ICO FoI Decision Notice - DVLA

steve1500

Don't think I have come across this on here before https://ico.org.uk/media/action-weve-taken/decision-notices/2018/2173189/fs50693758.pdf

I know the DN the is from last February But para's 13, 19 & 20 make for very interesting reading, especially Para 13.


The way I read it, the DVLA are supposed to ensure the PPC's are compliant with Data Protection Act & the signs certainly aren't

beamerguy

steve1500 wrote: »

Don't think I have come across this on here before https://ico.org.uk/media/action-weve-taken/decision-notices/2018/2173189/fs50693758.pdf

I know the DN the is from last February But para's 13, 19 & 20 make for very interesting reading, especially Para 13.


The way I read it, the DVLA are supposed to ensure the PPC's are compliant with Data Protection Act & the signs certainly aren't

YES ...... para 13
" The DVLA is able to disclose that information from its vehicle record if a person can demonstrate ‘reasonable cause’ to have it. Disclosure of this information under ‘reasonable cause’ is permitted"

Interesting wording ?

The PPC's run on auto service from the DVLA as they belong to an ATA. It would be impossible for the DVLA to assume reasonable cause with the millions of requests

Maybe for every ticket issued by PPC's, a request should be made to the DVLA requesting what was the "reasonable cause" given.

Could it be something as trivial as "wrong reg number entered" ?

The_Deep

Indeed, what is reasonable cause? Is a faulty parking meter reasonable cause? how about leaving within the grace period, leaving site, double entry, parking slightly outside a bay?

Umkomaas

28. With prior knowledge of how another company responded to issues identified during a past audit and going on to obtain a green/pass rating, a company being audited may provide the DVLA with the same kind of explanations as that provided previously by other companies. The DVLA stated that while its processes are likely to identify any false or fraudulent evidence or information being provided, a company that might be desperate to pass an audit (driven perhaps by the criticality of the supply of DVLA data to its business) might be tempted to resort to such undesirable tactics.

The DVLA must either be totally naive or acting in a protectionist role. Is it not beyond their imagination that any ATA worth its salt, looking after the interests of their paying members, by facilitating as easy an access as possible to data (and money), would not have already produced guidelines/advice, based on other PPCs' experiences of audits, to all its members?

Smells a bit fishy!

DragonCart

Reading the KADOE contract, it says

"The DVLA shall provide each requested item of Data to the Customer via the KADOE Service for the Reasonable Cause of enabling the Customer to:
a) seek recovery of unpaid Parking Charges in accordance with the Accredited Trade Association Code of Practice, and using the procedure in Schedule 4 to the Protection of Freedoms Act 2012 (where the vehicle was parked on private land in England or Wales on a particular date); and
b) otherwise seek recovery from a driver of unpaid Parking Charges in accordance with the Accredited Trade Association Code of Practice (where the vehicle was parked on private land in Scotland or Northern Ireland by that driver on a particular date, or where the Customer has chosen not to pursue, or is not in a position to pursue the vehicle keeper by utilising conditions in Schedule 4 of the Protection of Freedoms Act 2012)."
Does this mean that if the PPC doesn't make a request using POFA, they're not eligible to make a request under KADOE, and were they to make a request through KADOE and then not cite POFA in their NTK, they'd have acquired the data illegally?

KeithP

DragonCart wrote: »

Does this mean that if the PPC doesn't make a request using POFA, they're not eligible to make a request under KADOE, and were they to make a request through KADOE and then not cite POFA in their NTK, they'd have acquired the data illegally?

No it does not mean that.

It means that the PPC can get the keeper details to:

a) pursue the keeper under POFA, and/or

b) ask the keeper for the driver's details.

DragonCart

But can they pursue the keeper not under POFA on the 'reasonable assumption' the keeper is the driver? Apologies, this does seem like a riddle at times!

KeithP

DragonCart wrote: »

But can they pursue the keeper not under POFA on the 'reasonable assumption' the keeper is the driver? Apologies, this does seem like a riddle at times!

No, but as I said, they can get the keeper's details from the DVLA in order to ask the keeper for the driver's details.

DragonCart

Ok thanks Keith. So having obtained the keeper's details to ask for information on the driver, if no information is provided what next, for example in a hypothetical situation where POFA isn't used and they've said 'we will continue to pursue this matter on the reasonable assumption that the keeper was the driver until evidence to the contrary is provided.'
It is very confusing, as in this circumstance, have they not misused the KADOE process (Only for use to pursue the keeper under POFA or to ask the keeper for driver's details) to buy the personal information of the keeper in order to pursue them as the driver not under POFA, and this would have resulted in the DVLA committing a breach of the DPA and the PPC misleadingly acquiring personal data?

KeithP

DragonCart, perhaps this discussion should be elsewhere.

You seem to be dragging this thread a bit off topic.

steve1500

The part about para 13 is

The audit process is necessary to ascertain whether any person has failed to comply with this legislation and the Data Protection Act 1998.

This applies to the PPC's