Almost Imminent Court Case pending with VCS

Loum5

Good spot, thank you - and swiftly corrected!

Fruitcake

I spent a fragrant time this morning trying to work out why my sewer is backing up. Having done some more research I find I have an abundance of merd I can offer the OP to throw at the scammers regarding the data breach.

From the DVLA KADOE contract that the scammers must use and abide by in order to obtain keeper data via electronic means,

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/455973/Annex_A_-_KADOE_Fee_Paying_Contract_V4.pdf

Section D5

D5. Restrictions on Disclosure of the Data

D5.1. The Customer shall respect the confidentiality of the Data and shall not disclose it to any person, except in the following circumstances:

Note the mandatory requirements of the contract by using the words, "shall" and "shall not". This is not negotiable or optional.

Non of the circumstances that follow allow the scammers to send personal data to someone who is not the data subject of that data.

Section D10

D10. Incidents

D10.1. The Customer shall notify the DVLA immediately of any losses or misuse of the Data and keep the DVLA informed of any communications about that breach with: the individuals whose Personal Data is affected; the Information Commissioner’s Office; or the media.

Give it a couple of days and then ask the DVLA if both VCS and Excel have complied with this section of the KADOE contract by informing them that an "incident" has occurred.

This data breach could be construed as an "irremediable breach" as per section J2,

J2. Termination for Material Breach

J2.2. The events are the Breaching Party committing:
a) an irremediable Material Breach of this Contract;

… which could be enough to warrant a termination for breach as per section J3.

J3. Suspension of the KADOE Service

J3.1. If it comes to the attention of the DVLA that the Customer has committed any Default (including Material Breaches and all other Defaults), the DVLA may suspend the KADOE Service without further notice and with immediate effect and investigate the nature and effect of the breach.

The data has been sent to someone other than the data subject. It cannot be unseen therefore this breach is irremediable.

It could also be argued that VCS staff are not authorised to see the data which would constitute another breach.

Anyway, I suggest the OP sends a complaint to the DVLA along those lines. I do not believe this contravenes the advice from the ICO which is a separate complaint to a separate government body.
The ICO complaint is about a data breach.
The DVLA complaint is about a KADOE contract breach.

Loum5

Thank you so much for this Fruitcake - you are quite simply a legend.

An update from me is that I the person whose details I received called me yesterday after receiving my letter. I couldn't really talk as was away on a work trip, but will be calling them later to get them onboard with reporting this, which they are keen to do.

I have received a letter today from the scammers themselves advising they are confident they have a strong case against me to recover the charges plus additional costs, but would be willing to drop the case if I cough up £125 in the next 14 days - and if I don't accept it they will bring the letter to the Courts' attention upon the question of costs.

I've pretty much got my WS to where I want it - just a couple of things I need to update from the amazing assistance Fruitcake has been giving me, and will repost it soon in the hope any of you wonderful folks might scrutinise it for me before I get it sent off (it is currently at 9 pages which a couple of weeks ago I couldn't get past 2 sentences!!!!).

Loum5

Hello, I have a question for Coupon-mad, or anyone else that may be able to assist if you don't mind.....

Re the 'abuse of process' - I was initially going to add the whole section to the end of my WS, then I noticed in post 14 of the thread you say 'you can use this entire section as a SUPPLEMENTARY WITNESS STATEMENT to accompany your WS 'story of what happened'.

Pardon my inexperience, but should this be a completely separate document to my factual WS? I'm just confused how I add this into my bundle and looking for a little guidance here please?

Coupon-mad

I say make it a separate document.

Fruitcake

Have you made the complaint to the DVLA yet? It won't take much more than a copy and paste of the relevant parts of my previous post.
A serious KADOE breach like this might focus the scammers minds away from your case if they are being pressurised by the DVLA.
Given that this happened a week ago there is no reason why you can't ask the DVLA if the scammers have complied with the "immediate" part of section D 10. Incidents.

