June 2018 - start of the new PPC and DVLA fightback (GDPR related)

abedegno

Working on it

ANPR images seem to be kept for 2-3 months- entrance/exit, whitelist and location data is kept for 12 months before anonymisation - completely unreasonable to me where no parking offence has been committed. Industry practice for private surveliance cameras is 30 days.

I have gone back to PE challenging them on this, I have also asked for details of their anonymisation process as it has to be irreversible for the data to be no longer classified as personal data and fall outside of DPA/GDPR.

Failing that another complaint to the ICO is in the offing...

Coupon-mad wrote: »

How is it in any way reasonable to retain all ANPR images for 12 months in case the Police want it? That is ludicrous and excessive, and something to put to the ICO.

abedegno

So another update, in response to me questioning the feasibility of human intervention when ParkingEye issue 4,000 parking tickets per day:

In respect of your query regarding the checks undertaken, we can confirm that the data taken from our Automatic Number Plate Recognition (ANPR) cameras undergoes a stringent checking process of up to 19 stages before any registered keeper data is requested from the DVLA. These checks include steps relating to the quality of the data collected and the circumstances of each parking event, as well as multiple manual quality assurance checks undertaken thereafter to review the decisions made. We can confirm that each Parking Charge issued has been subject to a checking process that has included human intervention, as detailed within our previous correspondence.

Coupon-mad

OK someone needs to do those sums and work out how many staff members it would take (in normal working hours, with breaks) to individually carry out '19 checks' for 4000 PCNs per day.

abedegno

Someone needs to strap their number plate to a trolley and wheel it into Aldi to test

Coupon-mad wrote: »

OK someone needs to do those sums and work out how many staff members it would take (in normal working hours, with breaks) to individually carry out '19 checks' for 4000 PCNs per day.

fil_cad

:This is an interesting thread.

Carthesis

Not been around for a while, but having dipped my toe back in the waters and seen this thread, and being in the middle of fending off UKCPS, i took a bash at a letter to the DVLA:

Restriction of automated decision-making and data release under GDPR Article 22

Dear Sir/Madam,

I understand from reading the privacy notice provided by DVLA here:

https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter

that DVLA will release my personal details to private and public-sector organisations providing they can demonstrate reasonable cause to receive it. It is also my understanding that this information is released electronically and automatically without human intervention using the Keeper at Date of Event (KADOE) system.

This arrangement falls under the scope of Article 22 of the GDPR, which states:

“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” [GDPR Article 22(1)]

My concern is that this automated process does not:
i. check that reasonable cause exists, or;
ii. check that the KADOE System user has met their contractual requirement with DVLA, which includes verification:
a) that information from the records are used for the reason given;
b) that evidence exists that an unauthorised parking incident occurred;
c) there is a valid and current agreement in place between the private parking operator and the landowner of the specific site in question to authorise the private parking operator to operate the parking scheme on their land and to take legal action to recover a charge on their behalf.

As such, I now request that any and all DVLA records containing my personal details as Registered Keeper of AA11BBB be marked as frozen so that all future decision-making involves human intervention and that - where the request is not from the Police or a Local Authority - I am always contacted by the DVLA in advance of the release of my data, so that as the data subject with rights as set out in the GDPR, I can express my point of view, obtain an explanation of the decision to share data and, if applicable, challenge it.

Please take express note that I am not requesting for a restriction of processing under Article 18 of GDPR but am instead exercising the rights for data under Article 22(3) which states:

“… the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.” [GDPR Article 22(3)]

In this case, automated decision making is not required for entering into, or performance of, a contract between the data subject (in this instance, me as Registered Keeper of a vehicle) and a data controller (in this instance, either the DVLA or the appropriately named individual in a private company). Hence the exclusion given in Article 22(2)(a) does not apply.

Further, I note that while Regulation 27 of the Road Vehicle (Regulations and Licensing) Regulations 2002 provides a legal gateway for release of this information, it does not specify the means by which this data release should occur. I therefore contend that there is no Union, nor Member State, law applicable in this regard under Article 22(2)(b), and the provisions of Article 22(1) thus apply.

The only remaining applicable exclusion for automated decision-making therefore is given in Article 22(2)(c), which relies on the explicit consent of the data subject. This explicit consent had not previously been given, and by this letter you are now notified of this in addition to the withdrawal of any implied consent on which you may have been previously assumed and/ or been reliant.

Please confirm by return that you have fully understood the content of this letter, specifically my rights as a data subject and the provisions under GDPR Article 22(3), and that my records will be appropriately marked for human intervention and written contact to me, as the data subject, prior to release to any and all private companies.

Failure to acknowledge this request will immediately be met with letters of complaint to the ICO and my MP.

Yours Sincerely

This is shamefully cribbed from the letter abedegno originally wrote, but a quick review of Article 22 and a few words later should hopefully steer off the template response that several people on the forum have already received about how DVLA can basically do what they want and it's ok because the ICO know about it and it's all cool and groovy, man.

Coupon-mad

I love that, Carthesis - absolutely brilliant!

Just to add another update, yesterday I thought up a new GDPR related method of fightback for anyone with a private PCN that blames the driver for 'inaccurate data', which can be:

- someone with a RingGo 'location code' error (usually brought forward from an old parking session, an assumption made by the app, excessively storing old data)

and

- someone accused of a typo in their VRN, whether they did it or the system failed.

Explained here, send the PPC a 'RECTIFICATION NOTICE' and their only options under the GDPR are to put the inaccurate data right, or say ''it is not inaccurate'' (or refuse as the request is manifestly excessive):

https://forums.moneysavingexpert.com/discussion/comment/74758441#Comment_74758441

That can be sent to a PPC at any time, even in the middle of a defended claim, or POPLA appeal.

And the PPC has to stop processing the data while they investigate, if the data subject asks!

...and even better, it then leads to an ICO complaint if the PPC refuse to rectify what they themselves already admit they KNOW is inaccurate data, where they already have another data stream (ANPR, or photos) which indisputably tells the PPC which is the correct VRN or location code...

Carthesis

Hmm.

Reading an old thread where i got into a bit of a spat with the DVLA has brought something to my attention...

As the request to obtain the keeper details was submitted using an electronic system, DVLA did not have sight of this evidence prior to the application being made. It was only once this issue was raised by yourself could DVLA investigate.

https://forums.moneysavingexpert.com/showpost.php?p=71337415&postcount=47

Am i wrong, or is this an admission (albeit one from prior to GDPR) that DVLA doesn't involve any human interference or activity in handing data out via KADOE until it is queried by someone, at which point it is too late?

Coupon-mad

Looks that way to me.

Carthesis

Coupon-mad wrote: »

Looks that way to me.

I'll save that for the inevitable rejection letter from DVLA.

Obviously, if people like my modified version of the letter, it should be taken as free to use!