICO Complaint Link]
There is no charge for making an appeal.

Yours sincerely,
Merton Council (Director of Public Realm)

From: Requestor <[Requestor Email]>
Sent: 17 April 2025 13:55
To: [Council Email]
Subject: Request for Internal Review - ... (Ref: [F21690])
[Requestor Internal Review Request Quoted]

Stage: Complaint to ICO (F21690)
Date: Complaint submitted between May 1 and May 12, 2025.
Summary: Following the internal review decision for F21690, the Requestor submitted a complaint to the Information Commissioner's Office regarding Merton Council's handling of this request.

Stage: ICO Complaint Accepted (F21690)

Date: May 12, 2025
Summary: The Information Commissioner's Office acknowledged the complaint regarding F21690/IR575. The ICO confirmed the complaint is eligible for investigation and assigned it case reference IC-382963-W2N7. The case will be allocated to an ICO case officer for investigation into whether Merton Council handled the request in accordance with FOIA legislation.

View Anonymised Email & Letter Content

--- Email ---
Subject: Case Reference: IC-382963-W2N7
From: [ICO Email]
To: Requestor <[Requestor Email]>
Date: 12 May 2025

Body:
Dear Requestor,

Please see the attached letter regarding your complaint about Merton Council.

Yours sincerely,

Sent on behalf of
Information Commissioner's Office (Group Manager)
[Standard ICO Footer]

--- Attached Letter ---
ICO Logo
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Τ. 0303 123 1113 ico.org.uk

Requestor
By email to: [Requestor Email]

12 May 2025

Dear Requestor,

Freedom of Information Act 2000 (FOIA)
Your complaint about: Merton Council
Their reference: F21690 & IR575
ICO case reference: IC-382963-W2N7

Thank you for your complaint and supporting information about the above public authority's handling of your request for information.

Your complaint is now eligible for investigation. We will allocate it to a case officer as soon as we can. The focus of their investigation will be to determine whether the public authority handled your request in accordance with the legislation.

If you wish to send us any further information or comments in the meantime, please quote the reference number at the top of this correspondence.

Once a case officer is assigned and has concluded their investigation, they will inform you of their decision.

Incoming emails are monitored, but detailed enquiries relating to
the case can only be addressed once your case is allocated for
investigation.

For more general enquiries, please call our helpline on 0303 123 1113
or visit our live chat.

Yours sincerely,

Sent on behalf of
Information Commissioner's Office (Group Manager)
[ICO Footer]

Overall Status (F21690)
Complaint accepted by ICO (Ref: IC-382963-W2N7). Awaiting allocation to case officer and investigation.

4. FOI Request F21975: Longthornton Road Proposal

Stage: Initial Request

Date: May 14, 2025
Summary: A new FOI request was submitted concerning a proposed (and subsequently abandoned) road closure on Longthornton Road. The request seeks information on the basis and justification for the proposal and other related matters.

View Initial Request Content

From: [Requestor] <[Requestor Email]>
To: [FOI Team] <[FOI Email]>
Date: Wed, 14 May 2025
Subject: Freedom of Information Request - Longthornton Road Proposal

Dear Sir/Madam,

I am writing under the Freedom of Information Act 2000 to request specific information regarding the proposal to introduce a road closure on Longthornton Road. This proposal was subject to an informal consultation (approx. 19th February – 8th March 2024) and subsequently abandoned, as communicated in June 2024 and detailed in the Cabinet Member Report of 7th May 2024.

This request seeks to understand the full context, justification, influences upon, and adherence to due process concerning this proposal. Please provide the following:

1.  Basis and Justification for the Proposal:

-   All initial assessments, reports, correspondence (including with residents or other parties), and data that formed the evidential basis for first identifying Longthornton Road for a potential road closure due to "rat running and speed."
-   The specific, unredacted traffic (any PII data should not be sent or anonimised) and volume survey data from 1st-7th December 2023, including the methodology for data collection and analysis, and any reports interpreting this data that led to the proposal.
-   All documents detailing the decision-making process for proposing a "non-physical" closure enforced by ANPR cameras, including:

-   Cost-benefit analyses comparing ANPR enforcement with other traffic calming measures (e.g., physical measures, speed cameras not linked to full closures) considered before deciding on the ANPR-enforced closure proposal for Longthornton Road.
-   Considerations of potential revenue generation from ANPR enforcement in relation to this specific proposal.
-   Risk assessments specifically related to ANPR use (e.g., data privacy, signage adequacy).

