KADOE - a simplified version of the contract between car park operators and DVLA

doubledotcom

The problem is that the DVLA will try to fob off any complaints about them still being the data controller once they have provided the Keeper data to the operator. They will insist that they are no longer the data controller, especially if the operator made the request under the "reasonable cause" criteria.

However, I have been getting recipients of PCNs that breach the PPSCoP after the "reasonable cause" request was made. For example, MET parking issuing NtKs claiming Keeper liability for alleged contraventions that occurred on non-relevant land, which is a breach of the the PPSCoP section 8.1.1(d).

Whilst the request to the DVLA was lawful, the issue of an NtK in breach of PPSCoP 8.1.1(d) is also a breach of the KADOE contract and therefore the data is now being used unlawfully. The DVLA, as the data controller, is liable, even if they insist they are not because once they have passed the data to the operator, the operator then becomes the data controller.

Anyway, I have been getting many recipients of PCNs that  subsequently breach the PPSCoP after receiving the Keepers data, to submit formal complaints to the DVLA. Each complaint is always fobbed off with the pathetic excuse that it was lawfully requested under the reasonable cause criteria. I then get them to submit a Step 2 complaint which highlights the fat that the Step 1 complaint ignored the fact that it was not about the original request under reasonable cause but the subsequent unlawful use because of the PPSCoP/KADOE breach.

Again, the Step 2 complaints are fobbed off and the substantive point that the DVLA remains the data controller is always obfuscated. As such, I have been getting the recipients to then raise the issue with the ICA. Whilst the ICA will not investigate the actual issues of each complaint, they will investigate the DVLA for any failures to deal properly or lawfully with any complaints received.

I am happy to say that the ICA have finally agreed that there is an issue that needs investigation and further evidence has beeb provided to show the systemic nature of the DVLA fob offs. Unfortunately, this will be a very slow process as the ICA have admitted they are severely understaffed and resourced However, they have promised to complete any investigation but it will likely take many months before anything can be announced.

The only other advantage to a ll these formal complaints to the DVLA means that there is now a greater chance that in the future, FoI requests about how many formal complaints they have received and about which operators, may reveal trends that the DVLA will not be able to try and brush under the carpet.

ParkingMad

Umkomaas said:

Does anyone know what the general criteria are for a 'Red' rating, and what the consequences are?  Over the years we've seen repeat 'offenders', some of them our favourite 'big beasts', but seemingly no follow on information. 

These are some of GIAA’s general criteria for the ratings-

Umkomaas

Thanks @ParkingMad. There needs to be major weaknesses for a 'Red' assessment. And there are so many operators falling below an acceptable threshold.  The distribution of 'Reds' doesn't seem to be getting any better.  Makes you wonder what the DVLA are doing about this, or are they going through the motions of box ticking 'Annual Assessments Carried Out'. ☑️

LoneStarState

Umkomaas said:

Does anyone know what the general criteria are for a 'Red' rating, and what the consequences are?  Over the years we've seen repeat 'offenders', some of them our favourite 'big beasts', but seemingly no follow on information. 

Coupon-mad said:

You'd have to do a DVLA FOI re each and every one to expose the reasons.

Sometimes it's something major like telling a recipient they are liable under POFA when they can't be. Sometimes it's that some records are incomplete (i.e. unclear what action was taken).

You can request the in depth audit results from the GIAA that is provided to the DVLA.  Specifically, the forms you would want to look at and request are the GIAA's "External Data Users Programme Audit Findings". 

Requesting that quoted phrase should get what you want. It's the audit report sent to the DVLA's Data Sharing Strategy and Compliance Team and will include the RAG rating along with a summary of why that score was reached (eg premature KADOE request post NTD would lead to a Red and what the operator is going to do to address the issue). 

