June 2018 - start of the new PPC and DVLA fightback (GDPR related)

Coupon-mad

Bump to read this week! Thanks abedegno.

abedegno

I suspect the DVLA are relying on this clause:

When the decision is authorised by law.
The decision has to be authorised by law, but this doesn’t mean that there has to be a law which explicitly states that solely automated decision-making is authorised for a particular purpose. The Data Protection Act 2018 (DPA 2018) refers only to a decision which is ‘required or authorised by law’ (Chapter 2, Part 2, Section 14 (3)(b)).

If you have a statutory or common law power to do something, and automated decision-making/profiling is the most appropriate way to achieve your purpose, then you may be able to justify this type of processing as authorised by law and rely on Article 22(2)(b). However you must be able to show that it’s reasonable to do so in all the circumstances.

allcomplainsgohere

abedegno wrote: »

Their response suggests they do not appear to have read and understand your request properly.

We are not asking for a restriction of processing under article 18 of GDPR, but are instead exercising the data subjects rights for data under article 22, where entirely automated processing include a manual step.

I would suggest a response to them on those lines, and also raise a complaint with ICO for clarification.

Sure I will give it a go

beamerguy

The WHICH MAGAZINE take on this .....

Can I stop a company making automated decisions about me?

https://www.which.co.uk/consumer-rights/advice/can-i-stop-a-company-making-automated-decisions-about-me

abedegno

Got a response to my SAR from ParkingEye:

Good Afternoon,

Thank you for your email. We note that you have made a request for the following data:
Any and all information and correspondence we hold pertaining to your name and/or email address; and
Any and all ANPR data or similar information we hold relating to the vehicles with registration number XXXX XXX.

In order for us to release data, we must be able to satisfy ourselves that such data is personal data pertaining to you. You can complete the identification verification process by providing us with a copy of a signed form of identification, along with a copy of any recent documentation (last 3 months) that confirms your address (if not provided for within the signed ID).

We note that you have provided the V5c form for the vehicle but that the scan provided does not evidence the date that the vehicle was registered in your name. We would be grateful if you could provide the appropriate page of the V5c form to confirm the same and if you could confirm the period of time that you are primarily concerned with. We would also require copy insurance documentation to cover the dates for which data is sought. This will need to confirm your continued status as the registered keeper of each vehicle for that period of time and identify whether either vehicle is linked to any other named drivers and if other named drivers are identified, written confirmation from those individuals to confirm that they are content to allow data to be released to you.

In relation to your other queries as outlined in your request, our Privacy Policy which can be found at https://www.parkingeye.co.uk/privacy-policy will provide you with the information requested. If you still have questions unanswered please get in touch and we would be happy to advise.

ParkingEye have ensured that relevant signage throughout all sites meet data protection guidelines with sufficient information as to how data will be used, data subject rights and also where to find further information online.

On receipt of the above, we will review your request. If we require further information in relation to your request, we will respond and let you know.

If you have any questions about the above, please let us know by return to this email address.

Not sure why they want my insurance details.

The_Deep

You can complete the identification verification process by providing us with a copy of a signed form of identification,

Surely a driving licence covers the lot.

Castle

Section 5 of a V5 will show the date the RK acquired the vehicle.

pysspd

Can anyone clarify who is the 'data subject' - the keeper, the driver or the owner? All three could be associated with a particular registration mark and all three could be different people or they could be the same person. The reason I ask is that I have have submitted a SAR to a parking company who refuse to provide personal data they hold to me - the owner, but will at a push give it to the registered keeper. I have complained to the ICO and I am waiting for them to get back to me. Meantime, I would be interested on views on here.

beamerguy

pysspd wrote: »

Can anyone clarify who is the 'data subject' - the keeper, the driver or the owner? All three could be associated with a particular registration mark and all three could be different people or they could be the same person. The reason I ask is that I have have submitted a SAR to a parking company who refuse to provide personal data they hold to me - the owner, but will at a push give it to the registered keeper. I have complained to the ICO and I am waiting for them to get back to me. Meantime, I would be interested on views on here.

Who is the parking company ???

You have answered yourself, the Vehicle Reg info is the only access
they have which is the registered keeper.

It's not a case of "at a push" for them ..... they must reply

KeithP

abedegno wrote: »

Not sure why they want my insurance details.

They are asking for insurance details that demonstrate that you were not only the RK at the date of Issue of the V5c, but continued to be the RK throughout the period that you are requesting data for. Looks like that might almost be reasonable.

I cannot understand their interest in 'named drivers' though.
Just because there are named drivers on any insurance policy does not mean that the registration number of the RK's vehicle becomes personal date of those named drivers. That is ridiculous.