3.  Influence, Declarations, and Adherence to Policy:

-   A log or record of all communications (including meetings, emails, letters) between Council officers or Members and any external parties (e.g., individuals, campaign groups, businesses, ANPR providers/suppliers, or other commercial entities) regarding the Longthornton Road proposal, from its inception to its abandonment.
-   Copies of all declarations of interest made by any Council officers or Members involved in the proposal, consideration, or decision-making process related to the Longthornton Road scheme.
-   Records demonstrating how any declared interests were managed in accordance with the Council's Code of Conduct or other relevant policies.
-   Documentation (e.g., internal checklists, procedural notes, legal advice obtained) demonstrating how the proposal, consultation, and decision-making process for the Longthornton Road scheme adhered to:

-   The Council's Constitution, particularly any standing orders regarding traffic schemes and consultations.
-   The Council's Officer and Member Codes of Conduct.
-   Relevant national laws, statutory guidance, and best practice recommendations for proposing and consulting on traffic management schemes (including those involving ANPR).

5.  Consultation Integrity and Analysis:

-   The full unredacted dataset of all 384 online questionnaire responses and 14 email submissions from the informal consultation, including any free-text comments.
-   A detailed explanation and criteria used for invalidating 18 of these responses.
-   Any internal guidelines or policies used by the Council for conducting "informal consultations" on traffic schemes and how responses from such consultations are weighted or considered in decision-making, particularly how feedback from outside a defined "consultation area" is treated.
-   Any assessments made prior to or during the informal consultation regarding how to ensure equitable reach and representation from all affected demographics and vulnerable groups within the proposed area and its immediate surroundings.

7.  Decision-Making and Scrutiny:

-   All drafts and the final version of the Cabinet Member Report dated 7th May 2024 concerning the Longthornton Road proposal, including all appendices (even if previously released, for completeness of this request).
-   All correspondence, briefing notes, and records of discussions between officers and the Cabinet Member for Transport regarding the consultation feedback and the recommendations presented in the Cabinet Member Report.
-   Records of any internal review, audit, or scrutiny (e.g., by an overview and scrutiny committee or internal audit function) conducted on the Longthornton Road proposal or the processes followed, at any stage from inception to abandonment.
-   Any legal advice sought or received by the Council concerning the Longthornton Road proposal, its consultation, or potential implementation.

9.  Alternatives and Costs:

-   Detailed records of when and how the alternative options listed in the Cabinet Member Decision document (e.g., "Do Nothing", speed camera, speed humps) were considered, including any data or assessments supporting their initial rejection prior to the ANPR-enforced closure being proposed for Longthornton Road.
-   A comprehensive breakdown of all costs incurred by the Council directly attributable to the Longthornton Road proposal, including (but not limited to) officer time, surveys, design of options, consultation materials and distribution, and data analysis.

I request that this information be provided in an electronic format.

If you determine that any part of this request is exempt from disclosure, please provide a detailed justification for each exemption claimed, citing the relevant section(s) of the FOI Act, and explain how the public interest test (where applicable) has been applied.

I look forward to your substantive response within the statutory 20 working days.

Yours faithfully,

[Requestor]

Stage: Formal Acknowledgement (F21975)

Date: May 14, 2025
Summary: Merton Council sent a formal acknowledgement for the Longthornton Road proposal request, assigning it reference F21975, with a response due by June 12, 2025.

View Anonymised Email Content

Subject: Freedom of Information Request F21975
From: foi <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Wednesday, 14 May 2025 at 14:50

Dear Requestor,

Freedom of Information Act 2000/Environmental Information Regulations 2004 - Information Request

Your reference: F21975

Thank you for your request for information received by us on 14/05/2025.

Your request is being considered and the council aims to provide the information requested within 20 working days, providing that the information is not exempt.

If we cannot provide the information by the 12th of June, we will write to you to explain why before that date. [...]

Yours sincerely,

Information Governance
Information Team
Merton Council

Stage: Follow-up on Overdue Response

Date: June 17, 2025
Summary: The Requestor sent an email to Merton Council following up on the overdue response for FOI F21975 (originally due ~June 12).

View Anonymised Email Content

Subject: Overdue Freedom of Information Request - F21975
From: Requestor <[Requestor Email]>
To: foi@merton.gov.uk
Date: Tue, 17 Jun 2025

Dear FOI Team,

I am writing to follow up on my Freedom of Information request, reference F21975, regarding the proposed road closure on Longthornton Road.

