KCC’s £100m AI Surveillance Framework: The GDPR Guide That Thinks It’s About Electric Cars

Kent County Council’s national surveillance framework can help public bodies buy facial-recognition cameras, artificial-intelligence surveillance, biometrics, ANPR, thermal imaging and even drone surveillance. Its published GDPR appendix, meanwhile, says it’s for “framework Y23049 Electric Vehicle Infrastructure & Associated Solutions”.

It isn’t.

The actual framework is Y24007: CCTV, Access Solutions and Security Services. KCC, trading through Procurement Services, advertised it nationally in February 2025 with an estimated value of £100 million excluding VAT. That figure needs explaining, because £100 million rather sounds as though somebody’s already ordered a warehouse full of cameras.

A framework agreement isn’t the same thing as a £100 million spending contract. Think of a national courier firm approving a network of garages for 500 motorbikes and saying it may need up to £4 million of repairs over four years. That doesn’t mean £4 million will be spent, or that every garage gets work; money changes hands only when an actual job is awarded. Y24007 works on the same basic principle: approved suppliers are put in place so public bodies can buy when they need to, including by direct award or further competition.

So far, so sensible.

Then KCC’s paperwork starts doing impressions of Yes Minister.

The official tender says Y24007 has three lots: CCTV, Security & Access Solutions; Security Services; and Total Security Solutions. The user guide says it’s “split into four (4) LOTs” — and then lists three. Procurement Services’ separate electric-vehicle framework, Y23049, really does have four. It’d be unkind to suggest the missing fourth surveillance lot is parked round the back on charge.

The problem doesn’t stop there. Elsewhere, the surveillance guide talks about an “Electric Vehicle Infrastructure requirement”. Appendix A carries the wrong Y23049 framework header. Appendix B leaves in the instruction “CHANGE FRAMEWORK NAME”, while “security” becomes “SECUIRTY”. The cover calls the document Issue No. 1; the pages inside repeatedly call it Issue No. 3.

That’s quite a performance from paperwork designed to help public bodies buy technology capable of identifying other things accurately.

Then comes Appendix C: GDPR.

It begins, reassuringly enough, “WE ARE COMMITTED TO PROTECTING YOUR PRIVACY.” A few lines later it identifies Procurement Services as contracting authority for Y23049 Electric Vehicle Infrastructure & Associated Solutions. Better still, the same section advises framework users to carry out their own due diligence to make sure suppliers can provide “sufficient guarantees” that GDPR requirements will be met.

You couldn’t really improve that with a scriptwriter.

None of this proves Y24007 is unlawful, and it doesn’t prove the underlying framework or individual contract terms contain the same errors. The guide says separate GDPR clauses exist in those documents. We haven’t seen evidence that those clauses are wrong, so we’d be daft to say otherwise. What we can say is that the published user guide for a national surveillance framework repeatedly contains identifiers and wording belonging to KCC’s electric-vehicle scheme.

The politics need the same care. Y24007 was advertised on 17 February 2025, before Reform UK took control of KCC. Reform were elected on 1 May and formally took the reins on 22 May, when leader Linden Kemkaran said Cabinet decisions would be driven by “maximising productivity and delivering value for money”.

Reform didn’t start this procurement.

It did inherit it, and the three lots weren’t concluded until 14 September 2025, almost four months after the new administration took control. The framework began on 15 September and remains listed by Procurement Services as running until 14 September 2029.

So the fair question isn’t whether Reform dreamt up the muddle.

It’s what happened to oversight once it was running County Hall.

KCC should explain who drafted the guide, who checked it, who reviewed its GDPR section, how long the wrong wording circulated, whether customers received it and whether the underlying contracts were checked for the same Y23049 material. For an administration forever banging on about productivity and value for money, this isn’t exactly cracking Enigma. It’s basic office admin.

KCC owned Procurement Services tells customers there’s “no necessity to run a full tender as we have already done the hard work for you”.

Quite.

The hard work was done. The easy bit — reading the bloody thing — apparently wasn’t.

The Shepway Vox Team

Delightfully Delicious Dissent