Police recorded personal injury road accident data (STATS19): privacy notice

In accordance with General Data Protection Regulation (GDPR) this notice explains how the Welsh Government uses information about personal injury road traffic accidents from police forces.

The information in this notice will be kept under review to incorporate any further changes communicated by the Information Commissioner’s Office.

Data on road accidents resulting in personal injury are recorded by the police forces (either when an accident is reported to them or by attending the scene themselves) and uploaded to their incident recording system (Niche). These data are transferred to the Welsh  Government (WG) for statistical research purposes. This notice informs those whose data has been collected about the storage, processing and usage of those data by WG.

Information about road accidents involving human death or personal injury occurring on the Highway is recorded by police officers on a STATS19 form. This includes data on the accident, casualties and the vehicles involved and these data are transferred securely to WG on a monthly/quarterly basis. Both Police forces and the WG are data controllers.

WG uses this information to report statistics, monitor trends, carry out research and to support others in using road accident analysis to inform road improvement schemes or new road developments. Use of the data feeds into analysis of the safety of the road network and helps identify where improvements can be made to reduce the number of road accidents in Wales. Police Forces use the information to help inform operational tactical deployment of their patrols in order to fulfil one of their primary roles, the reduction of road casualties.

A complete list of the data items collected by the STATS19 form can be found on the Department for Transport website.

In summary, this includes details of all incidents (accidents, vehicles and casualties) recorded to the Police in Wales. 

The dataset contains some information regarding individuals. This includes:

• age and sex of casualties and severity of injury
• drivers’ home postcode vehicle details e.g vehicle registration mark
• police officer’s description of the accident
• factors which contributed to the accident, based on police officers initial assessments
• accident location
• screened breath test data from all persons involve

The data are considered personal because they may enable the identification of individuals either on their own or through combination with other data that are publicly reported on road accidents. Consequently, they are subject to GDPR.

The data controller is defined as the public authority which, alone or jointly with others, determines the purposes and means of the processing of personal data. Police Forces and WG both meet this description and thus are considered data controllers.

The police recorded personal injury road accident data will be used by government as follows:

• to publish official statistics
• to monitor progress towards national outcomes
• to monitor road safety
• to develop and evaluate policy
• to support research relating to police recorded personal injury road accidents
• to support others in analysing road accident data to inform road improvement schemes or the development of new roads

This may include linking data through secure anonymised means with other datasets.

WG may use the personal identifiable aspects of the data to support the uses set out above. However the data will not be used or processed to:

• take action or support measures or decisions with respect to individuals
• cause any damage or distress to individuals
• identify any individuals in any reports

Results from analyses carried out using the data will be made available in statistical or research publications released via the WG website and also via data placed on the StatsWales website.

External users such as Local Authorities, police forces, transport planners and the wider public will be able to use this published information for their own purposes, such as performance measurement and management; to improve practice and to hold government to account.

WG shares the data with the Department for Transport to feed into road accident statistics for Great Britain. WG also shares some or all of the data with other public sector organisations, non-government agencies and approved researchers, but only for statistical or research purposes. In every case any such disclosures will be scrutinised by the Welsh Government’s Chief Statistician and, if approved, controlled by an appropriate WG data access agreement which will:

• ensure secure transfer, storage and eventual destruction of the data
• only include personal information if there is a clear requirement
• limit the use to the specific requirement identified, ensuring that no individual can be identified in any published reports
• only allow the data to be stored for the duration of the research project, requiring the data to be destroyed after that period

The GDPR requires a lawful basis for processing personal data and in this case, Article 6(1)(e) applies: “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. In the case of special categories of data, Article 9(2)(j) applies “processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes in accordance with Article 89(1)”.

Section 39 of the Road Traffic Act 1988 provides that the Welsh Ministers may provide for promoting road safety by disseminating information and advice relating to the use of roads. The Welsh Ministers also have the power to do things which are conducive or incidental to their other functions by virtue of the common law executive functions transferred to them pursuant to Section 58A of the Government of Wales Act 2006.

The GDPR lists certain rights which apply to individuals in the context of storing and using their personal data. The rights extended to the individuals under both the articles quoted.

You have the right:

• to be informed what the WG will do with your personal data (this notice)
• to have access to the personal data that WG hold about you
• to require WG to rectify inaccuracies in that data
• to (in certain circumstances) object to or restrict the use of your personal data
• to request that your data be erased (in certain circumstances)

A further right exists which allows an individual to challenge or not be subject to a decision taken on the basis of an automated process. However, as set out later, WG will never use the police recorded personal injury road accident data transferred to them to take a decision about a particular individual, whether through an automated process or not.

More guidance on these rights can be found on the Information Commissioner’s Office website.

The personal information of the STATS19 data will only be transferred to approved individuals at WG. Personal Information will only be transferred to any individual outside WG if they have a legal right to the data, and only after a data access agreement, security aspects letter and cyber essential certification are in place. The information will be transferred through a secure data transfer system (Afon), in which the data files will be encrypted. To access an Afon account, appropriate authentication is required and an IP restriction is associated with the account. Personal data will not be shared via a standard open email connection or by standard postal methods. Data that are not deemed personal may be shared via a standard open email connection or publicly via our statistical releases or our StatsWales website.

At WG the data will be stored in a secure database with access limited to approved WG users. WG and police forces are responsible for any data that they hold for as long as they hold it.

Data will be retained by WG for as long as it remains useful for research purposes, and because historical data can be very useful in this context, this is likely to be a considerable number of years.

Where data is shared with third parties for research purposes, they will be required to be destroyed when the project is complete.

Questions about either this notice or individuals’ rights should be directed to WG in writing to the address below. Complaints should also be directed to this address in the first instance, although you can also complain directly to the Information Commissioner’s Office.

Transport, Economic and Labour Market Statistics
Knowledge and Analytical Services
Welsh Government
Floor 4 South
Cathays Park
Cardiff
CF10 3NQ
Email: stats.transport@gov.wales

Information Commissioner’s Office (Wales)
Churchill House
17 Churchill Way
Cardiff
CF10 2HH
Telephone: 029 2067 8400 or 0303 123 1113
Email: casework@ico.org.uk
Website: Information Commissioner’s Office

The Welsh Government’s Data Protection Officer can be contacted at:

Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ.
Email: dataprotectionofficer@gov.wales