KADOE - a simplified version of the contract between car park operators and DVLA

LoneStarState

LDast said:

The other problem is the rating is only based on a point in time which was on the date of the audit. They can simply turn around and claim it was a one off anomaly.

This is true although I guess you could argue repeated audits ratings (I notice GXS has scored red in the 4 audits it has ever had) could be used to indicate a pattern of behaviour.

It makes me wonder whether you could FOI what the GIAA actually sends regarding these ratings to the DVLA's data protection team and also FOI the DVLA to find whether they have actually bothered to do anything in regards to them.

ParkingMad said:

This FOI from 2019 has details of the GIAA audits for 4 PPCs. 

https://www.whatdotheyknow.com/request/parking_company_audit_informatio/response/1579051/attach/4/FOI152%20Review%20Response.pdf?

The GIAA documentation had the following definitions for each of the RAG ratings:

Thanks for this.  I tried to find any FOI requests that had already addressed my question but evidently didn't look hard enough.  Wonder why the GIAA didn't just send me that as I did ask if there was a sort of guide with examples.  Oh well.

Thorndorise

@136_NW @LoneStarState @ParkingMad @Coupon-mad @LDast

@136_NW I read this thread with curiosity - thank you for starting it off. I am fully aware that there are some very clued up folk on here, some of whom have commented here already. I've done some reading but I'd love your perspective on this also.

I've been reading through the process that the DVLA contracts with a PPC, and then of course the subsequent KADOE contract they require to enable them to source Keeper details.

I know this is a straw, but bear with me as I'm clutching it at the moment (and not to appeal any PCN in question) - rather than to try and throw a spanner in the works as best as possible with some of the PPCs.

My theory is this: That if a PPC that is a member of an ATA, does not adhere fully to their (albeit self-serving and pointless) code of practice (whether single or jointly now), they are in breach of their 'reasonable request for information' (namely that on form V888/3 - or via the DVLA contract for KADOE use which I assume to have the caveats).

I think it's now been established that the ICO don't deem the DVLA requests as a legal obligation (not sure if this has changed since their report in 2020 Information Commissioner’s Opinion: "The lawful basis for the processing of vehicle keeper data by the Driver and Vehicle Licensing Agency (DVLA)" 13 June 2022.

But that seems moot when the DVLA's own form/contract states specifically that one of three things must exist;

• That you own the land that parking charge scheme is on, or

• from the landowner that you are acting with their consent (if you are an agent)

• that signs are clearly visible and comply with the Accredited Trade Association (ATA) to request information.

So, assuming non-compliance with the signs element (or any of the others - but I'm thinking signs here), then it would be illegal for that PPC to make the request for keepers details, either knowingly (don't care/haven't implemented sign's properly etc) or unknowingly (i.e. haven't checked the site recently).

I don't make this statement lightly, the ICO stated that there was no legal basis for DVLA providing keeper details to the PPCs, more that it is a 'public task' element (it's interesting in that report above they talk mostly about fines and not PCNs from PPC). If that is the case, then the IMPORTANT INFORMATION on the notes page of the V***/3 form surely has impact; namely



Essentially this to me, seems to be saying that unless they have reasonable grounds for the request (i.e. they have adhered to their ATA CoP and all signs are present) - then they are pursuing keeper's details against data protection laws.

What it also says is that DVLA may not be checking every request for information as they claim they will above.

To a point made previously by established users on here, is that the landowner (contractor) of the PPC is jointly and severally liable for the actions of that agent. Therefore to me that implies that the landowner is equally involved in this requesting of the information for the data, for which they have no legal right to.

I also found this useful guide from DVLA about requesting data (sorry this won't be new to some of you)....
https://assets.publishing.service.gov.uk/media/661cff2808c3be25cfbd3db1/mis546-giving-people-information-from-our-vehicle-record.pdf

Whilst this is a guide, it makes for interesting reading on page 26

23. You are a private car park enforcement company under "Why DVLA can give you this information"

We can give you this information to establish liability and recover costs where a vehicle has breached the terms and conditions of a private car park.

DVLA data is disclosed in order to:

• follow up charges not paid when the ticket is left on the vehicle

• issue the charge to the motorist when captured on ANPR or CCTV

All private car parking management companies must be a member of a DVLA Accredited Trade Association (ATA) and operate in compliance with the association’s code of practice.

