June 2018 - start of the new PPC and DVLA fightback (GDPR related)

sparkyhx

one curious thought, if the contract is with the driver, and there could be multiple drivers, are they within their rights to only give the details instances where the driver self declares specific dates?

Could they argue against blanket disclosing all other vehicle entrances.

I still have 4 other cars I have access to up my sleeves, yet

Castle

sparkyhx wrote: »

one curious thought, if the contract is with the driver, and there could be multiple drivers, are they within their rights to only give the details instances where the driver self declares specific dates?

Could they argue against blanket disclosing all other vehicle entrances.

I still have 4 other cars I have access to up my sleeves, yet

The Vehicle Registration number is personal data and any processing on it is subject to DPA2018/GDPR

Mackers12

I complained to the DVLA recently (using the helpful advice on this thread) about the automated nature of handing over / selling my data to PPCs through KADOE without any checks or balances in place. I received the response below, which I found to be frustratingly disregarding and useless (and may probably a generic cut and paste). Have also complained to POPLA, BPA, my MP, Sir Greg Knight and sent a SAR to the landowner Welcome Break. Feel like banging my head against a wall...

Side note - but interestingly - the internals emails I got from the WB SAR show how they are happy to lie to motorists "just tell them you can't cancel it", and to ignore complaints that look like they have been supported by internet forums of people trying to dodge parking fees... I'm now boycotting WB.

---

Thank you for your email of 23 November to David Dunford about the release of
information from the Driver and Vehicle Licensing Agency (DVLA) vehicle records and
your request under Article 22 of the General Data Protection Regulations (GDPR). I have
been asked to reply and I apologise for the delayed response.

I would like to start by assuring you that that the DVLA takes the protection and security of
its data very seriously and has procedures in place to ensure data is disclosed only where
it is lawful and fair to do so.

I would also like to make it clear that while the DVLA uses an electronic link to provide
registered keeper details, we do not use automated decision making, as described in the
Data Protection Act (DPA). There is no requirement for a decision to be made to disclose
information at the time an application is received. The request is received and processed
in accordance with the terms and conditions of the contractual agreement between the
DVLA and the parking company and therefore this does not constitute automated decision
making.

Regulation 27(1)(e) of the Road Vehicle (Registration and Licensing) Regulations 2002
provides a legal gateway to disclose information contained in the UK vehicle register to
‘any person who can show to the satisfaction of the Secretary of State that he has
reasonable cause for wanting the particular to be made available to him’. An express right
has been established in law for the sharing of data in certain prescribed circumstances,
including for private parking management. The consent of the data subject is not required
where processing takes place under these conditions.

The DVLA exercises the Secretary of State’s discretion where it has the powers to do so.
The registered keeper of a vehicle is the person who, under UK law, accepts responsibility
for the vehicle and its use. If a vehicle is involved in an incident or contravention, the
registered keeper is the first point of contact to determine who may be responsible and for
the necessary action to be taken. Refusal to disclose these details to private car parking
management companies would mean that motorists would be able to park on private land
with disregard for the conditions applying with little prospect of being held to account.

The package of measures the DVLA has in place for parking management companies
using the KADOE system which includes provisions such as strict contractual conditions,
the requirement for Accredited Trade Association membership and stringent audit
procedure, means that the Secretary of State is lawfully exercising his powers of
discretion. When an organisation makes a large number of standardised requests, with
identical circumstances, we consider it reasonable to have electronic processes in place to
deal with these requests efficiently. Due to the volume of requests it would not be
reasonable to expect every request to be individually checked.

This situation has not changed with the introduction of the GDPR. The DVLA will continue
to share personal data with law enforcement agencies, other government departments and
other third parties where the law allows us to do so. We have robust procedures in place
to ensure that all our data sharing activities comply with the DPA.

The DVLA is unable to mark your vehicle record as frozen. As previously stated,
Regulation 27(1)(e) provides a legal gateway to disclose information where reasonable
cause has been met.

You have the right to complain to the Information Commissioner’s Office if you believe that
the DVLA has not handled your request to exercise your right appropriately. Please write
to The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9
5AF.

