ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

Sandtree

Coupon-mad said:

If you think its not worth it for the landowner to try and get additional funds in from parking why do you think they invite the "scum PPC" in or who'd you think does?

In many cases, a PPC will pitch to the head office (e.g. of a hotel or gym) or to a managing agent of retail premises (e.g. JLL or Savills) and are granted unsuitable multi-site contracts with little or no site-specifc adjustment nor retailer need consideration.

This might be cold-approach pitching "we'll sort all your parking problems out for free, guv" (protection racket stylee) or they hear that a previous PPC is being removed and scaremonger/blag their way in because the landowner doesn't engage their brain and realise they don't need any PPC.

The cafes and shops then suffer and the place becomes a ghost town until someone realises the effect and kicks the PPC out, as in the penultimate link where OPS were reportedly kicked out of the Co-op Peacehaven.

Absolutely, so someone at head office makes a decision after considering the pro/cons of what it will mean for their branches... this also gives the branches the ability to deflect blame for customers. Head Office wouldn't agree to the contract if they didn't think the benefits stacked up... now people sometimes do their sums wrong or assumptions are incorrect and exiting contracts can be expensive but its naive to think poor little Hilton hotel is having to deal with PPC managing their hotel and are much worse off for it.

Ghost towns were first blamed on out of town shopping centres which equally have PPCs in their carparks. Now you add to that the internet. Whilst there may be a small minority of people who wont park in a particular carpark because of who manages it the reality is that its not the majority and those out of town centre still have PPCs and still are attracting massively more footfall than town centres.

Where the landowner rather than the tenant control the car park its up to the tenants to put pressure on their landlord, something easily done for large corporations and smaller ones will have to band together... the issue comes when Tesco's is happy for the landlord to be using a PPC and small cafe next door isn't as inevitably one party wins. That however goes for a much wider range of things than just the PPC which is why choosing your neighbourhood and neighbours is important for a business. 

Coupon-mad said:
No, it is not 'required'. Nor is it terrible.

Why is getting some regular money from an honesty box 'terrible'? Because it's not ripping off a car park like a PPC would?

Name one business that would be happy if 70% of its customers took its products/services and didn't pay? Most would call it in much stronger terms than terrible. Our local urban farm used to have eggs at the gate with an honesty box and ended up taking it away (or more accurately not replacing it after someone stole the honest box) because they were finding too many weren't being honest.

Assuming land and business is controlled by the same party then revenue and costs are considered as a whole... if you have free parking you have to charge more for your products/services just in the same way that those offering free postage do. If your business plan is based on people paying for their parking you can budget for lower prices in store. If suddenly people stop paying its not any different to people who order a coffee and walk out without paying.

Where business and land are separated it has the same indirect impact as revenues impact rental charges which impact prices.

In our own case the monies generated by the PPC to the managing agent were deducted off the service charge and so 1) you had less people having their allocated bay used by non-residents and 2) for the lesser number that continued to do this the fees generated meant service charges went down £100 a quarter or so. Same goes for businesses. 

Sandtree

Coupon-mad said:

Who is now being ticketed at your home car park? Residents and their visitors.  You think that's OK?

Not mine any more but no, it was people who were going to the pub next door and people going to the train station that was a 5 minute walk away as neither had their own carpark and the local multi-storey closest to the station was £15 a day or so where as for 18 months they saw our residential parking as free.

When I left it was presumably still those that thought they could get away with it, there were less because the monies received had dropped notably from the first two quarters and I'd gone over a year without finding someone else taking up my space whereas before it was every other week or so and mine was a more inconvenient space for either destination.

Can certainly say none of our guests ever got ticketed but its not hard to give them one of the visitor permits to display in their window? When I was leaving they were talking of changing it from a permit to a website solution which you'd imagine is easier still but never saw/used it. 

Sandtree

Coupon-mad said:

Terrible situation to have to dodge £100 penalties at your home. How horrible to live like that.

