ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

zhonguonuren

Coupon-mad said:

The ICO really don't appear to be doing a great job, do they? 

Shocking - I have a couple of complaints with the ICO on behalf of others.  I will get a response within 9 months I am told.  

Sandtree

Coupon-mad said:
I think - in fact I know, due to doing this for 15 years - that the vast majority have absolutely no idea what the 'penalty' might be (nor even that there might be one) because tariff boards don't include the parking charge in anything like the same huge text as the parking fees. 

Firstly, I said if there is a penalty for not paying not how much the penalty is.

Secondly, I strongly disagree that people dont think there will be some form of penalty because there isn't large text to say so... there is no large text in most shops that taking goods without paying will have a penalty but the majority realise shoplifting has consequences. 

As to honesty boxes... just look at the research at https://www.sciencedaily.com/releases/2006/06/060628091247.htm which said by changing the honest box it got almost 3 times the amount of money... unfortunately it doesn't give the full analysis but that would suggest at least 66% of people were not using the honesty box before the big brother posters were put up. Certainly doesn't support the idea that the majority will pay when there is no perceived implication for not paying.

Coupon-mad

zhonguonuren said:

Coupon-mad said:

The ICO really don't appear to be doing a great job, do they? 

Shocking - I have a couple of complaints with the ICO on behalf of others.  I will get a response within 9 months I am told.  

Took me about that to get a useless response from the ICO about a complaint I made about a roboclaim firm and how they handled my data and SAR. 

Re what Sandtree said:

...getting 'a few quid more' absolutely is not worth it to a landowner who wants to invite the public on site (e.g. a retail shop, beach cafe, etc) if the presence of a scum PPC and the issuance of PCNs drives people away.

Which it does. Only takes one PCN and the business has list all goodwill and will never see that shopper return, nor their friends:

https://taxis4smartcities.org/drivers-threaten-to-boycott-parking-lot-over-ticket-chaos/

https://www.bbc.co.uk/news/uk-england-tyne-61175991.amp

https://www.tripadvisor.co.uk/ShowUserReviews-g186220-d12048934-r682084668-Flip_Out_Bristol_Pumped_Up-Bristol_England.html

https://www.tripadvisor.co.uk/ShowUserReviews-g186470-d7946024-r736923985-Forestside_Shopping_Centre-Belfast_Northern_Ireland.html

https://www.staffordshire-live.co.uk/whats-on/shopping/shoppers-boycott-sports-direct-matalan-5678915.amp

https://www.walesonline.co.uk/news/wales-news/llangrannog-car-park-fine-beach-20537396.amp

https://www.thecourier.co.uk/fp/news/perth-kinross/826974/smart-parking-boss-agrees-to-make-changes-after-deluge-of-complaints-from-perth-drivers/

https://lichfieldlive.co.uk/2022/06/12/decision-by-shopping-centre-owner-to-end-contract-with-car-parking-company-welcomed-by-lichfield-mp/

A couple from Sussex:

OPS kicked out of the Co-op car park:

https://www.theargus.co.uk/news/17799021.amp/

UKCPM ruining a West Sussex beauty spot called Bury Hill:
https://www.hdrcgb.org/threads/parking-cameras-at-whiteway-bury-hill-motorbikes-are-except.1186938/

I've seen two PCNs from that place from friends who didn't see the free parking had been removed. There are other beauty spots and cafes.  People soon learn.


Anyway, back to the topic of DVLA data:

My understanding of the ICO’s email is that if DVLA had used the ‘correct’ basis for processing data under Article 6(e) GDPR, this would have given me the right to object to processing.  At the time when I opted out of the permit scheme, I could have informed DVLA not to give my details to the PPC if a request was made regarding my own parking bay.  If DVLA agreed, this would have prevented the NTKs.

Have I understood that correctly?

Yes and you can do that now.  Let us know what the DVLA say.

Mouse007

https://gdpr-text.com/read/recital-69/

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation.

It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

Note it is the controller’s compelling legitimate interest not the third party’s compelling legitimate interest - the word “its” being possessive

This does not say

It should be for the controller to demonstrate that compelling legitimate interests of a controller or a third party overrides the interests or the fundamental rights and freedoms of the data subject.

Neither does it say

It should be for the controller to demonstrate a compelling legitimate interest which overrides the interests or the fundamental rights and freedoms of the data subject.

