'PCN NOW CANCELLED' data privacy & complaints NPC Group, DCB Legal, DVLA, IPC, ICO & MP

Thorndorise

1505grandad said:

Usually always agreed/backed by the ICO:-

https://ico.org.uk/media/action-weve-taken/decision-notices/2023/4027469/ic-255825-q6g3.pdf

1. The complainant has requested information about Accredited Trade Associations. The Driver and Vehicle Licensing Agency (“DVLA”) stated that it does not hold information within the scope of the request.
2. The Commissioner’s decision is that, on the balance of probabilities, the DVLA is correct when it says that it does not hold any information within the description set out in the request.
3. The Commissioner does not require the DVLA to take any further steps.

Just had a better read of this,  thank you.  Well,  I do find it a little shocking that despite calling out specific requirements in their data request forms and their contacts through KADOE, in particular about signage and rights to enforce, they don't actuality follow anything up or check after some initial 'audit' (which seems to focus more on use of data).

Blimey, not good... they're basically relying on a self serving ATA to manage their members!!!

Nellymoser

It's also not good DVLA are relied upon to monitor ATAs and review their ATA status annually. How they possibly thought it was acceptable to perform this role without maintaining any form of record is just jaw dropping. In my profession we were taught "if it's not recorded it didn't happen."

And I'm not convinced "The ICO exists to empower you through information". I can't understand how ICO can use "the balance of probabilities" in their decision making process when they claim it's not for the ICO to consider whether the authority should hold the information being requested. I would have thought this to be a relevant factor.

Thorndorise

Nellymoser said:

It's also not good DVLA are relied upon to monitor ATAs and review their ATA status annually. How they possibly thought it was acceptable to perform this role without maintaining any form of record is just jaw dropping. In my profession we were taught "if it's not recorded it didn't happen."

And I'm not convinced "The ICO exists to empower you through information". I can't understand how ICO can use "the balance of probabilities" in their decision making process when they claim it's not for the ICO to consider whether the authority should hold the information being requested. I would have thought this to be a relevant factor.

Truly is shocking all round...

I hadn't heard from the PPC for a while so I shot them a couple of reminders - mainly to ask for their complaints policy, I may have written something along the lines of you cannot fob complainants off with an inaccurate and incoherent reply, nor address the data protection issue.

I also specifically called out the DPO as they hadn't even acknowledged my complaint, given that was the crux of my email I couldn't quite believe they'd fobbed it to customer services.. I was explicit that I expected a response. Gave them a couple of days then rinse and repeat....

Dear Head of customers services X and team

Emailing again to bring this to the top of your emails, as politely requested 3 times, please can you respond with a copy of your complaints policy without further delay. Please do not refer back to your non-existent complaints policy online, pdf or word doc is fine by return.

It has also been requested of you the following;

• A copy of X site Audit performed by the IPC.
• An annotated copy of the photo sent to you with IPC CoP-mandated entrance (+ additional entrance) signs circled.
• Additionally it would be really helpful if you could confirm if the warden on duty on the day of the alleged parking event was an NPC employee, or is this a owner/self-ticketing site?

Finally regarding this statement: "However, it has now been passed to DCB Legal who have been instructed to start court proceedings and, unfortunately, the charges have been escalated too far and we are no longer able to cancel or reduce them."

DCB Legal have been contacted and are not presently starting court proceedings whilst they are investigating this Data protection complaint.

Looking forward to hearing from you X with the complaints policy, and hopefully from your DPO as time is running low (you are politely reminded that not dealing properly with Data protection matters is a legal matter).

Lots of love Me

Thorndorise

I'm seeing a trend from the PPC that they are, mmmm, struggling to understand stuff in general, a very strange response...

Good afternoon,

Please see a copy of the complaints policy.

Regarding your comments about data protection matters, are you wanting to submit an SAR request?

Please note that it is a warden site however, I will not be providing a copy of the audit, nor will we be pulling the charge back from DCB Legal.

If you are unhappy with our signage on site, you can put in a complaint with the IPC.

