DVLA MISUSE OF PERSONAL DATA UNDER GDPR - GROUP ACTION - NO WIN, NO FEE

Umkomaas

Despite a few misuses of the 'F' word, this firm of solicitors (the key partners are American Attorneys) are seemingly about to tackle the DVLA head on over their supply of personal data to PPCs. It's not absolutely clear from their website whether it applies only to those who have actually paid their PCN or whether to anyone issued with a NtK?  Applies to England and Wales only.  Credit to the PePiPoo Flame Pit forum. 

Here's the link to the website:

https://kellerlenkner-databreach.co.uk/dvla/

https://find-and-update.company-information.service.gov.uk/company/11937792/officers

PePiPoo thread:

http://forums.pepipoo.com/index.php?showtopic=140689

patient_dream

"In total, around 16 million people may be affected by this illegal handling of data.

If you have received a private parking fine between 2019 and 2021, the DVLA could have breached your data and you could be due thousands of pounds in compensation."

As per the solictors.  ^^

I think we all consider this as a data breach

bargepole

The relevant legislation that the DVLA rely upon, is section 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002:

27.—(1) The Secretary of State may make any particulars contained in the register available for use—
(e)by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him.

The key words here are 'may' (not 'must'), and 'reasonable cause'.

The DVLA's position is that, if a PPC is a member of an approved ATA (BPA or IPC), they are deemed ipso facto to be acting in compliance with that body's Code of Practice, and are therefore entitled to request and obtain keeper data. The vast majority of such requests are done electronically via the KADOE system, with no intervention from any member of DVLA staff, at £2.50 per request.

However, as seen daily on this forum and elsewhere, many BPA and IPC members do not act in accordance with the relevant CoP, which is one of the reasons why Government is in the process of replacing both of those with a new statutory version.

Interestingly, the UK is the only country in Europe, and possibly the world, whose Government sells citizens' personal data to private companies. If this group action gains traction and reaches the High Court, it will be quite a bunfight. Certain senior officers at the DVLA receive substantial annual bonuses based on the volume of data sold, and they will fight like ferrets in a sack to defend that.

patient_dream

bargepole said:

Certain senior officers at the DVLA receive substantial annual bonuses based on the volume of data sold, and they will fight like ferrets in a sack to defend that.

Is this a true fact ? If so, this would make headline news especially as the DVLA insist they don't make a profit 
Is there proof on this ?

Fruitcake

My relative got one of the bog standard, "the PPC are a member of an old boys club, so had reasonable cause to request personal data" from the DVLA KADOE team.

When I am not so busy I am going to help him complain to the ICO about VCS, Excel, Bristol Airport, and the DVLA about this very thing.
We actually included proof that the alleged event occurred outside the area that VCS are contracted to infest, and although the car was stopped, it was outside the No Stopping zone, and there was no signage at all, but the DVLA just whitewashed it using the "reasonable cause" excuse.
No oversite at all, despite them being data handlers.

Half_way

Fruitcake said:

My relative got one of the bog standard, "the PPC are a member of an old boys club, so had reasonable cause to request personal data" from the DVLA KADOE team.

When I am not so busy I am going to help him complain to the ICO about VCS, Excel, Bristol Airport, and the DVLA about this very thing.
We actually included proof that the alleged event occurred outside the area that VCS are contracted to infest, and although the car was stopped, it was outside the No Stopping zone, and there was no signage at all, but the DVLA just whitewashed it using the "reasonable cause" excuse.
No oversite at all, despite them being data handlers.

And when did the DVLa last audit/check the old boys clubs to ensure they are enforcing their own rules on their members?

 the last thing i heard was that the BPA ltd do not regulate their members  - I'm sure someone had that as a reply to a complaint at one time

Umkomaas

Half_way said:

Fruitcake said:

My relative got one of the bog standard, "the PPC are a member of an old boys club, so had reasonable cause to request personal data" from the DVLA KADOE team.

When I am not so busy I am going to help him complain to the ICO about VCS, Excel, Bristol Airport, and the DVLA about this very thing.
We actually included proof that the alleged event occurred outside the area that VCS are contracted to infest, and although the car was stopped, it was outside the No Stopping zone, and there was no signage at all, but the DVLA just whitewashed it using the "reasonable cause" excuse.
No oversite at all, despite them being data handlers.

And when did the DVLa last audit/check the old boys clubs to ensure they are enforcing their own rules on their members?

 the last thing i heard was that the BPA ltd do not regulate their members  - I'm sure someone had that as a reply to a complaint at one time

The DVLA in sidestepping criticism regularly describe the BPA as 'regulators'; the BPA regularly say they are not!  Where does that leave anything?

ParkingMad

The Government Internal Audit Agency (GIAA) carries out audits of PPCs for the DVLA. This FOI request shows the ratings given, from Red (worst), to Green (best), for the past 6 years.

https://www.whatdotheyknow.com/request/772618/response/1846692/attach/3/FOI%20057%20Final%20Response%20letter.pdf?cookie_passthrough=1

Definition of Red, Amber and Green ratings -

patient_dream

The DVLA and the BPA have a cosy relationship which is NOT in the interests of the public
Once the new code of practice kicks in together with an independent appeals service, I think most of  us would question why there is the BPA as they will only collect monies from parking companies so they can get our data from the DVLA, no other regulation required.

If the DVLA has the same cosy relationship with the IPC, they must be aware that the IPC/IAS operate only for profit to line the pockets of debt collectors and legals

I am fully aware that the DVLA is an agency for the government. Do the government carefully look into the DVLA and their auditing of the private parking industry and in particular the BPA and IPC. .. IT SEEMS NOT
This could well be the subect of a select committee to discover what is actually going on.

I asked the question above where Bargepole said  "Certain senior officers at the DVLA receive substantial annual bonuses based on the volume of data sold, and they will fight like ferrets in a sack to defend that".

I am sure that everyone agrees that this would be a "watergate" for the DVLA ... if it is true.

As this is vital information, the media should be involved on this



  

Half_way

Maybe the DVLA describing the BPA ltd as regulators should be added into every complaint, telling the BPA that according to the DVLA they are the regulatory body for [name of ppc] and as such they need to follow up on the complaint and take the appropriate action.

 Every time they state they are not its another bit of evidence to use against the DVLA

As for the DVLA data tap, i have been involved with several organisations, and where that involvement has meant that i have had access to members details i have had to had a clean enhanced CRB/DBS check.

As far as i know no such checking or requirements for PPC staff is in place.

 This means that in theory a  PPC employee with previous criminal convictions could use this data to track someone, lets say an Ex girlfriend/wife. He is forbidden from seeing her or the children, but with the VRN and access  the DVLA KODOE tap turned on then all that information is there

other situations could also exist:

 A family member goes to the hospital for an appointment which needs to be kept confidential from the family and wider community - if it got out then that could put the person in danger, shouldnt be a problem as the NHS takes patient confidentiality seriously - or does it? - Vehicle get s a parking charge notice, driver ( who visited hospital) isnt the Registered keeper, registered keeper finds out that that person - the driver has been to the hospital and not a friends house and then we have an issue.

 An extreme example, however i wouldnt be surprised that a PPC sending info as to a vehicle location to the RK has caused issues for the driver on the day

Le_Kirk

Some familiar names on that list with a RED label!