The controller must have (possess) the compelling legitimate interest


Article 21 GDPR. Right to object

https://gdpr-text.com/read/article-21/

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

... for the establishment, exercise or defence of whose legal claims?


Taking Article 21 (1) and recital 69 together suggests to me the legitimate interests of the controller (for the establishment, exercise or defence of legal claims) and not those of third parties. Edit: I suggest the ICO is wrong.  They are in the letter but see new post below the ICO agree online

Presumably DVLA’s real compelling legitimate interest is to make money selling the information.

Coupon-mad

On this basis, I think people could object in cases where:

- it's a non POFA PCN

- or where it's not relevant land

- or if they live in Scotland or NI

- or (as above) where it's their own space

...because processing the data of the registered keeper in those cases cannot result in any legal liability of that person.  The PPC might be allowed to use the data to 'ask the keeper who was driving' but that's it.

Processing over.

Keeper data deleted, as soon as that keeper tells the PPC to go swivel.

Sandtree

Coupon-mad said:

As to honesty boxes... just look at the research at https://www.sciencedaily.com/releases/2006/06/060628091247.htm which said by changing the honest box it got almost 3 times the amount of money.

Never seen that before but it always makes me laugh when 'research' has such a narrow scope.

And that research does nothing to help the cause of a PPC.  In fact quite the opposite. All you need is a poster with eyes on it next to your honesty box, then!

But getting 'a few quid more' absolutely is not worth it to a landowner who wants to invite the public on site (e.g. a retail shop, beach cafe, etc) if the presence of a scum PPC and the issuance of PCNs drives people away.

A few years ago the experiment was repeated on a TV show, it tested that one plus other ideas like chest size of a waitress impacting tips (which it did notably but possibly surprisingly more so to female customers than male) and all repeated the results that previous university research had shown.

Most research has to be on very small subjects otherwise you get too much cross pollution and difficulty to separate cause/effect. No matter the results you'll aways get those that disagree... did some PR after some sponsored research into if eating/drinking whilst driving was as distracting as using a mobile whilst driving. Had some old boy calling/writing almost daily for 6 months saying it was nonsense and as a driving instructor for 30 years etc he was just as competent driving whilst eating as when not etc.

The issue with the news article is that it says you get almost 3x the money with the perceived observation/threat with an honest box but that could be going from 10% to 30% or 32% to 96%... the later you may say is good enough but clearly the former would still be terrible and an actual threat may be required.

If you think its not worth it for the landowner to try and get additional funds in from parking why do you think they invite the "scum PPC" in or who'd you think does? There can be a conflict between the landowner and the renters (ie shops) of units but larger renters can have individual power and clearly collective bargaining can make changes too for the smaller renters. Even in a domestic setting as leaseholders we collectively discussed and voted on the introduction of "PPC scum" for our residential parking rather than the freeholder taking the decision alone (vote was to introduce them and it massively reduced the number of commuters and pub goers using our parking)

Mouse007

And to add to my previous post - the ICO agree

In these circumstances this is not an absolute right, and you can refuse to comply if:

• you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or
• the processing is for the establishment, exercise or defence of legal claims.

If you are deciding whether you have compelling legitimate grounds which override the interests of an individual, you should consider the reasons why they have objected to the processing of their data. In particular, if an individual objects on the grounds that the processing is causing them substantial damage or distress (eg the processing is causing them financial loss), the grounds for their objection will have more weight. In making a decision on this, you need to balance the individual’s interests, rights and freedoms with your own legitimate grounds. During this process you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of the individual.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

That is clear to me, the legitimate interests of the DVLA, not the private parking companies.

1505grandad

" Even in a domestic setting as leaseholders we collectively discussed and voted on the introduction of "PPC scum" for our residential parking rather than the freeholder taking the decision alone (vote was to introduce them and it massively reduced the number of commuters and pub goers using our parking)"

So reduced or no funds from pcn's  -  wonder where the ppc will obtain funds to "fund" their operation in future?

patient_dream

All this now proves is that the tin soldiers who work as government agencies have rusted up and those with slight movement practice incest

Mouse007

Following my previous posts

What compelling legitimate interest does the DVLA have in enforcing the unnecessary and predatory terms and conditions of use in private car parks?

I would suggest none whatsoever.