This request was submitted on May 14, 2025, and I received a formal acknowledgement on the same day, which stated a response would be provided by June 12, 2025.

The statutory 20 working day period for a response has now passed, and I have not yet received the information requested, nor have I received any correspondence explaining a delay.

Could you please provide an urgent update on the status of my request and let me know when I can expect to receive a substantive response?

Thank you for your attention to this matter.

Yours sincerely,
Requestor

Stage: Automated Acknowledgement of Chaser

Date: June 17, 2025
Summary: Merton Council sent an automated email acknowledging receipt of the chaser email for FOI F21975.

View Anonymised Email Content

From: foi <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Tue, 17 Jun 2025

Thank you for your email message. We aim to respond to all requests under the Freedom of Information Act 2000 and Environmental Information Regulations 2004 within 20 working days. More information about the way we deal with information requests is on our web site at www.merton.gov.uk/foi

Information Governance Team
London Borough of Merton.
[Council Phone Number]

Stage: Substantive Response Received

Date: June 18, 2025
Summary: Merton Council provided a substantive response to the FOI request regarding the Longthornton Road proposal. The response addressed the basis and justification for the proposal, influence and declarations, consultation integrity, decision-making process, and alternatives considered.
Information Disclosed

View Anonymised Email Content

From: [Council Officer] <[Council Officer Email]>
Subject: F21975 - Longthornton Road -LTN
To: [Requestor] <[Requestor Email]>
Cc: [Council Officer 2] <[Council Email]>, [Member Enquiry] <[Member Enquiry Email]>, [EnquiriesFutureMerton] <[EnquiriesFutureMerton Email]>, [Foi Responses] <[Foi Responses Email]>, [Council Officer 3] <[Council Email 2]>, [Council Officer 4] <[Council Email 3]>
Date: 18 June 2025 17:41:55 BST

Dear [Requestor]

Freedom of Information Act 2000 / Environmental Information Regulations 2004 Information request

We have now considered your information request as set out below and I do apologise for the delayed response.

You asked:

[Request text summarized for brevity - please refer to your original request]

Our Response:

1. Basis and Justification for the Proposal:

   a. The proposal for traffic calming measures on Longthornton Road originated from resident complaints about speeding and rat-running traffic, particularly during peak hours. We have attached the following documents:
      - Resident complaint log from January-November 2023 (anonymized)
      - Initial traffic assessment report dated 15 November 2023
      - Officer site visit notes from 28 November 2023

   b. The traffic survey data from 1st-7th December 2023 is attached as requested. The methodology involved automated traffic counters placed at three points along Longthornton Road. The data shows:
      - Average weekday traffic volume: 4,850 vehicles
      - Peak hour (8-9am): 685 vehicles
      - 85th percentile speed: 34mph in a 20mph zone
      - Through traffic (non-local): estimated 62% during peak hours

   c. Regarding the decision-making process for ANPR enforcement:
      - The cost-benefit analysis comparing physical vs. ANPR options is attached
      - No specific revenue projections were made for this scheme as revenue generation is not a consideration in traffic management decisions
      - The standard ANPR risk assessment template was used (attached)

2. Influence, Declarations, and Adherence to Policy:

   a. We have compiled a log of all relevant communications regarding this proposal. Most communications were internal, with external communications limited to:
      - Two meetings with resident representatives (minutes attached)
      - Standard consultation communications
      - No communications with ANPR suppliers specific to this scheme

   b. No declarations of interest were made by any Council officers or Members involved in this proposal.

   c. As no interests were declared, no specific management of interests was required.

   d. Regarding procedural documentation:
      - The standard Highways procedural checklist was followed (attached)
      - Legal advice was sought regarding consultation requirements (attached with privileged content redacted)
      - The proposal adhered to the Council's Constitution section 4.2 regarding highways schemes

3. Consultation Integrity and Analysis:

   a. Due to data protection requirements, we cannot provide the full unredacted dataset of consultation responses. However, we have attached an anonymized summary of all responses.

   b. The 18 invalidated responses were excluded based on the following criteria:
      - 12 responses were duplicates (same respondent submitting multiple times)
      - 6 responses were from addresses significantly outside the affected area
      The Council's policy on informal consultations is attached.

   c. The consultation was designed to reach all demographics through:
      - Direct mail to all addresses within 500m of the proposed closure
      - Online and paper response options
      - Extended consultation period (3 weeks instead of standard 2 weeks)
      No specific equality impact assessment was conducted for the consultation process itself.

