ICO Response to DVLA complaint on GDPR compliance (After 4 years wait)

Mouse007

Does the Commissioner’s decision mean the DVLA should not have shared vehicle keeper information with car park management companies?

No. Regulation 27(1)(e) provides the DVLA with a power to disclose vehicle keeper information with car park management companies to recover fines.

The're not fines !

KeithP

There are six occurrences of the word 'fines' in that document.

Not just one slip-up, but a total misunderstanding by its author.

Fruitcake

My relative has just received the identical response as the OP, did from the ICO. In his case, he got a PCN for stopping in a no-stopping zone at Bristol Airport, only his car was outside the area that VCS are contracted to operate. 
His is not the only PCN at this airport where PCNs have been issued to a keeper when the vehicle was outside the PPC's contracted area, therefore they had no reasonable cause to obtain keeper data, but the ICO have completely ignored this data breach.

This is what the DVLA's website says,

"They (meaning the PPC) must provide evidence which shows they are acting on behalf of the land owner,"

In my relative's case, they were not acting on behalf of the landowner because they did not, and still do not, have a contract to act where the alleged event occurred. In fact, they don't have a contract with the landowner at all, because the landowner is a foreign investment company, and the airport is managed by a sub-contractor who in turn has subcontracted the PPC. I doubt the owner even knows what's going on. All they see is profit being shovelled out of the UK and into a foreign country's coffer's.

This is the part of the ICO's response that galls me,

"How the DVLA oversees carpark management companies are not matters within the ICO’s remit."

A data breach is entirely within the ICO's remit, and was the subject of my relative's complaint, but they have completely ignored it. Grrrrr!

Le_Kirk

abedegno said:

I am writing to you in your capacity as data protection officer for the DVLA.  I understand from reading your privacy notice provided here: -

https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter
That that you will release my personal details to private and public-sector organisations provided they can demonstrate reasonable cause to receive it.

When I last wrote to you ..............

Following an investigation by the ICO which they concluded this week, they have advised me that you have errored erred in your legal basis and that you have no legal basis for processing my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

Just a couple of suggestions above.

abedegno

Le_Kirk said:

abedegno said:

I am writing to you in your capacity as data protection officer for the DVLA.  I understand from reading your privacy notice provided here: -

https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter
That that you will release my personal details to private and public-sector organisations provided they can demonstrate reasonable cause to receive it.

When I last wrote to you ..............

Following an investigation by the ICO which they concluded this week, they have advised me that you have errored erred in your legal basis and that you have no legal basis for processing my data under Article 6 (1) c in relation to Regulation 27 (1) e because that regulation is merely granting you a power and is not a legal obligation.

Just a couple of suggestions above.

I had a few glasses of wine when I wrote it 🙁

Fruitcake

This is the part that confuses me in your proposed letter/email the DVLA,

"When I last wrote to you in June 2018, you advised that this could not be done because ..."

It reads as if the DVLA say something could not be done, then gives a reason why it can be done.

Did you previously request the DVLA not to disclose your personal data, because that part is missing if you did?

patient_dream

Fruitcake said:

"How the DVLA oversees carpark management companies are not matters within the ICO’s remit."

A data breach is entirely within the ICO's remit, and was the subject of my relative's complaint, but they have completely ignored it. Grrrrr!

The ICO seem to be suffering from a "bleed on the brain" ?

The DVLA and car park management has nothing to do with this mega data breach

We can all accept that the DVLA can advise authorities such as the police and crime agencies but I have never seen a clause that gives them an automatic opt-in to provide personal data to the private parking industry. By doing so without permission is a data breach

KeithP

Fruitcake said:

This is the part that confuses me in your proposed letter/email the DVLA,

"When I last wrote to you in June 2018, you advised that this could not be done because ..."

It reads as if the DVLA say something could not be done, then gives a reason why it can be done.

Did you previously request the DVLA not to disclose your personal data, because that part is missing if you did?

Yes, I mentioned that yesterday, but the OP seems to have overlooked my post.

abedegno

KeithP said:

Fruitcake said:

This is the part that confuses me in your proposed letter/email the DVLA,

"When I last wrote to you in June 2018, you advised that this could not be done because ..."

It reads as if the DVLA say something could not be done, then gives a reason why it can be done.

Did you previously request the DVLA not to disclose your personal data, because that part is missing if you did?

Yes, I mentioned that yesterday, but the OP seems to have overlooked my post.

Hi, yes - I was referencing an earlier exchange with the DVLA in 2018 which triggered my complaint to the ICO

stationsidecottage

Hi.

I was wondering, have any of you privately sued APCOA or Network Rail, DVLA or ICO over the car parking fines for your deeded land?

Can you:

A) Provide the outcome

List which solicitor / barrister you used as I need to hire one

C)  Even if you had a positive action for yourself, did you get some relief for your visitors?

D) List some contacts for us newbies on this matter

E) Have you considered making a claim under unreasonable surveilance / human rights?

F) Approached this from a breached contract perspective by suing the freeholder or whomever made the agreement with the

    car parking company?

Thanks - I just need more meat for my approach.

In short, I have private deeded land at a railway. Everyone entering gets a ticket. I got a ticket myself today!

They (APCOA) want me to 'report' every time I park or someone else parks on my land. F! Them!  This all started in April with the install of the ANPR Cameras.I am not going to let this rest.

My friend wants to sue me over the fine. I am considering either paying the fine on her behalf and then suing related parties above for financial loss and mental anguish, or just letting her sue me over the threat. She as well as all of my visitors are very upset when they get a ticket and I have a medical issue which is impacted by not having visitors.

I and my visitors are being wrongly given tickets by APCOA which has placed its camera pointing at my private deeded land.

Thanks and feel free to contact me if you are a solicitor. I am not interested in being a part of a class action suit because I can't wait for the long outcome.

In the meantime- I should state that I have a letter admitting breach of my deeds.