Kind regards, DPO


Complaints policy is an oddy, not on their website as it should be, not sent out at the first complaint to them. Makes me think it didn't exist until I pushed them on it - it's not very long, a bit odd, read's like a C&P from the IPC CoP, and has a created date of yesterday at 16:48 (received their email at 16:57 - just saying - feels a little bit after the fact is all....

It appears that the DPO has changed (what! - no one's told the ICO!) - assuming this person is actually the DPO - can't find their name online anywhere so I suspect it could be a moniker, also all their surnames start with an 'S' - can't be a coincidence can it? They clearly hadn't bothered to read the original complaint I sent due to their banal question!

Shared it's a warden site, handy - but won't share their Audit - craziness
And the cherry being - "if you don't like our signs, take it up with someone else"

Ho hum...

Coupon-mad

Typical from this industry.  Scam, innit?!

Thorndorise

Nellymoser said:

@Thorndorise are you aware of What do they know FOI request site. There are plenty DVLA FOI requests re private parking issues/email exchange to view. It can prove a bit time consuming searching and sometimes leaves you surprised when they say "DVLA does not hold the information requested." 
The DVLA told me they delete complaints not upheld after 90 days. I think that could only be viewed as bad practice. 
Liking/following your complaint 😊

https://www.whatdotheyknow.com/list?utf8=✓&query=DVLA+BPA&request_date_after=&request_date_before=&commit=Search#results

So I put in a complaint to DVLA as well - mainly focusing on the data protection element that I've described elsewhere in this thread. It was so incredibly hard to find the email address, shocking...

I have had a response...it was pretty rubbish imho

My email to them...

Dear Data Sharing Strategy and Compliance Team

I am writing to raise a complaint I have about the sharing of my data held by yourselves in relation to a Parking Charge Notice received on X March 2024. The alleged date of the parking incident is X March 2024 at XXX, and at the time the register keeper was myself, residing at XXX (this is also the current address for the keeper). The complaint stems from the contract the Private Parking Company, National Parking Control Group Ltd, of The Pinnacle, Station Way, Crawley, RH10 1JH, made with yourselves to allow them to make a reasonable cause request for keeper's details.

As part of either utilising KADOE, after contracting directly with yourself and KADOE, or submitting a form V888/3, National Parking Control Group Ltd. (NPC hereafter) agreed that they are one of three things;

• That you own the land that parking charge scheme is on, or
• from the landowner that you are acting with their consent (if you are an agent)
• that signs are clearly visible and comply with the Accredited Trade Association (ATA) to request information.

Whilst it may not be your task to check the compliance of each and every request, it is your responsibility should you receive a complaint that claims that the Private Parking Company have not adhered to their own ATA Code of Practice, and as such, must investigate - either through audit or other means. By NPC not adhering to their Code of Practice and not having clear signage contrary to the agreement above. This is despite having AOS status with IPC (their ATA), they will be reported to the IPC separately - that has no bearing on this complaint however.

Thus NPC are requesting keeper's details without reasonable cause, and as there is no legal basis for the DVLA to provide this information, I am reporting this incident as a breach of your own guidance - and of the contract with NPC.

1. Release of information from DVLA’s registers INF266 3/22

• https://assets.publishing.service.gov.uk/media/624dabc7e90e0729f6bf8167/inf-266-release-of-information-from-dvlas-registers.pdf

Thorndorise

DVLAs reply is so bad now I look back at my email to them!

Thank you for your email of  September to the Driver and Vehilce Licensing Agency’s

subject access team about the release of data from the vehicle register to car parking

management companies. I have been asked to reply.

Please be assured that the DVLA takes the protection and security of the data it holds very

seriously and has appropriate procedures in place to handle personal data in line with the

relevant data protection principles applying. All data sharing undertaken by the DVLA is

carried out in accordance with data protection law. The Agency must strike a balance

between ensuring the privacy of motorists is respected while enabling those who may have

suffered loss or damage to seek redress.