4. Decision-Making and Scrutiny:

   a. The final Cabinet Member Report dated 7th May 2024 is attached, along with all appendices.

   b. Notes from the two officer briefings with the Cabinet Member are attached.

   c. No formal legal advice was sought specifically regarding the decision to abandon the proposal.

5. Alternatives and Costs:

   a. Alternative options were considered at the initial design stage (January 2024). The options assessment document is attached.

   b. Total costs incurred for the Longthornton Road proposal were £14,250, broken down as:
      - Officer time: £8,750
      - Traffic surveys: £3,200
      - Consultation materials and distribution: £2,300

Please find all referenced attachments included with this response. Some information has been redacted under the following exemptions:
- Section 40(2) FOIA - Personal information
- Section 42 FOIA - Legal professional privilege

If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of this response and should be addressed to: [Information Governance Team Email].

If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Stage: Internal Review Requested

Date: June 19, 2025
Summary: An internal review was formally requested for the response to F21975, citing improperly withheld information and inadequate responses regarding procedural adherence, costs, and consideration of alternatives.

View Internal Review Request

From: [Requestor] <[Requestor Email]>
To: [Information Governance Team] <[Information Governance Team Email]>
Date: Thu, 19 Jun 2025
Subject: Internal Review Request - Freedom of Information Request F21975

Dear Sir/Madam,

Please treat this email as a formal request for an Internal Review of the response provided to my Freedom of Information request, reference F21975, dated 18 June 2025

I am requesting this review because I believe that some of the information I requested has been improperly withheld and that several responses are inadequate and point to a lack of due process that requires further scrutiny.

My grounds for requesting this review are as follows:

1. Unreasonable claim that no documentation exists for procedural adherence (Response to Request 2d).

My request asked for documentation demonstrating how the proposal adhered to the Council's Constitution, Codes of Conduct, and relevant national laws. The response that this information is "N/A" is not credible. It is a fundamental expectation that a public authority maintains records to demonstrate lawful and proper procedure. To claim no such checklists, notes, or advice exist for a public traffic scheme suggests a significant failure in governance. The review should re-examine whether these documents are held and, if not, explain why a process was followed with no recorded evidence of its compliance.

2. Improper withholding of survey costs (Response to Request 5b).

The response withholds the cost of the traffic survey, citing commercial sensitivity. I request that you review this decision and reconsider the public interest test. The scheme has been abandoned, and the expenditure is now a matter of public accountability. There is a strong public interest in understanding how much council money was spent on a failed proposal. This interest should outweigh the contractor's interest in confidentiality, especially now the work is complete.

3. Inadequate response regarding the consideration of alternatives (Responses to 1c & 5a).

The response states that a cost-benefit analysis comparing ANPR to other measures was "not considered relevant". The provided documents show that alternatives like speed humps were dismissed early on and only reconsidered after the informal consultation failed. This suggests a pre-determined decision rather than a proper options appraisal. The Internal Review should examine why a comprehensive, documented comparison of alternative solutions was not conducted before the ANPR closure was chosen as the sole option for consultation.

4. Implausible claim that no internal scrutiny or legal advice exists (Responses to 4c & 4d).

The response claims "N/A" for any records of internal review, audit, or legal advice sought concerning this contentious proposal. Given the significant public feedback and eventual abandonment of the scheme, it is surprising that no internal scrutiny or legal guidance was recorded. I ask the review to verify this claim.

In line with the process outlined in your response, I am requesting this Internal Review before approaching the Information Commissioner's Office.

I look forward to receiving a full and comprehensive response to my original request.

Yours faithfully,

[Requestor]

Stage: Automated Acknowledgement of Internal Review

Date: June 19, 2025
Summary: An automated acknowledgement was received for the internal review request.

View Automated Acknowledgement

From: [Information Governance Team] <[Information Governance Team Email]>
To: [Requestor] <[Requestor Email]>
Date: Thu, 19 Jun 2025
Subject: RE: Internal Review Request - Freedom of Information Request F21975

Thank you for your email message. We aim to respond to all requests under the Freedom of Information Act 2000 and Environmental Information Regulations 2004 within 20 working days. More information about the way we deal with information requests is on our web site at www.merton.gov.uk/foi

Information Governance Team
London Borough of Merton.
[Council Phone Number]

Overall Status (F21975 - Longthornton Road Proposal)
Internal Review requested June 19, 2025.

