CEL Whacked for £900 in DPA Breach Counterclaim

Coupon-mad

I see what you are saying but it doesn't help people to target the DVLA, they can't win.

So I am arguing that PPCs certainly 'hold themselves out' as a data controller, ergo, they are responsible. As above, the introduction to DPA breach counter-claims I am making for people, says as much. It's for the PPC to counter that argument, and many are not bright enough.

Ruurb

I also get what you are saying and people are free to do what works for them, my post was merely in response to my disagreement about who is actually the data controller here.

And whether or not people can win against the DVLA is a matter of opinion, though I did point out previously that those facing claims probably wouldn't want to take on the DVLA and the PPC as parties to a claim because having to defend a claim may be stressful enough.

As for what the KADOE contract says, its simply a matter of substance over form. As long as people continue to get away with claiming from the PPC that's all good

safarmuk

You don't seem to be wrong but on the other hand, we would be far better attacking the PPCs.

Totally agree, was just trying to rationalise Ruurb's points in my own head using my own experiences and training in Data Protection.

However your additional points C-M and Lynnzer's additional point:

You conveniently missed out the part where the KADOE Contract says that once data has been obtained by a PPC, they become the controller of it.

... seem to imply that in this case the ATA and the DVLA through their KADOE contract are making an exception to the normal rule Ruurb points out and I tried to rationalise with my analogy.

My conclusion is similar to both of yours, the PPC is perhaps at a minimum a joint Data Controller (due to holding themselves out there as such and via the KADOE contract) AND the Data Processor.

Coupon-mad

As Lynzzer just pointed out, there is a legal case law that helps show the company is a data controller:

http://forums.pepipoo.com/index.php?showtopic=112492&st=60&start=60

http://www.bailii.org/ew/cases/EWCA/Civ/2017/121.html

''if they are processing personal data on their own behalves they will be data controllers as regards that processing and those data''.

IMHO, people can use that case as well as the ATA CoP and the KADOE, to show that PPCs are data controllers, because they are certainly acting on their own behalf, and not on behalf of the DVLA as some sort of agent.

Umkomaas

I would rather doubt that the DVLA has built the Data Controller contractual obligation into the KADOE agreement without first running it past the ICO and/or their own legal team.

safarmuk

''if they are processing personal data on their own behalves they will be data controllers as regards that processing and those data''.

IMHO, people can use that case as well as the ATA CoP and the KADOE, to show that PPCs are data controllers, because they are certainly acting on their own behalf, and not on behalf of the DVLA as some sort of agent.

Agree, these definitions seem to provide the answer to the ambiguity, in this specific example, of the aged DPA legislation that Ruurb was pointing out.

I would rather doubt that the DVLA has built the Data Controller contractual obligation into the KADOE agreement without first running it past the ICO and/or their own legal team.

Agree, it would be a huge surprise if the DVLA had messed up in such a way.

But, I would conclude it appears that as well as being able to pursue the PPC as currently thought ... this thread also potentially opens up a potential avenue for the bravest to pursue the DVLA as well ...

Ruurb

Well that is interesting, I can't argue much with that!

Timothea

So, to summarise:

1. If a PPC obtains personal data under its KADOE contract with DVLA then the data controller of those data may well be DVLA. This is because DVLA is providing personal data under a contract that also specifies how the PPC should use the data (and the PPC would therefore be a data processor of those data).
2. If a PPC obtains personal data from DVLA using form V888/3 then the data controller of those data is more likely to be the PPC. This is because DVLA is not providing personal data under a contract and the PPC specifies how it will use those data (the purpose). DVLA should check that the purpose given constitutes reasonable cause, but this is not a DPA requirement.
3. If a PPC obtains personal data from another source (e.g. from its ANPR, or directly from the driver or keeper) then the PPC is the data controller for those data.

Obviously, this is all speculation until it is decided by a judge. We should also consider the fact that DVLA has access to expert lawyers, who have no doubt considered the matter and have presumably advised DVLA that it would not be the data controller for personal data given out under regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002.

Please correct me if I have misunderstood the consensus view.

beamerguy

Timothea wrote: »

So, to summarise:

1. If a PPC obtains personal data under its KADOE contract with DVLA then the data controller of those data may well be DVLA. This is because DVLA is providing personal data under a contract that also specifies how the PPC should use the data (and the PPC would therefore be a data processor of those data).
2. If a PPC obtains personal data from DVLA using form V888/3 then the data controller of those data is more likely to be the PPC. This is because DVLA is not providing personal data under a contract and the PPC specifies how it will use those data (the purpose). DVLA should check that the purpose given constitutes reasonable cause, but this is not a DPA requirement.
3. If a PPC obtains personal data from another source (e.g. from its ANPR, or directly from the driver or keeper) then the PPC is the data controller for those data.

Obviously, this is all speculation until it is decided by a judge. We should also consider the fact that DVLA have access to expert lawyers, who have no doubt considered the matter and have presumably advised DVLA that it would not be the data controller for personal data given out under regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002.

Please correct me if I have misunderstood the consensus view.

As far as I am concerned, the DVLA are the data controller
of my vehicle details. Without my permission they sell on my data
for £2.50 to parking scammers

hoohoo

This is all very interesting.

What happens in the case where the data is not provided by the DVLA?

Eg
1) The keeper is not the driver, so they dob in the driver.
2) The driver replies to a windscreen ticket, giving their own details
3) The driver data is supplied by a hire car firm

In none of these cases is the DVLA involved

Is the PPC data processor in these instances, or now data controller? And if they are now data controller, why are they not data controller if the path of data is from the DVLA?

For scenario 2, what if the driver tries to limit the use they are giving their data to the PPC. Eg

"My personal data is provided only for the purposes on making an appeal and allowing you to cancel the charge. It may not be used in any other way. For the avoidance of doubt, this includes pursuing a parking charge."

Does the PPC have to respect this, or can they ignore it?