You can't exactly give a permit to a delivery driver in time, nor to a carer who has trudged up the stairs to treat a patient. I've seen that happen to an arriving carer within 2 minutes flat in a place with no 'P' entrance sign, and as expected, the appalling IAS refused the appeal.

The very worst sharp practice occurs at residential car parks, even if you say you didn't see it (if you work for the PPC that got the contract then you'd be on a white list anyway).

What do you think of the hypocrisy of the McLaren £160k supercar parked across 3 bays at ParkingEye HQ? One rule for them.

Personally, its a worse situation to find some random stranger parking in your space and you having to pay £15 for the multi-story because they didn't want to. For me it was only every other week or so it happened but those closer to way in or the pedestrian access was getting it much more.

Wasn't really any "dodging" about it... you put your permit in your window, it stays there and not only do you not get fined £50 but instead you get given £100. When you are using a courtesy car or a visitor is there you use the visitor permit.

Parking tickets of all variety are an occupational hazard for delivery companies, our whole area (on street parking only) is either bus stop or council resident controlled parking now (not PPCs) but even before the resident permit system was put in the Tesco/DPD drivers were always parking in the bus stop and risking a remotely issued ticket for it. 

There could be some sympathy for careers but then take our new situation where there is no off street parking and no visitor permits to give to people surely that's worse and that's a governmental organisation creating that situation not a PPC.

Mouse007

Would it be possible to get this thread split into 2 on the grounds of deviation away from the original issue?

I thought we were discussing the DVLA’s right to process personal data.

Sandtree

Coupon-mad said:

But delivery drivers can unload from bays. And on single and DYL.

There could be some sympathy for carers but...

Could be?  Must be!

How would you fairly protect them from scum PPCRUs?

How does your company do that, assuming you work for a PPC as it appears you might do? 

Or are they fair game? Or have to appeal each and every time, only to get the IAS door slammed in their face?

No, the on street parking states no stopping 8am-8pm without a resident permit. How would you protect them and carers from councils? 

Sandtree

Coupon-mad said:

the on street parking states no stopping 8am-8pm without a resident permit.

It doesn't. There is no such rule. You can't have 'no stopping' as a restriction in residents bays.

I don't expect a parking firm to know this, but in the real world (on street) unloading and loading is exempt activity, for example here are the rules in London:

https://www.londoncouncils.gov.uk/services/parking-services/parking-and-traffic/parking-advice-members-public/loading-and-unloading

Parking bays

• you can stop to load and unload on parking bays (pay and display, residents’ bays etc.) for a maximum of 20 minutes during controlled hours
• you cannot load and unload on diplomatic parking bays
• you cannot load and unload on a suspended parking bay (unless you have requested the suspension)
• you should if possible avoid using disabled bays. 

Avoiding Penalty Charge Notices (PCNs) 

You should:

• check the signs and lines to ensure loading and unloading is permitted before you start
• tell any traffic warden or civil enforcement officer that you are loading and that you will move the vehicle once you are finished
• if you are leaving the vehicle unattended try to make it obvious that you are loading and loading.

And the average carer would be considered loading/unloading? Average carer visit is less than 20 minutes?

And as per your first bullet in the final section... the signs do not say loading/unloading is allowed.

Coupon-mad

And the average carer would be considered loading/unloading? Average carer visit is less than 20 minutes?

Quite possibly.  Sometimes just dropping off meds or provisions that they've collected.  And if they got a PCN at least they'd have a proper appeals system open to them and it would be cancelled.

And as per your first bullet in the final section... the signs do not say loading/unloading is allowed.

They wouldn't, because that's not what it means.  This means the opposite - drivers should check that no signs prohibit loading/unloading.

What PPCs don't understand or care about (because it doesn't suit them) is that in the real world - on street parking rules - such exempt activity is always allowed unless signs and lines say it isn't. Delivery drivers needn't risk PCNs unless they do something silly like stop on a red route or in a bus stop.

Not only do on street residents' bay signs never say 'no stopping' but nor is there any type of sign (except in a loading bay) in the TSRGD that says 'loading/unloading is allowed'.

