June 2018 - start of the new PPC and DVLA fightback (GDPR related)

Castle

steve1500 wrote: »

Thought I'd bump this, plus, one obvious candidate we seemed to have missed off hitting with a SAR


Gladstones

You can also add, (if you've ever contacted them):-
1) BPA
2) IPC (which would cover the IAS)
3) POPLA

Raxiel

Coupon-mad wrote: »

I know that people can be exempted under certain circumstances, not sure what apart from diplomatic immunity or maybe a disabled and vulnerable non-driving or child registered keeper.

But I am of the view that people should ask and should complain more, and should now BOMBARD the DVLA about this subject.

I agree that people can certainly now validly ambush the DVLA with requests to either be 'exempted' so their data is blocked from private parking firms, or alternatively ask that the file is noted that the data subject requires the DVLA to never release their data without first:

- writing to tell them, and
- prove that the decision has been manually checked and not processed automatically, and
- allow them a suitable, stated period of time to object, as per the GDPR.

If you don't ask, you don't get.

I'll be writing to the DVLA myself, because why not? But I do wonder how the industry will react to this. What would the implication for POFA compliant NTK's? Even if the DVLA worked hard to benefit the PPC's, by the time they informed the keeper of the request, gave the keeper time to respond, reconsidered after the inevitable objection, released the info to the PPC anyway for them to issues their NTK.

How could the NTK possibly be served in time? I don't see how it could, which I realise is kind of the point. A boon for the motorist but clearly at odds with parliament's intention with schedule 4.

If the DVLA's initial contact included all the required NTK information would that count? Will the DVLA become a forwarding service for private ''''fines'''' in order to protect (and possibly boost) that particular income stream? Interesting times ahead I think.

That said, given the number of people who still think private tickets are completely unenforceable and should be ignored (up to the point high court bailiffs appear at the doorstep). Unless it gains real momentum, perhaps those that exercise their GDPR rights will just go into the same 'too hard, just debt collector spam' pile that a lot of us that put up a proper fight already end up on.

Umkomaas

Just read a very detailed SAR request over on PePiPoo. For anyone about to drop a SAR-bomb, this might be good starting point for constructing it.

http://forums.pepipoo.com/index.php?showtopic=114450&pid=1388235&st=300!!!entry1388235

Scroll down the page to post #311

EDIT TO ADD
MSE poster abedegno has added some additional comments on this in posts 45 and 47 below. Please read through the comments and check out the links within the posts which will help formulate a SAR which is more 'surgical' than a lengthy, 'kitchen sink' version.

abedegno

Umkomaas wrote: »

Just read a very detailed SAR request over on PePiPoo. For anyone about to drop a SAR-bomb, this might be good starting point for constructing it.

http://forums.pepipoo.com/index.php?showtopic=114450&pid=1388235&st=300!!!entry1388235

Scroll down the page to post #311

Don't use that template, it was written by Constantine Karbaliotis as a marketing exercise when he was at Nymity and in March 2017 before the GDPR legislation was made final. All the requests about security, firewalls, routers etc is not covered under right of access and too broad.

Umkomaas

abedegno wrote: »

Don't use that template, it was written by Constantine Karbaliotis as a marketing exercise when he was at Nymity and in March 2017 before the GDPR legislation was made final. All the requests about security, firewalls, routers etc is not covered under right of access and too broad.

PePiPoo poster Baconrasher (who apparently earns their living from DPA/GDPR stuff) seems to have given it the thumbs up.

That looks like a pretty good list of stuff - should keep them busy for a few days. They may also trip themselves up by providing the 'wrong' answers.

An interesting thought occurred to me:
In quite a few cases POFA does not apply, and the PPC has been informed of this (or they have confirmed it). A lot of people send a S.10 notice under the old DPA98; there is similar clause in DPA18 but I can't recall the number. The new rules require the PPC to restrict processing of data that is disputed (or in fact that they should know is disputed). One way of restricting processing is to not pass this on to debt collectors (which they routinely do). This could be a futrher way of attacking their mishandling of data. Just a thought.

Bacon
(Incidentally, I do this GDPR/DPA stuff for a living)

I'm not attempting to play one off against the other, but as I'm no expert in this stuff (at the moment), I took Bacon's advice/endorsement at face value.