It will also include the auditor questionnaire based on responses from the PPC about certain conduct regarding data (will be heavily redacted) as well as a large pro forma spreadsheet that contains a (presumably random and therefore representative) sample of tickets issued by the PPC documenting the following:

Vehicle registration number (redacted)
Date of Event (redacted)
Date of Enquiry (redacted)
Notice Date (redacted)
Enquiry Reference No 
Reason code used (if applicable)
What was the reason for the enquiry?
Was the correct reason code used?
Was a ticket attached to vehicle or was ANPR/CCTV used to issue a postal parking charge notice?
Has the PCN/NTK been checked?
Was POFA used on the notices?
Has the signage been checked?
Have the photographs or images been checked?
Was the correct vehicle enquired upon?
Please note any comments or issues relating to this enquiry

If the GIAA refuse to publish this on first request, push for an internal review citing that it is important to know more detail on RAG ratings given the GIAA being the only real independent organisation publishing such info for the benefit of the motoring public who are subject to such requests and that redaction is an easy tool for protecting personal info in the documents.  You can refer to FOI152 where they had provided this information to help bolster your case against an initial refusal to provide.

ParkingMad

FOI148 also has details of VCS audits between 2014 and 2024.

https://www.whatdotheyknow.com/request/audit_results_for_vehicle_contro

Coupon-mad

Time to update this thread and add more findings.

So we had this from @LoneStarState as the definition of the RAG ratings in GIAA Audit reports, from a FOI request made in 2024:

and this FOI from 2019 has details of the GIAA audits for 4 PPCs:

https://www.whatdotheyknow.com/request/parking_company_audit_informatio/response/1579051/attach/4/FOI152%20Review%20Response.pdf?

…courtesy of @ParkingMad, that GIAA documentation had the following definitions for each of the RAG ratings:

GIAA Audits year on year:

GIAA audit results from 2015 to August 2022:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_2/response/2121316/attach/3/FOI088%20Response.pdf?

GIAA audit results from August 2022 to July 2023:

https://www.whatdotheyknow.com/request/giaa_audit_results_for_private_p/response/2384899/attach/3/FOI122%20Response.pdf?

GIAA audit results from July 2023 to April 2024:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_3/response/2658673/attach/5/FOI150%20final%20response.pdf?

GIAA audit results from April 2024 to April 2025:

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_4/response/3060693/attach/4/Attachment%20to%20FOI%20186.pdf?

And from @ParkingMad

"Here's the latest naughty list:

June 2025 - June 2026
They haven't re-audited all the failed companies from previous years though."

https://www.whatdotheyknow.com/request/giaa_audit_results_of_private_pa_5#incoming-3466746

Correct me if I'm wrong - or have missed a prolific offender - but it looks like to top issues are:

• APCOA has been audited 3 times and was 'red' every time;
• GXS has scored 'red' in all 4 audits it has had.
• G24 have been audited 6 times and have been rated 'red' 5 times out of 6;
• UKCPM have been audited 5 times and have been rated 'red' 4 times out of 5;
• VCS have also been audited 5 times and have been rated 'red' 4 times out of 5.

FOI148 also has details of VCS audits between 2014 and 2024.

https://www.whatdotheyknow.com/request/audit_results_for_vehicle_contro

And there are no repercussions seen at all.

Coupon-mad

@Thorndorise pointed out earlier in this thread:

"I think it's now been established that the ICO don't deem the DVLA requests as a legal obligation but PUBLIC TASK, per the Information Commissioner’s Opinion:

"The lawful basis for the processing of vehicle keeper data by the Driver and Vehicle Licensing Agency (DVLA)" 13 June 2022.

https://ico.org.uk/media2/migrated/4020676/dvla-opinion-20220613.pdf

But that seems moot when the DVLA's own form/contract states specifically that one of three things must exist;

• That you own the land that parking charge scheme is on, or

• from the landowner that you are acting with their consent (if you are an agent)

• that signs are clearly visible and comply with the Accredited Trade Association (ATA) to request information.



So, assuming non-compliance with the signs element (or any of the others - but I'm thinking signs here), then it would be illegal for that PPC to make the request for keepers details, either knowingly (don't care/haven't implemented sign's properly etc) or unknowingly (i.e. haven't checked the site recently).

I don't make this statement lightly, the ICO stated that there was no legal basis for DVLA providing keeper details to the PPCs, more that it is a 'public task' element (it's interesting in that report above they talk mostly about fines and not PCNs from PPC). If that is the case, then the IMPORTANT INFORMATION on the notes page of the V***/3 form surely has impact; namely:

Essentially this to me, seems to be saying that unless they have reasonable grounds for the request (i.e. they have adhered to their ATA CoP and all signs are present) - then they are pursuing keeper's details against data protection laws.