I'm guessing perhaps you are quite a new driver, unfamiliar with Local Authority signage. Anyway, hopefully your queries are answered. If not, you'll need a new thread for this, if you want to know more.

I've deleted some if my replies to ensure the discussion stays on track.

@Mouse007 is quite right:

Mouse007 said:

Would it be possible to get this thread split into 2 on the grounds of deviation away from the original issue?

I thought we were discussing the DVLA’s right to process personal data.

Coupon-mad

Mouse007 said:

What are the lawful bases for processing?

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever you process personal data:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

DVLA relied upon (c) to supply (process) registered keeper information because of “legal obligation”

Note (c) Legal obligations - clearly, very clearly states in brackets - "not including contractual obligations". The whole basis of every parking charge notice claim is a contractual obligation -it is irrelevant if that is the DVLA’s contractual obligation or a third party’s contractual obligation (you couldn’t make this up) the DVLA had no right to process the personal data under that legal basis full stop.

It took the ICO 4 years to kick that into touch. 4 years?

They then suggest/shoehorn the lawful basis into (e) Public task - I’ve dealt with that above.

Now what do you think about the integrity and independence of the ICO? I’m uncomfortable very uncomfortable.

This smells.

Mouse007 said:

And to add to my previous post - the ICO agree

In these circumstances this is not an absolute right, and you can refuse to comply if:

• you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or
• the processing is for the establishment, exercise or defence of legal claims.

If you are deciding whether you have compelling legitimate grounds which override the interests of an individual, you should consider the reasons why they have objected to the processing of their data. In particular, if an individual objects on the grounds that the processing is causing them substantial damage or distress (eg the processing is causing them financial loss), the grounds for their objection will have more weight. In making a decision on this, you need to balance the individual’s interests, rights and freedoms with your own legitimate grounds. During this process you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of the individual.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

That is clear to me, the legitimate interests of the DVLA, not the private parking companies.

I think you are right and on to something.

I really hope the press pick up that the DVLA have been using the wrong legal basis and despite the ICO throwing them a lifeline, it just doesn't quite stack up.

I wonder if we should all now tell the DVLA we object to them releasing our data to a PPC and see what whitewash comes back now?

1505grandad

"I wonder if we should all now tell the DVLA we object to them releasing our data to a PPC and see what whitewash comes back now?"

I seem to remember posting this on one of my threads a few years ago:-

"(Nice to know you can suppress DVLA data - wonder what would happen if everybody demanded suppression marker)"

Maybe this is relevant:-

pinkelphant12  -    "At the time when I opted out of the permit scheme, I could have informed DVLA not to give my details to the PPC if a request was made regarding my own parking bay"

C-m  -  "Yes and you can do that now."

Presumably this would also apply if a RK has the permission of the landowner for their vehicle to park in a certain area of their (l.o.) car park. Because the VRM is on a white list there will be no windscreen documentation. So, if I understand correctly, a demand can be made to DVLA, with email permission from landowner as evidence, to place a suppression marker on driver/vehicle record for the particular circumstances of this car park. 

Hope I have interpreted correctly  -  and I think I know what the DVLA would say.

Mouse007

Dear DVLA

In accordance with my rights under Article 21 of the UK General Data Protection Regulations (GDPR)  I am writing to inform you of my objection to you disclosing my personal data under Article 6 (1) e of the GDPR to any person requesting it under Regulation 27 (1) e of the The Road Vehicles (Registration and Licensing) Regulations 2002.

I remind you that you have no legal basis to process my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

Before rejecting my objection please refer to the ICO’s guidance

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

which states you need to balance my interests, rights and freedoms only with your own legitimate grounds. During this process you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of mine.

That is your, the DVLA’s, compelling legitimate interests and not the interests of the person requesting my data.

Yours faithfully

DVLA must respond within one calendar month to objections

AND

They must inform all Registered Keepers of their right to object

No wonder it took the ICO 4 years to reply, the consequences are huge.