It may help if I explain that Regulation 27(1)(e) of the Road Vehicles (Registration and

Licensing) Regulations 2002 permits the disclosure of vehicle keeper information to those

who can demonstrate a reasonable cause for needing it. Reasonable cause is not defined

in legislation but the government’s policy is that it should relate to the vehicle or its use,

following incidents where there may be liability on the part of the driver.

Drivers choosing to park a vehicle on private land do so subject to the terms and conditions

set out on signage in the car park. The need to contact individuals who may not have

complied with these conditions is, in most circumstances, considered to be a reasonable

cause. Data is provided by the DVLA to enable landowners or their agents to pursue their

legal rights and to address disputes. I hope you can appreciate that if this were not the case,

motorists would be able to park with disregard for the conditions applying with little prospect

of being held accountable.

The DVLA cannot determine liability when dealing with requests for information. Under the

regulations, the DVLA discloses keeper information as a first point of contact to help

investigate where liability might lie and to resolve disputes. The DVLA would not be the

appropriate body to determine whether or not a breach of the terms or conditions for parking

on private land has occurred, as ultimately that would be a matter for the Courts.

As you are aware the company in question, National Parking Control Group Ltd, is a

member of the International Parking Community Ltd (IPC) which is an ATA for the parking

industry. The IPC’s code of practice is published on its website at www.theipc.info under the

heading Accredited Operators Scheme. If a member of this AOS does not comply with the

code of practice, it may be suspended or expelled, during which time no data will be

provided to it by the DVLA. If you feel that any of the practices used by the company do not

comply with the IPC’s code of practice which incudes the use of signage, you may wish to

contact the IPC via their website or by writing to IPC, at PO Box 662 SK10 9NR.

Technological advances have enabled many parking companies to employ different methods

of capturing alleged parking contraventions, these include the use of automatic number plate

recognition (ANPR), closed circuit television (CCTV) and parking attendants using handheld

devices to photograph vehicles before issuing a parking charge notice through the post rather

than placing it on the windscreen of the offending vehicles. This does not mean that

companies operating in this way are not entitled to receive registered keeper data from DVLA,

as they still meet the reasonable cause criteria.

Private parking operators like National Parking Control Group Ltd that request information

from the vehicle record via an electronic link are not required to provide supporting

evidence with each application, although the evidence must be collected and stored for

future DVLA audits. Parking operators with an electronic link are regularly audited by DVLA

to check that they can prove reasonable cause for the requests made and that they have

adequate security over the information in their possession. If the data is misused or a

company did not adhere to their contract with DVLA it could be suspended independently of

any ATA investigation.

The DVLA is aware that private car parking companies such as National Parking Control

Group Ltd use debt recovery agencies to recover unpaid parking charges. There is no

indication that your data has been used by National Parking Control Group Ltd and the debt

recovery agent for any purpose other than that for which it was originally requested, i.e. to

pursue the landowner’s legal interests with regard to the use of his land.

I trust this explains the Agency’s position.

Thorndorise

Key elements of this that stand out are

The Agency must strike a balance between ensuring the privacy of motorists is respected while enabling those who may have suffered loss or damage to seek redress.

Loss or damage to seek redress!

There's a whole spiel which is straight out of the parking industry's playbook

Drivers choosing to park a vehicle on private land do so subject to the terms and conditions set out on signage in the car park ... Data is provided by the DVLA to enable landowners or their agents to pursue their legal rights and to address disputes

Some helpful direction to the IPC's website (thanks for that - very useful)!

There is also the suggestion that is the ATA suspends the operator, then the DVLA will stop providing data, or alternatively

If the data is misused or a company did not adhere to their contract with DVLA it could be suspended independently of any ATA investigation.

What I'm struggling with is that I have told the DVLA that the operator has not adhered to their code of practice, and can prove it, thus broken their contract with the DVLA and need them to suspend and audit in the interim (big ask that they're not gonna do, but hey, I can ask)

Coupon-mad

The DVLA appear not to give a flying fig about the interests of motorists or DPA 2018, in my view.

Umkomaas

Pretty standard DVLA fob off response.