ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

Fruitcake

Perhaps you could extract and quote the precise wording, highlighted, as well as pointing them to a link, just in case they skim read, or can't get the link to open, or ... get their whitewash from a different supplier.

I think your suggestion could be very useful for people with own space cases, or want to make a pre-emptive strike and opt out when a managing agent arbitrarily introduces or threatens to introduce a PPC.

I also think that when someone complains to the DVLA about their misuse of data, they should ask under what statute/GDPR regulation they have sold their personal data to see if they are still using the "old" reason.

Mouse007

Mouse007 said:

Dear DVLA

In accordance with my rights under Article 21 of the UK General Data Protection Regulations (GDPR)  I am writing to inform you of my objection to you disclosing my personal data under Article 6 (1) e of the GDPR to any person requesting it under Regulation 27 (1) e of the The Road Vehicles (Registration and Licensing) Regulations 2002.

I remind you that you have no legal basis to process my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

ENTER YOUR SPECIFIC REASON HERE

"An individual must give specific reasons why they are objecting to the processing of their data. These reasons should be based upon their particular situation."

Before rejecting my objection please refer to the ICO’s guidance

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

which states you need to balance my interests, rights and freedoms only with your own legitimate grounds. During this process you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of mine.

That is your, the DVLA’s, compelling legitimate interests and not the interests of the person requesting my data.

Yours faithfully

Amended as above - yes you do need to include a reason for objecting. Perhaps someone can come up with some generic wording about rouge Private Parking Companies issuing fake invoices not being properly vetted by the DVLA.

Fruitcake

Yes, something generic is needed, or a section that reads *insert reason here* as you have suggested.

A list of the most common reasons could then be included. Perhaps at some point when C-m has time, and Forum Ambassadors allow the NEWBIES to be unlocked, it could be included there.

Obvious reasons would include, but not limited to: -

Own space (owned, leased, demised, landowner/landholder authorised)
Double Dip
ANPR misread
Vulnerable adult (I can't remember where, but I do seem to recall it being in the DPA/GDPR somewhere)


No offence meant by the way, but it's rogue, not rouge. 

Mouse007

No offence meant by the way, but it's rogue, not rouge. 

I usually hide my dyslexia better than that using spell checkers first then enter typed word into google to check it's the one I meant. Perhaps I should be blushing

Fruitcake

No worries. My son has ADHD and several other learning difficulties. The law is a pedant, so it is important that the correct terminology is used, otherwise I care not for typos etcetera unless it changes the meaning.
"Rogues" is one of the words used by MPs in open parliamentary debate when describing these unregulated private parking companies, which is why it is an important word to use in discussions.


No landowner authority would be another reason to add.

abedegno

I've given it a shot - this is what I wrote:

Dear Sir/Madam,

I am writing to you in your capacity as data protection officer for the DVLA.  I understand from reading your privacy notice provided here:
https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter
That you will release my personal details to private and public-sector organisations provided they can demonstrate reasonable cause to receive it.

When I last wrote to you in June 2018, you advised that this could not be done because

'Regulation 27(1)(e) of the Road Vehicle (Registration and Licensing) Regulations 2002 provides a legal gateway to disclose information contained in the UK vehicle register to ‘any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particular to be made available to him’. An express right has been established in law for the sharing of data in certain prescribed circumstances, including for private parking management. The consent of the data subject is not required where processing takes place under these conditions.'

Following an investigation by the ICO which they concluded this week, they have advised me that you have errored in your legal basis and that you have no legal basis for processing my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

In accordance with my rights under Article 21 of the UK General Data Protection Regulations (GDPR), I am writing to inform you of my objection to you disclosing my personal data under Article 6 (1) e of the GDPR to any person requesting it under Regulation 27 (1) e of The Road Vehicles (Registration and Licensing) Regulations 2002.

The specific reason for requesting this is I have personally fallen victim to the predatory behaviour of rogue Private Parking Companies which has resulted in financial loss and significant distress.  The Private Parking Bill (Private Parking Code of Practice), which is designed to limit these practices, has still not been implemented.  Once it is implemented it is reasonable for my objection to be reconsidered.

Before rejecting my objection please refer carefully to the ICO’s guidance

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

which states you need to balance my interests, rights and freedoms only with your own legitimate grounds. During this process, you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of mine.