What it also says is that DVLA may not be checking every request for information as they claim they will above.

To a point made previously by established users on here, is that the landowner (contractor) of the PPC is jointly and severally liable for the actions of that agent. Therefore to me that implies that the landowner is equally involved in this requesting of the information for the data, for which they have no legal right to.

I also found this useful guide from DVLA about requesting data:

https://assets.publishing.service.gov.uk/media/661cff2808c3be25cfbd3db1/mis546-giving-people-information-from-our-vehicle-record.pdf


Whilst this is a guide, it makes for interesting reading on page 26

"23. You are a private car park enforcement company under "Why DVLA can give you this information"

We can give you this information to establish liability and recover costs where a vehicle has breached the terms and conditions of a private car park.
DVLA data is disclosed in order to:

• follow up charges not paid when the ticket is left on the vehicle

• issue the charge to the motorist when captured on ANPR or CCTV


All private car parking management companies must be a member of a DVLA Accredited Trade Association (ATA) and operate in compliance with the association’s code of practice."

This seems categorical in stating recovery of costs (what costs?)!
But more importantly in the boldened section, it implies that they will only give out keeper's details if one of two things are done, a ticket is left on the vehicle or when a motorist is captured on ANPR or CCTV. (I don't think a mobile phone or camera counts as either of these)

Am I missing something? - I believe that in many cases a warden may take a photo (or several) and this is used to then send a letter to the keeper after no ticket is left, or ANPR or CCTV used. Again this is often with non-compliance from a signs perspective - and therefore is an illegal act, with no due diligence being performed by DVLA.

Am I wrong?

I guess the question is:

a) so what? and

b) how do we challenge it?"

***************************************

I agree.

That document also says on p26:

So why don't the DVLA check this properly?

There are meant to be strict rules about ANPR: proportionality over excessive use. Surveillance systems can be intrusive and can impact on the rights and freedoms of individuals.

After all, the Deregulation Act 2015 banned Local Authorities from using camera surveillance for most parking enforcement, except for monitoring 'sensitive' areas such as those justified on safety grounds and places which are 'inaccessible' to CEOs on foot.

So, why have the DVLA got that clause in KADOE but still let the parking industry invent something appallingly covert and unnecessarily data-intrusive that they call 'MNPR' (manual number plate recognition)…

LOL… which actually means:

some random employee or self ticketer lurking with a phone took covert photos then ran away instead of affixing a timely consumer notice to the windscreen…

Now, the last government identified in their Feb 2022 published Ministerial comments that this is a CRA 2015 issue and - they said - in order to ensure 'timely consumer notices are affixed to windscreens' their Code banned self-ticketers from doing this.

But it made no sense only to ban self-ticketers from the lurking photo-taking trick because it is illegal and against KADOE.

What the industry call 'MNPR' should be banned for self-ticketers and employees alike (it should mirror local authority enforcement, postal PCNs for drive-away situations ONLY) because it breaches:

• the CRA 2015 regarding timely consumer notices and fair & open dealing;
• the ICO surveillance and transparency rules (DVLA data is currently being unlawfully obtained as a 'first resort' in cases where a PCN certainly can be served to the driver on the day).

In one fell swoop, by banning MNPR in the first iteration of the Code as they must, the Government will reduce multiple postal PCNs down to one PCN on the windscreen in all cases where there is a ticketer on foot.

This will especially protect freehold/leaseholders and tenants (and their visitors) where they currently have to suffer marauding PPCs at their own homes.

Especially those who've only just moved in and are either trying to get a permit or are on a waiting list, or haven't even been told they 'need' a permit.

For example, in the binding Court of Appeal parking charges CCJ set aside case of VCS v Carr, through no fault of his own and despite strenuous efforts to resolve his predicament, poor new resident Philip Carr got a CCJ (and HCEOs breathing down his neck) for an eye-watering £9000, which would have been over 50 PCNs at £170 a pop - yep AIUI, well over 50 x £70 (around FOUR GRAND of the nine) was added for ONE letter chain!

