Penetralia

The Humber Bridge

For those of you who do not live in North Lincolnshire, the Humber Bridge crosses the river Humber from Barton on the south bank to Hessle on the north bank. Using the bridge reduces the journey between the two sides of the river by approximately 60 miles compared to the next closest crossing. Many locals use the bridge to commute to work twice daily. Others use the bridge to access medical treatment which the NHS can dictate is given at any number of hospitals in the region on either side of the bridge. This 120 mile saving has major effects on time, money and, certainly for medical appointments, stress.

The bridge opened to traffic on Wednesday 24 June 1981 at a reported final cost of £91 million, paid for, at least in part, from public funds. Under an act of parliament, The Humber Bridge Board was set up to manage the bridge. The 2025 version of the Constitution of the Humber Bridge Board Lays down what the Board's responsibilities are.

Until recently, the Humber bridge had Toll booths allowing travellers to pay for a crossing at the time of the travel. They also had a tag system that people could use making the system fastier and easier. These toll booths have now been removed and the Humber Bridge Board offer a number of ways that payment can be made. However, the time lag between crossing the bridge and your account being updated can be problematic resulting in many complaints about the system. If you are unlucky enough to incur a penalty for not paying within the time limit specified, you receive a letter through the post which state the ONLY way to pay the penalty is on the website.

We have a bridge paid for mainly by public funds, managed by a public body in a monopolistic position with members of the public reliant on its services. This puts the Humber Bridge Board in a very powerful position. A position which, at times, FORCES, people to use their website.

The Privacy Violations

Given these facts, you would expect the Humber Bridge Board to pay careful attention to the legal requirements under which such a website should be designed and implemented but this is not our experience. Following a number of complaints to us, we investigated the site and found what we consider to be violations of peoples privacy rights under a number of laws and regulations the major ones being:

Forced use of Google reCAPTCHA

the ICO has explicitly stated that reCAPTCHA is not exempt from user consent requirements but the Humber Bridge website uses it and denies the users the ability to refuse any cookies. Given this is forcibly set on that part of the website that takes payment for penalty notices and Google are renowned for profiling users, one can only imagine what this may be doing to people's credit ratings without them knowing.

Data Minimisation

For people using the bridge on a regular basis or needing to use it for medical appointments at short notice, setting up an account could make life simpler and reduce the risk of penalties for missing payments. However, if you wish to register for an account, the system requests far more information than is necessary including your name and address. This information is not required in order to cross the bridge. The Humber Bridge Board do not use this information when issuing penalty notices, they query the DVLA for the correct address from the vehicle registration.

Non Privacy Friendly Cookies

There are a number of minor but seemingly blatant infractions of rules concerning cookies.

• The popup box for "Accept" our cookies follows normal ( but incorrect) practices of highlighting the accept button and "encouraging" the visitor to accept;
• Cookies are incorrectly classified with tracking and analytical cookies being classed as "Essential" where the ICO repeatedly states they are not;
• The website stores cookies that are not included on the cookie list and one cookie had the description "Pending"

All these infractions lead to website users being tracked and their data being made available for reasons that they are unaware of and that are not to do with crossing the bridge. Given the monopolistic position of the Humber Bridge, It is probably true to say much of the consent is not "freely given".

What We Did

We wrote to the Humber Bridge using the registration details they have given the ICO for any contact relating to GDPR. We listed all our concerns and, as recommended by the ICO, requested a response within one calendar month. We pointed out that we would escalate this as an official complaint to the ICO if we had not had a response within that time period.

30 days came and went and we received no response or acknowledgement at all from the Humber Bridge Board. This was surprising given they have a legal requirement to respond to GDPR enquiries / complaints and their own Constitution of the Humber Bridge Board states that the board is responsible for answering complaints from members of the public and for "The Need to take full account of human rights".

Consequently, we raised the issues with the ICO as an official complaint. Out of courtesy we emailed mail@humberbridge.co.uk which is / was the address given for the Data Protection Officer. This is the same email address that was used to send the original complaint. To our surprise we got a response. An automated response.

In the footer it states that you can "notify our mail manager at mail@humberbridge.co.uk". Given that was the address that just sent us a very snotty "We're not listening" response, we decided not to try. There is also a link to their Contact us form which clearly states visitors Have to agree To the website's 15 page Privacy Policy before we can even contact them. Apparently, another breach of GDPR rules.

We looked for another way to email anyone working at the bridge but there isn't one. We looked at the Board of Directors but no contact details are given. The Chair of the Board is a councillor (Cllr Paul West) we looked up his details and emailed him directly.

He, too, chose not to respond to us.

We must admit to being disappointed, but not surprised, at the Humber Bridge's lack of privacy respect on the website. Their lack of compliance with all aspects of the GDPR (including not responding to complaints and not using the registered contact email address) and not respecting their own publicly available constitution is quite shocking. However, the aims of our organisation are to work for a safe, free and private Internet and we will use all resources at our disposal to ensure the Humber Bridge Board stop abusing their position and treat the public with the respect they deserve (and the Humber Bridge Board Constitution states they should give us).

This issue is ongoing.

We would love to hear from anyone who has concerns or problems with the Humber Bridge website. You can email us at info[at]penetralia.org.uk. If you wish to send an encrypted email, use our public key that can be downloaded from the link in the footer of all webpages.