ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

Coupon-mad

I have also received the court transcript for the case of Farrer v Secretary of State for Transport [2002] EWHC (Admin) which I can post a link to if anyone is interested.

Yes please, we'd like to read that.

Ed2022

@patient_dream Re: DfT... disorganised chaos without giving too much away.

@pinkelephant12 Couldn't find anything on bailii.org

pinkelephant12

@Coupon-mad Link to Farrer v SoS for Transport [2002] EWHC (Admin)

https://mega.nz/file/W6IUiYKC#SxSR1ViNFv03F7SmiCccn_Wu9pi0Yacuu-wkJZASSXM

You may need to paste the link into your browser rather than click on it.

Apologies for the poor quality as it is printed on grey paper in small font.  

DVLA also sent a reminder about the changes to the law since this case (a-d):

Umkomaas

pinkelephant12 said:

@Coupon-mad Link to Farrer v SoS for Transport [2002] EWHC (Admin)

https://mega.nz/file/W6IUiYKC#SxSR1ViNFv03F7SmiCccn_Wu9pi0Yacuu-wkJZASSXM

You may need to paste the link into your browser rather than click on it.

Apologies for the poor quality as it is printed on grey paper in small font.  

DVLA also sent a reminder about the changes to the law since this case (a-d):

I don't think they've got c (ii) correct. 

pinkelephant12

Umkomaas said:

pinkelephant12 said:

@Coupon-mad Link to Farrer v SoS for Transport [2002] EWHC (Admin)

https://mega.nz/file/W6IUiYKC#SxSR1ViNFv03F7SmiCccn_Wu9pi0Yacuu-wkJZASSXM

You may need to paste the link into your browser rather than click on it.

Apologies for the poor quality as it is printed on grey paper in small font.  

DVLA also sent a reminder about the changes to the law since this case (a-d):

I don't think they've got c (ii) correct. 

I agree. DVLA's interpretation of the law is very interesting.

pinkelephant12

Ed2022 said:

@patient_dream Re: DfT... disorganised chaos without giving too much away.

@pinkelephant12 Couldn't find anything on bailii.org

I have contacted bailii.org and asked them to add this case.

pinkelephant12

A quick update.

Just a reminder, I have been trying to find out whether DVLA would allow residents to object to the release of keeper details to a specific PPC in ‘own space’ situations as a result of the ICO’s published Opinion.

https://ico.org.uk/media/about-the-ico/documents/4020676/dvla-opinion-20220613.pdf

I didn’t make any progress by pursuing this with DVLA, so escalated this to the DPO at the Department for Transport (she is DPO for DVLA too).

Her response made the following points:

• Electronic marker can be placed against a vehicle but it restricts use of DVLA online services and DVLA couldn’t refuse a request if there was a legitimate reason for the release of a keeper’s details.

• This is usually only done when disclosure of a person’s address may affect their personal safety (this has always been the case, so no changes as a result of the ICO’s Opinion).

• I made various suggestions as to how an objection could be accommodated e.g. an opt out form countersigned by the land owner.  The response: “the Agency has no statutory function that would require the processing of that additional information”.

Basically, they aren’t prepared to make any adjustment as a result of the ICO’s Opinion.

At my request, she gave the address for service of court papers as: DVLA Legal Team, C3, Longview Road, Morriston, Swansea, SA6 7JL

Email: DVLA.Legal@dvla.gov.uk

Coupon-mad

Imagine my surprise!

IMHO the DVLA are completely in the pocket of the BPA, in that (despite delays reported in all DVLA services involving consumers) they are known to make time for chatty meetings with their mates at the BPA every Thursday, I hear.

Anyone who questions the DVLA re them apparently favouring rogue PPCs gets a template response, as you know.  At least you got a bespoke reply.

The DVLA appear to care more about parking operators rights than consumer rights.  Thank Goodness they/The DFT are not involved in writing or considering the new statutory Code.

fisherjim

I think the dodgy DVLA who are basically not fit for purpose are more interested in the auto money collection link with the PPC's personally, what a fantastic simple and diabolical revenue stream with no human intervention or checking.

pinkelephant12

I sued DVLA for sharing my Keeper details.  They used the incorrect lawful basis which prevented me from objecting to them providing my details to a PPC.  There’s a lot of information, so I’ll spread it over a couple of posts.

DVLA shares Vehicle Keeper details under Reg 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002.  They also have to comply with data protection law.

DVLA relies on Article 6(1)(c) of the UK GDPR (legal duty).

In the Information Commissioner’s published Opinion of 13th June 2022, he stated DVLA was processing data by relying on the incorrect lawful basis.  They should have relied on Article 6(1)(e) UK GDPR (public task).  This is because they have a power to release data rather than a duty and there are situations where they can refuse to exercise their power (which they couldn’t if it was a duty). 

The KADOE contract I relied on from 2020 at Part B referred to a ‘legal power’ (not a duty) and also refers to situations where DVLA may choose not to share Keeper details.

This difference is important because Article 6(1)(e) gives a right to the data subject to object to the sharing of Keeper details, whereas Article 6(1)(c) does not. 

The Information Commissioner thought the difference didn’t matter much because DVLA could refuse objections to the release of Keeper details on the basis that they are being released for ‘the establishment, exercise or defence of legal claims’ under Article 21 UK GDPR.

In my case, the PPC did not request my data to establish whether there was a claim because they knew there could not be one; my car was parked in an area they knew they were not contracted to manage.  I had opted my parking space out of the permit scheme where I live and the PPC had acknowledged this.  My opt out was also evidence that I would have objected to DVLA as well if this option had been available.

Recital 69 (guidance notes to the original GDPR) requires DVLA to take into account an individual’s particular situation. In correspondence with the DPO at the Department for Transport, she indicated that they might be willing to consider an objection in my specific circumstances. 

Continued in next post...