ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

Fruitcake

This is where I think the DVLA have taken an arbitrary decision that all enquiries from PPCs automatically meet the "reasonable cause" criteria without them doing any of the other necessary checks and safeguards.

An own space case is a perfect example where there is no reasonable cause for the DVLA to sell personal data. If the motorists owns the parking space outright, there is absolutely no doubt this is wrong.
If the motorist leases the space and has an unfettered and exclusive right to use that space, and their lease states they have the right to quiet enjoyment of their leased property, then again, the DVLA have no right to sell the motorist's data.

Then we get ANPR misreads where again there is no reasonable cause because it is the wrong vehicle.

There is also the fairly recent case where by their own admission, keeper data was sold on more than one occasion to a PPC that was no longer a member of an ATA. The PPC had left the BPA but neither party told the DVLA, and the DVLA didn't check their database of ATA members was up to date.

I suspect the test cases being brought against the DVLA will be for one or more of the above.

Umkomaas

👆👆 What an excellent post by @Mouse007. 👆👆

Fruitcake

More on the own space situation where a motorist owns the parking space.

From the DVLA's website.

What evidence do private companies need to provide to receive DVLA data?

All companies requesting DVLA data have to demonstrate they have reasonable cause for receiving it and explain how they will use the data. Companies requesting information to enforce parking charges must provide details of their business activities. They must provide evidence which shows they are acting on behalf of the land owner, that a parking charge scheme exists and that motorists are made aware of the parking charge scheme. Companies have to be registered with the Information Commissioner’s Office and be current members of an ATA.

Selling keeper data to an unregulated parking company when the keeper owns the parking space is a DVLA failure and data breach.

1505grandad

"Then we get ANPR misreads where again there is no reasonable cause because it is the wrong vehicle."
And four photos taken but only two processed - the two trips may even have been by two separate drivers.

Fruitcake

The DVLA selling personal data to a PPC on four separate occasions where the motorist was parked on a public road.

... and so the list goes on.

Umkomaas

Fruitcake said:

The DVLA selling personal data to a PPC on four separate occasions where the motorist was parked on a public road.

... and so the list goes on.

Hopefully Keller Lenkner will be all over these examples where personal data should never have been handed over to PPCs by the DVLA. 

Mouse007

What are the lawful bases for processing?

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever you process personal data:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

DVLA relied upon (c) to supply (process) registered keeper information because of “legal obligation”

Note (c) Legal obligations - clearly, very clearly states in brackets - "not including contractual obligations". The whole basis of every parking charge notice claim is a contractual obligation -it is irrelevant if that is the DVLA’s contractual obligation or a third party’s contractual obligation (you couldn’t make this up) the DVLA had no right to process the personal data under that legal basis full stop.

It took the ICO 4 years to kick that into touch. 4 years?

They then suggest/shoehorn the lawful basis into (e) Public task - I’ve dealt with that above.

Now what do you think about the integrity and independence of the ICO? I’m uncomfortable very uncomfortable.

This smells.

pinkelephant12

I’m trying to process the implications of this for me as I am currently in correspondence with DVLA about their release of my data without reasonable cause and in breach of GDPR.

Mine was an ‘own space’ case.  I own a FREEHOLD property with an allocated numbered parking bay which I do not own but have unfettered exclusive use of (identified in the Transfer – the Transfer is referred to in the Land Registry docs).  There was no power to require the display of a permit.  I opted my parking bay out of the permit scheme in writing and the opt out was acknowledged by the PPC who subsequently issued multiple parking tickets (including NTKs) for my vehicle in my exempt bay.  All the parking tickets were cancelled. 

My understanding of the ICO’s email is that if DVLA had used the ‘correct’ basis for processing data under Article 6(e) GDPR, this would have given me the right to object to processing.  At the time when I opted out of the permit scheme, I could have informed DVLA not to give my details to the PPC if a request was made regarding my own parking bay.  If DVLA agreed, this would have prevented the NTKs.

Have I understood that correctly?

zhonguonuren

I just received the same message after 3 years! 

zhonguonuren

@pinkelephant12
I would definitely consider a claim to the parking company for breach of GDPR.  I wonder if you need to start your own thread for me to comment further? 

Complaining to the DVLA is like pulling teeth.  I eventually sued and won.  I wouldn’t rule out a claim against it either.