The UK-based Guardian newspaper released an exclusive report Friday revealing that Transport for London (TfL) issued fines to thousands of EU drivers by illegally obtaining their personal information in what is being described as a massive data breach.

The report details that the breach was discovered by Belgian MP Michael Freilich. Under the current post-Brexit data protection rules, personal data does not need to be shared for non-criminal offenses, the UK government is prohibited from accessing the data of EU citizens automatically. According to Freilich, in 2021 EU citizens began receiving hefty fines of up to £2,000 per day when visiting London and driving through its ultra low emissions zone (Ulez). Under the current Ulez rules, drivers who do not meet vehicle standards must pay a £12.50 daily when driving in Ulez zones. Non-UK vehicles must register with a Ulez partner 10 days before entering the city.

According to Freilich, “Ulez primarily targets heavy, large commercial vehicles,” however, drivers of family cars were also being penalized with excessive fines. Freilich says that he submitted a freedom of information request to Belgium’s vehicle licensing agency, which revealed that the TfL partner, Euro Parking, had been denied access to Belgian driver personal information and data. However, it “employed a local court bailiff who accessed the database more than 26,000 times and passed drivers’ names and addresses to Euro Parking.”  He clarified that while a driver’s details can be obtained in enforcing criminal court judgements, data cannot legally be shared with a UK company.

Belgium is not the only EU country impacted by the TfL’s alleged unlawful collection of data and Ulez fines. The Guardian’s report reveals that over 100 drivers in France have launched a lawsuit “claiming their details were obtained fraudulently.” Five EU countries so far have formally accused the TfL of the data breach.

TfL has commented on the breach, asserting that “local laws allowed authorities to share vehicle owner information with the UK for the enforcement of traffic regulations.” The EU states have argued that this rule only applies for criminal offenses, and failure to register a vehicle under Ulez constitutes as a civil offense.