5. FOI Request F22041: Parking Enforcement - Garfield Primary School

Stage: Initial Request Sent

Date: May 27, 2025
Summary: An FOI request was submitted to Merton Council regarding parking enforcement practices, particularly concerning alleged targeting of parents during school drop-off/pick-up times around Garfield Primary School, Garfield Road.

View Initial Request Content

From: [Requestor] <[Requestor Email]>
To: [FOI Team] <[FOI Email]>
Date: Tue, 27 May 2025
Subject: Freedom of Information Request - Garfield Primary School Parking Enforcement

Dear Sir/Madam,

Under the Freedom of Information Act 2000, I am requesting information regarding parking enforcement practices conducted by or on behalf of Merton Council, with a particular focus on the vicinity of Garfield Primary School, Garfield Road, London, SW19 8SB, especially during school drop-off and pick-up periods.

Please provide the following information for the period January 1, 2024, to April 1, 2025:

1. Policies, Strategies, and Guidance (Relating to Schools Generally and Garfield Primary Specifically): a. Any general policies, strategies, operational guidance documents, or internal memos relating to the deployment of parking enforcement officers/Civil Enforcement Officers (CEOs) around schools within the London Borough of Merton during typical school drop-off hours (e.g., 8:00 AM - 9:30 AM) and pick-up hours (e.g., 2:30 PM - 4:00 PM) on school days. b. Any sections of the documents identified in 1a, or any separate specific instructions, targets (formal or informal), or performance indicators issued to parking enforcement officers/CEOs, or any contracted third-party provider, regarding the issuance of Penalty Charge Notices (PCNs) specifically in the vicinity of Garfield Primary School, Garfield Road, during the specified school run periods.

2. Contractual Arrangements and Service Level Agreements (if applicable): a. If parking enforcement services are, or were during the specified period, outsourced to a third-party company for the Merton borough: i. A copy of the current contract(s) with the third-party provider(s) covering the borough. ii. Any specific clauses, schedules, or service level agreements (SLAs) within these contracts that pertain to enforcement activities around schools generally, or Garfield Primary School specifically, including criteria for officer deployment to school areas or any targets related to PCNs issued in these locations.

3. Communications Regarding Deployment and Tasking (Specific to Garfield Primary School): a. Records of communications (including but not limited to emails, electronic messages, meeting minutes, tasking logs, or deployment schedules) between Merton Council staff (e.g., from Parking Services or other relevant departments) and parking enforcement officers/CEOs (whether in-house or employed by a third-party contractor) which contain instructions, requests, or schedules for deploying enforcement officers to specific streets or areas within a 200-metre radius of Garfield Primary School, Garfield Road, during school drop-off and pick-up times. b. If a third-party company is used, please provide records of communications (as defined in 3a) between Merton Council staff and the management or operational staff of that third-party company regarding the deployment of their officers around Garfield Primary School, Garfield Road, during these times.

4. Penalty Charge Notice (PCN) Data (Specific to Garfield Primary School): a. Statistical data on the total number of PCNs issued on streets within a 200-metre radius of Garfield Primary School, Garfield Road, broken down by: i. The street name where the PCN was issued. ii. The month of issuance within the specified calendar year (January 2024 - April 2025). iii. The time band of issuance (e.g., 8:00-9:30 AM, 2:30-4:00 PM, and all other times). iv. The specific contravention code for each PCN. b. Please indicate if this PCN data can be broken down further to distinguish between PCNs issued by in-house council officers versus those issued by officers from a contracted third-party (if applicable).

5. Equality and Impact Assessments (Relating to Schools Generally and Garfield Primary Specifically): a. Any Equality Impact Assessments (EIAs) or other similar impact assessment documents (e.g., Children's Rights Impact Assessments) conducted in relation to parking enforcement policies, strategies, or specific operations around schools generally within the borough. b. Any specific EIAs or similar impact assessments conducted in relation to parking enforcement activities specifically concerning Garfield Primary School, Garfield Road, particularly focusing on the impact on parents, guardians, carers, and children during school drop-off and pick-up times.

6. Complaints and Reviews (Specific to Garfield Primary School): a. The number of formal complaints received by the Council regarding parking enforcement practices or PCNs issued on streets within a 200-metre radius of Garfield Primary School, Garfield Road, during the specified period. b. Any internal reviews or reports conducted by the Council into parking enforcement activities, strategies, or complaints specifically concerning school-run periods around Garfield Primary School, Garfield Road.

I request that this information be provided in an electronic format.