Finally, with regard to your concerns about POPLA, the DVLA has been assured that the
adjudicators for the appeals services are required to be entirely independent and impartial
and not accountable to the car park operator in any way in their adjudication of the appeal.
The appeal outcome is binding on the operator but not on the motorists who is always free
to continue to contest a disputed charge. The appeals process is offered to motorists free
of charge.

I hope this helps to explain the position on this matter.

beamerguy

Finally, with regard to your concerns about POPLA, the DVLA has been assured that the adjudicators for the appeals services are required to be entirely independent and impartial and not accountable to the car park operator in any way in their adjudication of the appeal.

What level of competence is a different story with POPLA, the DVLA or the BPA don't check that

Umkomaas

Side note - but interestingly - the internals emails I got from the WB SAR show how they are happy to lie to motorists "just tell them you can't cancel it", and to ignore complaints that look like they have been supported by internet forums of people trying to dodge parking fees

I think I'd be copying that to your local MP and Sir Greg. Why not also flag it up on the WB TripAdvisor, Facebook, Twitter pages so other users know of their seeming disregard for their customers.

Why not ask the BPA to take a look and investigate how their member is encouraging WB to distort the truth in favour of the PPC.

Computersaysno

Mackers12 wrote: »

Side note - but interestingly - the internals emails I got from the WB SAR show how they are happy to lie to motorists "just tell them you can't cancel it", and to ignore complaints that look like they have been supported by internet forums of people trying to dodge parking fees... I'm now boycotting WB..

Who are WB???????????

Umkomaas

Computersaysno wrote: »

Who are WB???????????

Welcome Break. First para, post #184.

jonehboy

I would like to start by assuring you that that the DVLA takes the protection and security of
its data very seriously and has procedures in place to ensure data is disclosed only where
it is lawful and fair to do so

This made me laugh out loud. The RK for a parking invoice I'm helping with complained to the DVLA regarding the handling of personal data as per the newbie thread and they replied to the complaint with someone else's private data! Wrong car, wrong date and wrong data. Followed up with a complaint stating "I hope the irony isn't lost on you here".


The RK is currently at the debt collector stage. I'll be sure to start my own thread when or if it progresses

abedegno

So the final update from the ICO on my complaint regarding ParkingEye and their data retention policies:

Dear Abedegno


We write further to previous correspondence. We have now received a further response in relation to your concern and are in a position to provide our view. Thank you for your patience throughout this case.

We advised ParkingEye in our email of 5 November 2018 that its retention period for non-contravention data appeared to be excessive. Having reviewed the information provided to the ICO we remain of the view that ParkingEye’s current retention period for non-contravention parking data is excessive, and would not be compliant with Article 5 (1) (e) of GDPR.

As set out in the ICO’s surveillance code of practice, where a controller continues to retain ANPR data after it has been determined that vehicles have not exceeded the parking limit, it is unnecessary and unlikely to comply with the data protection principles.

We understand ParkingEye is in the process of conducting a review of its retention periods, and we have provided the organisation with our view of its current policy. Further to this we have provided advice and guidance on the issue of retention, specifically in relation to ‘non-contravention parking data’.

We expect ParkingEye to consider our view when reviewing its policies and procedures.

Although we do not intend to take any further regulatory action in relation to this complaint at this time, we will keep details of this concern on file. Information gathered from concerns may form the basis for formal regulatory action in the future where appropriate.

We would like to thank you for bringing this matter to our attention. Should you wish to discuss this case further please do not hesitate to contact me.

Yours sincerely

The ICO

So the ICO's view is ParkingEye are not compliant with Article 5 (1) (e) of GDPR.

They won't take formal action at present - but no doubt if they received enough complaints about ParkingEye's data protection practices they would.

This, of course, doesn't stop me (or anyone else) starting a private county court claim against them...

Umkomaas

Well done for your persistence on this. A bit of a poke in the eye for ParkingEye! A bit of a damp response from the ICO in terms of proactively monitoring whether PE do anything whatsoever to comply.