This seems categorical in stating recovery of costs (what costs?)!
But more importantly in the boldened section, it implies that they will only give out keeper's details if one of two things are done, a ticket is left on the vehicle or when a motorist is captured on ANPR or CCTV. (I don't think a mobile phone or camera counts as either of these)

Am I missing something? - I believe that in many cases a warden may take a photo (or several) and this is used to then send a letter to the keeper after no ticket is left, or ANPR or CCTV used. Again this is often with non-compliance from a signs perspective - and therefore is an illegal act, with no due diligence being performed by DVLA. Am I wrong???

I guess the question is a) so what? and b) how do we challenge it?

I know the PPCs are not good to talk to, but it seems like at least lodging a complaint with them initially challenging their use of the DVAL system or KADOE to access it, is the first port of call - along with the landowner. Then DVLA, ICO and also IPC or BPA (don't get me wrong I know the latter with have very impact). And before you say it @LDast @Coupon-mad I know there will be new guidance coming....but I want to make as much noise as I can (these PPC really rub me up the wrong way)

Thorndorise

One other thing, and again forgive my newbieness on this point...

I note with that DVLA V88/3 form, it clearly states the following below...

Do DVLA 'give' their permission within their contracts with PPCs to pass said info on as a matter of course? I get that they cannot pass it on to a 3rd party for debt management, but are the PPCs readily getting this permission for DCBL and the like?

Umkomaas

Debt collection agencies like DCBL, DRP, ZZPS etc will be working 'on behalf' of the PPC, and the data can be legitimately passed to them by the PPC. 

Thorndorise

Umkomaas said:

Debt collection agencies like DCBL, DRP, ZZPS etc will be working 'on behalf' of the PPC, and the data can be legitimately passed to them by the PPC. 

Thanks @Umkomaas

I guess in my head I was thinking that they weren't 'sub-contracted' to do so, but I guess they are as this is easy for the PPCs to shift it across to them to handle...point well made 

fisherjim

As far as the taking of photos on a mobile phone and not leaving a windscreen NTD issue is concerned;

I seem to remember when the PoFA first came into use this was used as an appeal point with POPLA but was ignored and fell by the wayside.

LDast

I think that most DRAs are also members of either one or both ATAs.

However, the point about unlawful collection of DVLA data has not been properly tested in court. In cases with obvious breaches of the relevant CoP, the KADOE contract has been breached. Double-dip cases are a classic example. The operator, by not performing the manual quality control checks on the ANPR images is in breach of the CoP and therefore also in breach of the KADOE contract.

Obviously, the operator does not give a toss and neither does the DVLA, despite being the data provider at the source of the contractual breach. The individual who has had their data unlawfully provided is the person who would have to initiate any legal action and, as we know very well from this forum, there are very few who are prepared to "go all the way" and most are simply relieved that the PCN was cancelled or have been plucked from a low hanging branch on the gullible tree and simply paid it off for a simple life.

I have one victim of a double-dip case, on another forum, where the operator eventually cancelled the PCN upon complaint but has ignored any request for compensation for the GDPR breach. The victim is seriously considering suing them under the Data Protection Act for compensation and is about to issue a Letter of Claim for £300. Early days yet but this is an individual suing for compo and, even if they " go all the way" and the defendant doesn't settle before any hearing, it will not be binding on anything.

I think the fact that the DVLA get away with selling GDPR data and that the ATAs are unregulated as are their paymaster members and we know how there is no actual "audit" of things such as signs made on location, the only way this idea of holding the DVLA and others to account would be through a judicial review or something similar.

ParkingMad

ParkingMad said:

GIAA audit results from July 2023 to April 2024:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_3/response/2658673/attach/5/FOI150%20final%20response.pdf?



GIAA audit results from August 2022 to July 2023:

https://www.whatdotheyknow.com/request/giaa_audit_results_for_private_p/response/2384899/attach/3/FOI122%20Response.pdf?



GIAA audit results from 2015 to August 2022:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_2/response/2121316/attach/3/FOI088%20Response.pdf?

GIAA audit results from April 2024 to April 2025:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_4/response/3060693/attach/4/Attachment%20to%20FOI%20186.pdf?

Umkomaas

Does anyone know what the general criteria are for a 'Red' rating, and what the consequences are?  Over the years we've seen repeat 'offenders', some of them our favourite 'big beasts', but seemingly no follow on information. 

Coupon-mad

You'd have to do a DVLA FOI re each and every one to expose the reasons.

Sometimes it's something major like telling a recipient they are liable under POFA when they can't be. Sometimes it's that some records are incomplete (i.e. unclear what action was taken).