This page will be updated as we find out more information – do you have any?

The Card

This information comes from this FOI request.

The card is a RFID (touch) card and conforms to the LASSeO (Local Authority Smartcard Organisation) Profile E. The fields available are:

• Service label
• card number
• forename
• surname
• display name
• date of birth (if known)
• DOB verified
• card holder number
• card expiry date
• resident flag

How is the card managed

The card is managed by the council through the existing CRM (Customer Relationship Managment) software. The card number is issued and managed by the “Smart Connect” card management system which links to the Hillingdon CRM. Smart Connect is from Bracknell Forrest Borough Council, you can read more about it here.

When a card is ordered Smart Connect sends information to Burall Infosmart Ltd (Burall), the bureau. Burall encode the card (put data on it), print and add personalisation (e.g. you name etc to the front). Burall then send back to Smart Connect that they have produced or dispatched the card. They then destroy all data securely. We do not know what security there is, who has access to the data whilst it is with Burall or what oversight there is, if any.

The card can be managed via a library or at Hillingdon directly (The system is dealt with by the Officers of the Council.). We do not know how many ‘Officers of the Council’ there are or what training they receive, or what oversight there is.

The parking management system is hosted by Metric Ltd using dedicated SQL servers. Officers of the council (within the Environment & Consumer Protection Directorate) have access to this system as do Metric Ltd employees. The FOI request says that the machines do not read the card holders first name, surname or date of birth, and therefore no personal information is stored, just an ‘anonymous’ card number. See the Privacy Page for more information. Again, we do not know what security is in place, what employees have access to, or what oversight there is.

Card Usage – What actually happens?

The card will be used at the following locations, but the system has been built to add additional features later (see ‘Future Page’).

Libraries
No data is exchanged with the library when you use your card, unless a new card is being ordered, reported lost or stolen or that a resident has moved out of the borough. When data is tranmitted the card number is sent to the CRM.

Business Discounts
The card is shown visually at the point of sale and no data is exchanged with any business participating in the scheme.

Harefield Civic Amenity Site & Parking Meters
When you use your card at a parking meter, or at the dump, this happens;

The card is updated with the following:

Service label
Parking indicator
Parking scheme reference
Last used data/time is updated

then the machine does this:

The machine will validate the card (check it has not recently been used or on a ‘hotlist’ of rescinded cards).
It will communicate back to the parking management system the following:

Card Number
Serial Number
Date/Time
Parking Machine ID
Cost of Ticket issued (if issued)
If the card was in passback (we do not know what this means)
If the card was on the hotlist
If the card was invalid for another reason

This data is stored for 6 years.

Your data is stored (see above) and checks are carried out by the ‘Officers of the Council’ to prevent abuse of the HillingdonFirst scheme (for example, to get daily rate discounts for parking more than once a day). See Privacy Page.