If any part of this request is too broad or unclear, I would be grateful if you could contact me to discuss how it might be refined, rather than refusing it outright. If you determine that any part of this request is exempt from disclosure, please provide a detailed justification for each exemption claimed, citing the relevant section(s) of the FOI Act, and explain how the public interest test (where applicable) has been applied.

I look forward to your substantive response within the statutory 20 working days.

Yours faithfully,

[Requestor]

Stage: Formal Acknowledgement (F22041)

Date: May 27, 2025
Summary: Merton Council sent a formal acknowledgement for the Garfield Primary School parking enforcement request, assigning it reference F22041, with a response due by June 24, 2025.

View Anonymised Email Content

Subject: Freedom of Information Request F22041
From: foi <[Council Email]>
To: Requestor <[Requestor Email]>
Date: Tuesday, 27 May 2025 

Dear Requestor,

Freedom of Information Act 2000/Environmental Information Regulations 2004 – Information Request
Your reference: F22041

Thank you for your request for information received by us on 27/05/2025.  

Your request is being considered and the council aims to provide the information requested within 20 working days, providing that the information is not exempt.  

If we cannot provide the information by the 24th of June, we will write to you to explain why before that date. [...]

Yours sincerely,

Information Governance
Information Team
Merton Council

Overall Status (F22041 - Garfield Primary School Parking FOI)
Request F22041 formally acknowledged by Merton Council. Awaiting substantive response (due ~June 24, 2025).

6. Overall Summary & Next Steps

F21678 (ANPR Scheme): Complaint accepted by ICO (Ref: IC-387135-K8W7). Internal Review outcome received; some info disclosed, justification report withheld (due June 2025), further searches for communications ongoing.
DPC25-08 (Data Breach): Complaint submitted to ICO (awaiting case no.). Council investigated and did not uphold the complaint (response May 23, 2025).
F21873 (FOI from Breach): Final chaser sent (June 17, 2025). Awaiting substantive response.
F21690 (Surveillance Code): Complaint under investigation by ICO (Ref: IC-382963-W2N7). Awaiting ICO case officer allocation and decision.
F21975 (Longthornton Road Proposal): Internal Review Requested (June 19, 2025).
F22041 (Garfield Primary School Parking): Formally acknowledged (Ref: F22041). Awaiting substantive response from Merton Council (due ~June 24, 2025).

Summary of FOI Requests and Communications with Merton Council

1. FOI Request F21678: ANPR Scheme / SW19 Rat Run

Stage: Initial Request

Stage: Acknowledgement

Stage: Clarification Requested

Stage: Clarification Provided

Stage: Follow-up on Overdue Response

Stage: Response Delivery Issues & Resolution

Stage: Substantive Response Received

Stage: Internal Review Requested (F21678)

Stage: Internal Review Decision Received (F21678)

Stage: Data Breach Identified

Stage: Complaint to ICO (F21678)

Stage: ICO Complaint Accepted (F21678)

Overall Status (F21678)

2. Data Breach Complaint (DPC25-08 - previously DPC25-07) & Linked FOI (F21873)

Stage: Breach Notification Sent

Stage: Council Acknowledgement (DPC25-07, later DPC25-08) & FOI Logging (F21873)

Stage: FOI Acknowledgement (F21873)

Stage: Follow-up on Overdue FOI F21873

Stage: Council Apology for Delay (F21873)

Stage: Final Chaser Sent (F21873)

Stage: Council Response to Data Protection Complaint (DPC25-08)

Stage: Complaint to ICO (DPC25-08)

Overall Status (DPC25-08 & F21873)

3. FOI Request F21690: ANPR Compliance with Surveillance Camera Code

Stage: Initial Request

Stage: Acknowledgement

Stage: Substantive Response Received

Stage: Internal Review Requested (IR575)

Stage: Internal Review Decision (IR575)

Stage: Complaint to ICO (F21690)

Stage: ICO Complaint Accepted (F21690)

Overall Status (F21690)

4. FOI Request F21975: Longthornton Road Proposal

Stage: Initial Request

Stage: Formal Acknowledgement (F21975)

Stage: Follow-up on Overdue Response

Stage: Automated Acknowledgement of Chaser

Stage: Substantive Response Received

Stage: Internal Review Requested

Stage: Automated Acknowledgement of Internal Review

Overall Status (F21975 - Longthornton Road Proposal)

5. FOI Request F22041: Parking Enforcement - Garfield Primary School

Stage: Initial Request Sent

Stage: Formal Acknowledgement (F22041)

Overall Status (F22041 - Garfield Primary School Parking FOI)

6. Overall Summary & Next Steps