DVLA & Data Protection

Laughingbear

By supplying our private details (names & addresses) to Private Parking Companies based soley upon vehicle registeration plate numbers and a request from a Private Parking Company, the DVLA must surely be skating on thin ice with the Data Protection Act.

eg My wife's details were supplied to one of these companies and they issued her with a PCN (this has happened on 2 separate occassions and 2 separate locations). On both occasions she was completely innocent because I was the driver of the car.

So now at least 2 Private Parking Companies have private details of my wife and her address (most probably kept on thier own database, which they can sell on to ANYBODY).

DVLC should beware that if they are breaching the Data Protection Act (please, please, please let there be somebody out there qualified to look into this!) they'll become yet another arena for the "where there's a blame there's a claim" brigade and i for one will be happy to claim my money back off them or the Private Parking Company that issued my PCN! :beer:

robredz

I think you will find a large back door that permits DVLA to release data, for "Prevention OF Crime" or public good, or any head that allows authorities to snoop, as they get paid for the info, and the inference that ppc's clampers, bailiffs and the police are on the same side, sort of, they will happily flog the details and be immune to sanction.

Others will know more but that IMHO is the position. Actually there needs to be a challenge under Human Rights, as that may trump any other legislation, say bailiff or other individual with access to DVLA, seeking details of young single mother debtor, using details to follow or spy on for reasons NOT Connected with their day job.etc

peter_the_piper

As no other member of the EU allows this then its only a matter of time before the door is closed. Anyone on good terms with an MEP?

robredz

Problem with EU is that contrary to expectation, they allowed the self incrimination not permitted elsewhere in the EU for S172 RTA 1988 name driver demands, but it is not beyond the realm of possibility that "Harmonisation" or future challenges about inconsistency would render both these travesties unlawful

steve1500

Who ever holds the information in this case the DVLA decides whether to release the information or not. Ususally trhey are required to meet what is known as a schedule 2 condition before they can release the infomation.

There are 6 conditions are available to choose from.2 are immediate non starters Cosent of the person to who the information relates to, Life and Death.

The others are pretty dubious. They are required to disclose the information by law. (employer telling inland revenue who works for them) Disclosure is required as part of a contract the person has entered into. Carrying out a public function (administration of justice is an example)

Last but not least if we can't rely on any of the other conditions the catch all

the processing is necessary for the pursuit of legitimate interests by the data controller or the person to whom the information is being disclosed, unless such processing is unwarranted because of prejudice to the rights, freedoms or legitimate interests of the data subject.

My guess is this will be the one that the DVLA will be relying on unless someone knowsof a legal requirement to disclose.

If it is the "legitimate" interests it becomes immediately challengable if someone eleses details are released i.e. my wifes. You would argue that the DVLA failed to keep the information secure could also go after them for selling on information for commercial gain.

Think I will have to get another ticket and do something about it with the Information Commissioners Office


Section 29 has been mentioned it is for the detection & prevention of crime But again is up to the DVLA to decide whether to release. Just because someone says they want it under S29 does not mean they have an automatic right to it.

If an organisation fails to keep personal information secure then the ICO has the power to fine upto £500k

AlexisV

Two words - 'reasonable cause'. In the DVLA's opinion, selling your details to a company to help them establish who was driving would be reasonable cause.

In the DVLA's opinion, anything is reasonable cause.

vax2002

I wonder what would happen if you wrote to DVLA removing any implied right to sell your data to third party private companies. Discuss ?

Sirdan

vax2002 wrote: »

I wonder what would happen if you wrote to DVLA removing any implied right to sell your data to third party private companies. Discuss ?

Nothing would happen.. your consent specific or implied is not a requirement..they would continue under the excuse of "reasonable cause".

esmerobbo

What if going by this section!

the processing is necessary for the pursuit of legitimate interests by the data controller or the person to whom the information is being disclosed, unless such processing is unwarranted

I tell Muppet PPC Co Ltd yes I am the RK but I was not driving. Then there is no legitimate reason for them to hold my data as they have no course of action against me. I should then be able to tell them to remove my data and to ask them to confirm it has been erased?

Just a thought!

mustrum_ridcully

peter_the_piper wrote: »

As no other member of the EU allows this then its only a matter of time before the door is closed. Anyone on good terms with an MEP?

Wow, when did they kick Sweden out of the EU? I ask because you can find the owner of a vechicle by SMS http://www.transportstyrelsen.se/sv/Vag/Fordon/Fordons-agaruppgift/Sms-tjansten-vem-ager-fordonet/

There might be similar things in other EU state (Sweden is the only one I know of). The Swiss (EEA not EU) have the equivalent of the phone book that lists numberplates and their owners.

Sirdan

esmerobbo wrote: »

What if going by this section!

the processing is necessary for the pursuit of legitimate interests by the data controller or the person to whom the information is being disclosed, unless such processing is unwarranted

I tell Muppet PPC Co Ltd yes I am the RK but I was not driving. Then there is no legitimate reason for them to hold my data as they have no course of action against me. I should then be able to tell them to remove my data and to ask them to confirm it has been erased?

Just a thought!

I think they'd argue that they will use your data to write to you asking you who was driving so they can pursue their claim. Despite the fact that you are not legally obliged to divulge that information there is nothing to stop them asking you in pursuit of the money they mistakenly believe in their fantasy world they are entitled to.

That said once you tell them that you will not tell them who was driving even if you knew ..then yes I think you would be justified in asking them to delete your data ..but do you think they will give a crap about your rights and the law ?? Not likely is it ..it's just not how things are done in PPC world.