On thing I think for sure is that we need a decent template that OPs (many of whom will be very nervous about 'upsetting' a PPC) can more or less just 'top and tail', then leave the problem of dealing with the SAR firmly at the door of the PPC.

@abedegno - does the linked SAR have the basis for some adjusting to form a template, or are you saying it is way off the mark?

abedegno

The original article is here:
https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/


Constantine has updated the article to warn people against using it as a template:

I do want to address something brought to my attention recently—a couple of people have used my nightmare letter as a copy-and-paste subject access request. Please don’t do that. The letter is meant, as I set out, to test and remediate #SAR processes. It is extremely unlikely that all the issues raised in this letter could arise out of your personal fact situation. Using this as a cut-and-paste will get (legitimately) get a very limited response to a SAR, undermine your credibility, and may not get you much support from a supervisory authority if you are not happy with the response.

I have personally used it as a starting point, with additional guidance from the ICO website here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ as to what can actually be asked for under GDPR. I posted my template earlier on this thread here: https://forums.moneysavingexpert.com/showpost.php?p=74351914&postcount=4

Umkomaas

@abedegno - I've just added a cautionary paragraph to my original post which linked the PePiPoo posting, to encourage posters to read your subsequent inputs and links before any blind copying and pasting.

Coupon-mad

What would the implication for POFA compliant NTK's?

Even if the DVLA worked hard to benefit the PPC's, by the time they informed the keeper of the request, gave the keeper time to respond, reconsidered after the inevitable objection, released the info to the PPC anyway for them to issues their NTK.

Exactly, that is one of the reasons to send this to the DVLA, forbidding them to make 'automated decisions' and requiring that you note your instruction that you are a previous PPC victim (if true) who categorically prohibits the DVLA just sending your data out as if it was on a conveyor belt under the automated KADOE system, because that breaches the GDPR rules about automated decision-making, which the DVLA GDPR statement says they promise not to do.

So, if everyone who is a car owner keeper, and who has or has ever have had a private PCN (or even those who have not) now bombards the DVLA with this statement, and tells the DVLA they MUST inform you first before releasing your data and to whom they intend to release it, and why, then there will be NO timely NTKs!

LOL.

At the very least, the DVLA will be stretched to respond all the time, day in day out, even if they are saying, tough. And if they do say tough then they can be reported to the ICO, which is easy (online) and worth a try to expose the DVLA for their automated conveyor belt processing of data bought by the scum of Society.

I have no time right now to write any templates:

(a) to send to the DVLA, which should mention the applicable section of the GDPR about not making automated decisions, and informing the data subject before sharing data

and

(b) to send to a PPC

...so the efforts made so far are good to see, to point people in the right direction.

EDIT

I did just see a suggested SAR on this pepipoo thread and posted some wording for obtaining ANPR images and data held emanating from all other data streams including ''exact or near-miss'' VRN data from any ticket machine:

http://forums.pepipoo.com/index.php?showtopic=120679

ANPR cases - you will always want all letters/PCN/NTK and all images, but consider also any other data streams.

PDT machine - you might want 'exact and near-miss VRN data' if there's a suggestion of a typo.

PDT machine where you put in the wrong VRN - you'd be asking for all data stream info for both VRNs.

Permit (residents car park) cases - you'd want all photos, all letters/the PCN & NTK, and you should ask for all ''whitelist'' data about your car and/or complaints you might have made that were shared by the Managing Agent with the parking firm. And/or all copies of letters or emails ever sent to your home or email address about the 'permit scheme' and all data held from the initial 'due diligence' checks they and the Managing Agent made* to ensure no unconscionable PCNs would be issued to residents who already enjoyed the right to park and/or all responses made to the introduction of the scheme and the percentage of residents who agreed or objected and any formal variation of the leases that occurred to enable the onerous nuisance of a parking firm to override residents' existing primacy of contract.





*read - ''didn't make''

ttp2120

im looking to write a SAR to a solicitors who are trying to con my partner. Im not sure how I would use the example above as the company are not chasing her its the solictors(debt collectors now)

foxy-stoat

Once a good template has been posted I will send it DVLA for the 3 vehicles our household has.