Article 13 GDPR (Data Protection Act 2018)

markrg1965

UK-CPMs deadline to respond to my subject access request has also passed without even an acknowledgement, I shall be complaining to the ICO.

beamerguy

markrg1965 wrote: »

UK-CPMs deadline to respond to my subject access request has also passed without even an acknowledgement, I shall be complaining to the ICO.

Just do it, these PPC's are not the God's they think they are

RichieBoy56

I sent a SAR request to VCS attaching a copy of my drivers licence to confirm my identity.
They have replied asking for further details:
Full Name (This was on my SAR letter)
Full address (This was on my SAR letter)
Charge notice number
Vehicle Registration number
Status of person making request (Keeper, driver, hirer)


VCS have issued court papers for an alleged parking infringement but my SAR request was a general request to find out what information they hold on me and who they share it with.
Is this request for further information valid?
Should I complain to the ICO?


Advice appreciated.

abedegno

Hi RichieBoy,

As per the ICO guidance here:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

Have already sent you an NTK (Notice to Keeper)? If so they have already applied to DVLA for the Registered Keeper details and established the identity of the registered keeper.

I would point them at the ICO guidelines that they should only request information to establish your identity and in your opinion, with your driving license you have already established that. Ask them why this additional information is necessary to establish your identity and why your driving license is insufficient. Remind them you still expect a response within 30 days or you will be escalating the matter with the Information Commissioners Office.

Zero_Gravitas

abedegno wrote: »

Draft response below, comments welcome:

I believe your assertion that the DVLA does not make decisions solely on automated processes is incorrect and will set out the reasons why below:

• The latest copy of the KADOE fee-paying contract I have seen[1] suggests that after a probation period of 26 weeks organisations are able to make electronic submissions to request registered keeper details.
• This electronic service appears to make a decision to release registered keeper data automatically and without human involvement. It also seems infeasible for it to operate in any other way as the DVLA appears to have only 5,698 employees[2] and the number of fee and non-fee paying requests for FY2017/2018 totalled 20,450,951[3]

As such, rights granted under article 22 of GDPR are applicable in this case which I am exercising as per my original communication dated 9 June 2018.

Best Regards

Abedegno

Sources:
[1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/455973/Annex_A_-_KADOE_Fee_Paying_Contract_V4.pdf
[2] https://www.gov.uk/government/publications/dft-gender-pay-gap-report-and-data-2017/dfts-gender-pay-gap-report-2017
[3] https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/699770/kadoe-enquiries-q4-2017-18-v2.xlsx

Might be a bit late, but shouldn’t the first sentence read “I do not believe” ?...

Edited to add that the first sentence should read “I believe” and I’d got it wrong.

Umkomaas

Zero_Gravitas wrote: »

Might be a bit late, but shouldn!!!8217;t the first sentence read !!!8220;I do not believe!!!8221; ?...

That would add a double negative into the main thrust of the sentence. Currently it states

I believe your assertion [that the DVLA does not make decisions solely on automated processes] is incorrect

Your suggestion would turn that to

I DO NOT believe your assertion [that the DVLA does not make decisions solely on automated processes] is incorrect

Therefore their assertion IS correct.

To me the original seems to be correct as it stands.

Zero_Gravitas

Umkomaas wrote: »

That would add a double negative into the main thrust of the sentence. Currently it states

I believe your assertion [that the DVLA does not make decisions solely on automated processes] is incorrect

Your suggestion would turn that to

I DO NOT believe your assertion [that the DVLA does not make decisions solely on automated processes] is incorrect

Therefore their assertion IS correct.

To me the original seems to be correct as it stands.

You’re quite right - thank you for the correction. I’ll edit my other post.

abedegno

Latest response from DVLA:

I can assure you that that the DVLA takes the protection and security of its data very seriously and has procedures in place to ensure data is disclosed only where it is lawful and fair to do so.

Regulation 27(1)(e) of the Road Vehicle (Registration and Licensing) Regulations 2002 provides a legal gateway to disclose information contained in the UK vehicle register to ‘any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particular to be made available to him’. An express right has been established in law for the sharing of data in certain prescribed circumstances, including for private parking management. The consent of the data subject is not required where processing takes place under these conditions.

The DVLA exercises the Secretary of State’s discretion where it has the powers to do so. The registered keeper of a vehicle is the person who, under UK law, accepts responsibility for the vehicle and its use. If a vehicle is involved in an incident or contravention, the registered keeper is the first point of contact to determine who may be responsible and for the necessary action to be taken. Refusal to disclose these details to private car parking management companies would mean that motorists would be able to park on private land with disregard for the conditions applying with little prospect of being held to account.

The package of measures the DVLA has in place such for parking management companies using the KADOE system such as strict contractual conditions, the requirement for Accredited Trade Association membership and stringent audit procedure, means that the Secretary of State is lawfully exercising his powers of discretion. When an organisation makes a large number of standardised requests, with identical circumstances, we consider it reasonable to have electronic processes in place to deal with these requests efficiently. Due to the volume of requests it would not be reasonable to expect every request to be individually checked.

I would like to make it clear that the DVLA does not use automated decision making, as described in the Data Protection Act (DPA). Electronic requests for information from the DVLA vehicle record are handled via an automated process. There is no requirement for a decision to be made to disclose information at the time an application is received. The request is received and processed in accordance with the terms and conditions of the contractual agreement and therefore this does not constitute automated decision making.

This situation has not changed with the introduction of the General Data Protection Regulation. The DVLA will continue to share personal data with law enforcement agencies, other government departments and other third parties where the law allows us to do so. We have robust procedures in place to ensure that all our data sharing activities comply with the DPA.

You have the right to complain to the Information Commissioner’s Office if you believe that the DVLA has not handled your request to exercise your right appropriately. Please write to The Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

I hope this information helps to explain the position on the matters you have raised.

Coupon-mad

There is no requirement for a decision to be made to disclose information at the time an application is received.

There should be, a keeper would reasonably expect as much, at the very least. And that cannot be right because what if they got a request from UKPC during their ban?

Something stops the data being released during a ban so that IS decision-making, of a sort, surely. Not fully automatic.

Fruitcake

Am I right in thinking that the DVLA should inform the data subject (registered keeper) each and every time they pass personal data about them to a PPC, or have I got things muddled?