As I said previously, this is separate to your ICO complaint about a data breach. This is a query about a KADOE breach.

Loum5

Fruitcake wrote: »

Have you made the complaint to the DVLA yet? It won't take much more than a copy and paste of the relevant parts of my previous post.
A serious KADOE breach like this might focus the scammers minds away from your case if they are being pressurised by the DVLA.
Given that this happened a week ago there is no reason why you can't ask the DVLA if the scammers have complied with the "immediate" part of section D 10. Incidents.

As I said previously, this is separate to your ICO complaint about a data breach. This is a query about a KADOE breach.

I haven't yet, but I will - One point - I did not name the person in my complaint to the DPO - I did however put in my court claim number so they should easily be able to locate my details and view the WS containing the breached documents to find out who has been breached - I suspect they have also sent this persons details to the court, as in their WS I received the pages are numbered 6, 7 & 8 in between the copy of my original defence and their WS!!

Loum5

Coupon-mad wrote: »

I say make it a separate document, I think NorfolkBOI has posted a good example. Also see how I mentioned it in the last few paras of this WS:

https://forums.moneysavingexpert.com/discussion/comment/76532184#Comment_76532184

Perfect, thank you - I have stumbled across this example before now too, so will work on this tonight

Fruitcake

Loum5 wrote: »

I haven't yet, but I will - One point - I did not name the person in my complaint to the DPO - I did however put in my court claim number so they should easily be able to locate my details and view the WS containing the breached documents to find out who has been breached - I suspect they have also sent this persons details to the court, as in their WS I received the pages are numbered 6, 7 & 8 in between the copy of my original defence and their WS!!

I don't think it will hurt to tell the DVLA the identity of the person whose documents you have received as they will need to see the evidence for themselves in order to take action.

Do make issue that VCS and Excel are different companies according to Companies House to imply that this is not just a simple KADOE breach by the scammers, but a DPA/GDPR breach between the companies themselves.

Loum5

Fruitcake wrote: »

I don't think it will hurt to tell the DVLA the identity of the person whose documents you have received as they will need to see the evidence for themselves in order to take action.

Do make issue that VCS and Excel are different companies according to Companies House to imply that this is not just a simple KADOE breach by the scammers, but a DPA/GDPR breach between the companies themselves.

I had already sent the complaint to the DVLA not disclosing the person's identity before I read this with the following content (in the hope they will contact me for further info):

I would like to inform you of a situation with relation to a breach in DPA/GDPR that is also a breach of your KADOE contract.

I am currently in the process of being taken to court by VCS (Vehicle Control Services) for an unpaid PCN. They sent me their Witness Statement ("WS") via post which I received on 19th November. This document contained copies of sensitive information for a person with no association to me concerning Excel Parking Services (the sister company of VCS based at the same address). I have written to the person concerned to advise of the breach as the information received includes their name and address along with other sensitive information.

These companies have retrieved our data through your KADOE agreement with them. On 20th November I emailed the Data Protection Officer of VCS to begin the complaints process as advised by the ICO.

In your KADOE contract it is stated:

D10. Incidents

D10.1. The Customer shall notify the DVLA immediately of any losses or misuse of the Data and keep the DVLA informed of any communications about that breach with: the individuals whose Personal Data is affected; the Information Commissioner’s Office; or the media.

J2. Termination for Material Breach

J2.2. The events are the Breaching Party committing:
a) an irremediable Material Breach of this Contract;

J3. Suspension of the KADOE Service

J3.1. If it comes to the attention of the DVLA that the Customer has committed any Default (including Material Breaches and all other Defaults), the DVLA may suspend the KADOE Service without further notice and with immediate effect and investigate the nature and effect of the breach.

I would therefore like to bring this to your attention to ensure that you have been notified of this serious breach and misuse of personal data, that was initially supplied to these companies by the DVLA.

I would be happy to discuss this with you in more detail on the telephone number supplied in this complaint, or via email.