That is your, the DVLA’s, compelling legitimate interests and not the interests of the person requesting my data.

Yours faithfully

KeithP

abedegno said:

I've given it a shot - this is what I wrote:

Dear Sir/Madam,

I am writing to you in your capacity as data protection officer for the DVLA.  I understand from reading your privacy notice provided here:
https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter
That you will release my personal details to private and public-sector organisations provided they can demonstrate reasonable cause to receive it.

When I last wrote to you in June 2018, you advised that this could not be done because

'Regulation 27(1)(e) of the Road Vehicle (Registration and Licensing) Regulations 2002 provides a legal gateway to disclose information contained in the UK vehicle register to ‘any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particular to be made available to him’. An express right has been established in law for the sharing of data in certain prescribed circumstances, including for private parking management. The consent of the data subject is not required where processing takes place under these conditions.'

Following an investigation by the ICO which they concluded this week, they have advised me that you have errored in your legal basis and that you have no legal basis for processing my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

In accordance with my rights under Article 21 of the UK General Data Protection Regulations (GDPR), I am writing to inform you of my objection to you disclosing my personal data under Article 6 (1) e of the GDPR to any person requesting it under Regulation 27 (1) e of The Road Vehicles (Registration and Licensing) Regulations 2002.

The specific reason for requesting this is I have personally fallen victim to the predatory behaviour of rogue Private Parking Companies which has resulted in financial loss and significant distress.  The Private Parking Bill (Private Parking Code of Practice), which is designed to limit these practices, has still not been implemented.  Once it is implemented it is reasonable for my objection to be reconsidered.

Before rejecting my objection please refer carefully to the ICO’s guidance

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

which states you need to balance my interests, rights and freedoms only with your own legitimate grounds. During this process, you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of mine.

That is your, the DVLA’s, compelling legitimate interests and not the interests of the person requesting my data.

Yours faithfully

Is there something missing?

In your second paragraph you state..."When I last wrote to you in June 2018, you advised that this could not be done..."
It is not clear to me what this is in this context. 
What exactly are you saying 'could not be done'?

Mouse007

Just found this

Information Commissioner’s Opinion:
The lawful basis for the processing of vehicle keeper data by the Driver and Vehicle Licensing Agency (DVLA)

https://ico.org.uk/media/about-the-ico/documents/4020676/dvla-opinion-20220613.pdf

I think they are wrong about the "The right to object under the UK GDPR has a built-in exception, where the organisation is processing the information ‘for the establishment, exercise or defence of legal claims’." Page 5. The DVLA are not processing the data for that purpose, they are processing it for someone else.

LoneStarState

CrikeyMouse007 said:

Just found this

Information Commissioner’s Opinion:
The lawful basis for the processing of vehicle keeper data by the Driver and Vehicle Licensing Agency (DVLA)

https://ico.org.uk/media/about-the-ico/documents/4020676/dvla-opinion-20220613.pdf

I think they are wrong about the "The right to object under the UK GDPR has a built-in exception, where the organisation is processing the information ‘for the establishment, exercise or defence of legal claims’." Page 5. The DVLA are not processing the data for that purpose, they are processing it for someone else.

Crikey.  I guess we should inform the ICO that using the F word to describe invoices for alleged breaches of contract is wholly incorrect.

Really hope the DVLA get stuffed by Keller Lenkner in the group claim.

Mouse007

Can people who are, or are potentially, subject to unpaid parking charges exercise their right to object under the UK GDPR when their data is being processed under the public task lawful basis?

The right to object under the UK GDPR has a built-in exception, where the organisation is processing the information ‘for the establishment, exercise or defence of legal claims’.

Paragraph 11 of Schedule 4 of POFA contains an enforceable legal right of the car park management company to claim the charges from the vehicle keeper. It is not for the DVLA to determine the validity of claims against the vehicle keeper. Car park management companies can use the exception. It would be for a court or parking tribunal to determine the validity of any claim. It is the Commissioner’s view is that the DVLA could refuse an Article 21(1) objection by the vehicle keeper in these
circumstances.

Why does the ICO think the car park management companies can use that exception? they are not processing the data, the DVLA is!