ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

abedegno

Hi all,

4 years ago I made a complaint to the ICO regarding the DVLA's refusal to comply with my request to suspend automated decision-making processes in relation to the provision of registered keeper details to private parking companies.  After nearly 4 years, I finally got a response which I enclose for perusal...

Fruitcake

Four years, and all the ICO can come up with is a bucketful of whitewash.

The DVLA release data to a PPC if they are a member of an ATA, and as a fairly recent FOI request showed, to at least one PPC that was not a member of an ATA.

No other checks are carried out.

The DVLA don't check that the data subject is a vulnerable adult, which they should be doing.
They don't check that the PPC has a right to obtain keeper data, which they should do. Own space cases are a prime example where the DVLA sell keeper data to a PPC when they have no right to do so.

I really hope the solicitors win their test cases against the DVLA where motorist's personal data has been sold without reason, and without reasonable checks being carried out.

The Police have to jump through more hoops than a PPC to obtain keeper data, which can never be right.

Trainerman

Fruitcake said:

Four years, and all the ICO can come up with is a bucketful of whitewash

The Police have to jump through more hoops than a PPC to obtain keeper data, which can never be right.

Yes but the police do not produce revenue, and in my view DVLA are all about money. Look at how they have changed rules over the years in order to take more money off us. To me, DVLA belong in the same company as PPCs anyway. I hope they DO get spanked !

patient_dream

Fruitcake said:

Four years, and all the ICO can come up with is a bucketful of whitewash.

Dear oh dear, 4 years for the ICO to write such rubbish and they never really addressed your your question.

Sadly government and their agencies continue to think that the public are idiots ?

This extreme incompetence grows once again

abedegno

Worse thing is, they didn't even answer my original complaint.  My original complaint was about the automated decision making that the DVLA undertake when they provide these details and not questioning the lawful basis that they do it.

Mouse007

How the hell can it be “in the public interest” to allow these scum scammers access to personal data?

Seriously? Surely it is the complete opposite. It is not in the public interest at all.

I’m not distracted by the right to object thereafter being blocked, somehow I get that, but the idea that it is in the public interest to provide the data in the first place must be challenged as warped falseology.

Mouse007

Changed my mind about Article 21 (1) - it is not the DVLA who are processing the information “for the establishment, exercise or defence of legal claims” it is the scammers.

The DVLA are giving the information to a third party so they can process it

Bloody bull !!!!!!

Coupon-mad

The worst thing is the ICO has managed to completely ignore your actual complaint and answered a different question.

Thanks for this, @abedegno - have passed the info on off forum.

Mouse007

well well well, from the horse's own mouth

Can we change our lawful basis?

You must determine your lawful basis before starting to process personal data. It’s important to get this right first time. If you find at a later date that your chosen basis was actually inappropriate, it will be difficult to simply swap to a different one. Even if a different basis could have applied from the start, retrospectively switching lawful basis is likely to be inherently unfair to the individual and lead to breaches of accountability and transparency requirements.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

Coupon-mad

The ICO really don't appear to be doing a great job, do they? 

Mouse007

Coupon-mad said:

The ICO really don't appear to be doing a great job, do they? 

Nope, but what are the consequences for the DVLA from "retrospectively switching lawful basis"

which is "likely to be inherently unfair" ?

That has legs for me, lots of legs like a centipede number of legs