I assume gdpr (and/or equivalent) is still law in the UK? If so, dealing with person data (traveldata + car registration should qualify) - without explicit consent is illegal, yes. Just storing the data would be illegal. (getting consent, and then not storing it securely would also be an offense).