And of course, he was oblivious at first because the DVLA had given out his old address, again and again and again.

The Court Of Appeal gave VCS short shrift. The hearing was very uncomfortable for their barrister and their Lordships said a DVLA address "is only a starting point":

https://m.youtube.com/watch?v=FvK6XwAGHcs&ra=m

But in a fair world and if applying the KADOE rules properly, VCS should never have been allowed to use MNPR to get this victim's old (or new) address.

If the government or the dozy DVLA had required windscreen PCNs - not phone or bodyworn/hand-held camera use - in all residential car parks to protect residents from intrusive surveillance and the likelihood of getting out of date address data, Philip Carr would have been alerted by a single PCN on his car on day one.

This is how it MUST be under the new Code.

The MHCLG's new infrastructure will also desperately need some ICO-led safeguards against excessive surveillance.

But the ICO told me in a FOI response the other week, that they haven't even looked at any consultations about private parking or excessive camera surveillance for PCN issuance since 2015!

https://www.whatdotheyknow.com/request/ico_responses_since_2014_about_a/response/3535054/attach/3/IC%20548332%20K2K1%20Response%20Letter.pdf?cookie_passthrough=1

There must be sector-specific ICO rules set to stop operators from thinking:

"well we won't use people on foot then, let's run everywhere using CCTV or ANPR then we can carry on sending fifty PCNs to the old address of the next "Mr Carr" we single out, instead of just one NTD on the windscreen".

Nope.

MNPR must be banned but also:

The places where camera use must be banned altogether, due to unfair and intrusive first resort postal data-sharing with (often third party) registered keepers, include:

• all accessible (disabled) bays
• all residential sites
• all GP surgery/medical practices.

Using cameras in those three types of parking space lead to unfairness such as (illegal under the Equality Act 2010) burdens on disabled people to take extra steps to unexpectedly 'register' as well as display Blue Badges.

It's also highly data intrusive to send keepers pictures of the comings and goings of members of their family at their own home and/or attending the doctor.

Half_way

On the Doctor subject, and accessing healthcare provision a glaring issue surrounds patient confidentiality.

If the driver is not the registered keeper then the registered keeper will be informed that the driver on that day accessed some form of healthcare provision, at best this could cause embarrassment, however it could also put someone's wellbeing and life in very real danger

Car1980

the ICO stated that there was no legal basis for DVLA providing keeper details to the PPCs, more that it is a 'public task' element

Yes, I mean you'd think this was obvious. To have a cause that must be reasonable is not the same as having an automatic legal right, such as a FOI request. And if it is a public task, the onus lands on the DVLA to satisfy itself that the cause is reasonable.
But implementing some hoops to try and automatically deem 18 million requests are all reasonable will never prevent the unlawful unreasonable ones. If just 1 percent would not pass the threshold that's 180,000 unlawful releases.

Which brings us on to the BPA's signage auditing. What evidence is there that this occurs? Because we've all seen plenty of signage that would have failed an audit.

Does a BPA representative even check the sites or do they rely on emailed paperwork? Do they even see photos in situ or rely on maps with dots on them? What guarantees have the BPA given to the DVLA? Do the DVLA audit the BPA?

Or are we in system of cogs where each cog simply assures the previous cog that they have checked the next cog works?

GrannyKate

A couple of points;

1. Looking at the Guidance 'Giving people information from our vehicle record January 2026' According to the cover This document is directed at customers (or prospective customers) of the manual or paper enquiry service. Section 23 requires the car parking firm to send both a registration number and the make and model of car which will be checked. Does this same information have to be provided and checked for requests issued through whatever automated system is used by the big players? My invoice a while ago from Tesco/Horizon gave my registration number (wrongly read) and pictures of a red car probably a Toyota or similar whereas the registration supplied is for my black Kia.
2. @Half_way - you make a valid point. I am trying at the moment (via FOIA) to obtain a copy of any Data Protection Impact Assessment done by a particular hospital in relation to its parking contract. The risk you have pointed out would make a DPIA mandatory under NHS Information Governance Guidance. I will be very surprised if they have done one but they are legally obliged to tell me whether they 'hold one' or not. My request and reminders are being ignored so the case has been referred to the ICO.