Help with railway Apcoa Fine ZZPS now involved

LillacIris

UPDATE: Got a response from DVLA about my complaint, but it was very generic and failed to acknowledge the main issue - how APCOA used my data afterwards. Also looks like they disclosed I was the one who complained, which I thought was meant to be anonymous. But I guess they needed to fully investigate.

RESPONSE:

Dear [my name],

Thank you for your correspondence of 28th April 2025 about the release of

information from the Driver and Vehicle Licensing Agency’s (DVLA) vehicle register.

I have been asked to formally review your case at Step 1 of our complaints

procedure.

The DVLA takes the protection and security of its data very seriously and has

procedures in place to ensure data is disclosed only where it is lawful and fair to do

so and where the provisions of the Data Protection Law are met. The Agency must

strike a balance between ensuring the privacy of motorists is respected while

enabling those who may have suffered loss or damage to seek redress.

Drivers choosing to park a vehicle on private land do so subject to the terms and

conditions set out on signage in the car park. The need to contact individuals who

may not have complied with these conditions is, in most circumstances, considered

to be a reasonable cause. Data is provided by the DVLA to enable landowners or

their agents to pursue their legal rights and to address disputes. I hope you can

appreciate that if this were not the case, motorists would be able to park with

disregard for the conditions applying with little prospect of being held accountable.

I have investigated this matter with APCOA Parking Ltd who made the request to the

DVLA for the registered keeper details for vehicle registration number [my reg number].

APCOA Parking Ltd have confirmed the Penalty Notice was issued due to the

vehicle being parked in [location] Car Park without payment

for the duration of your stay. APCOA Parking Ltd confirmed receipt of your appeal

stating you paid for the incorrect location although this was taken into consideration,

the payment did not cover the full duration of your stay resulting in the appeal being

rejected and the matter has now been passed to the debt recovery agency.

Registered keeper details can be released under a Keeper at Date of Event

(KADOE) contract where the land is covered by Railway Byelaw 14. Regulation 27 of

Road Vehicles (Registration and Licensing) Regulations 2002 allows vehicle keeper

details to be disclosed to third parties who can demonstrate that they have a

reasonable cause to receive it. Although reasonable cause is not defined in

legislation, the Government’s policy is clear. Requests should relate to the vehicle or

its use following incidents where there may be liability on the part of the driver.

To help ensure motorists are treated fairly when any private parking charge is

pursued the DVLA discloses vehicle keeper information only to companies that are

members of an appropriate Accredited Trade Association (ATA). The purpose of

requiring a company to be a member of an ATA is to ensure that those who request

DVLA information are legitimate companies that operate within a code of practice

that promotes fair treatment of the motorist and ensures that there is a clear set of

standards for operators.

The company in question, APCOA Parking Ltd, are a member of the British Parking

Association (BPA) which is an Accredited Trade Association for the parking industry.

The BPA’s code of practice is published on its website at

http://www.britishparking.co.uk under the heading “Approved Operators Scheme”. If

a member of this scheme does not comply with the code of practice, it may be

suspended or expelled, during which time no data will be provided to it by the

DVLA. If you feel that any of the practices used by the company do not comply with

the BPA’s code of practice, you may wish to contact the BPA via email at

https://portal.britishparking.co.uk/compliance/LogComplaint or by post at Chelsea

House, 8-14 The Broadway, Haywards Heath, West Sussex RH16 3AH.

We have fully considered all the information available. If you feel that your complaint

has not been resolved, you can request escalation of your complaint to Step 2 of the

complaints process. Further options about our complaint procedure can be found

online at www.gov.uk/dvla/complaints.

Yours sincerely

[name]

Data Customer Auditor

Data Assurance Team/Information & Assurance Group

BuzzingBee

How far until the 6 month expiration date are you?

doubledotcom

Did you raise the DVLA fob-off to a Step 2 complaint to the 'Head of Complaints" at the DVLA?

LillacIris

BuzzingBee said:

How far until the 6 month expiration date are you?

6 months has passed, haven't recieved anything for weeks now.

doubledotcom said:

Did you raise the DVLA fob-off to a Step 2 complaint to the 'Head of Complaints" at the DVLA?

No I have not, I was unsure on what to respond to them since I didn't recieve any comments/advise. I hold little knowladge when it comes to the whole DVLA Complaints so wouldn't know what to say.

doubledotcom

You rase the DVLA to Step 2 of the complaints process in exactly the same manner as advised by @LDast in this earlier post: 26 April at 2:28PM. The only difference is that the link is slightly different: contact our Head of Complaints here.

For the webform section of the complaint you can use the following:

I am escalating this complaint to Step 2 because the Step 1 response was a fob-off that wholly failed to address the actual issue raised. My complaint is not about whether APCOA Parking had reasonable cause to obtain my data at the point of request.

It concerns their subsequent misuse of that data — specifically, issuing a 'Penalty Notice' that falsely implies statutory enforcement under Railway Byelaws while later admitting they are pursuing a civil contractual claim. That conduct breaches the Private Parking Single Code of Practice (PPSCoP) and the KADOE contract.

The DVLA’s repeated tactic of sidestepping complaints about post-access misuse is not only obstructive but undermines the DVLA’s role as a data controller under UK GDPR. I expect this Step 2 escalation to be reviewed by someone who understands the distinction between lawful access and unlawful use, and who is prepared to answer for the DVLA’s regulatory responsibilities.

I have uploaded a revised supporting statement that lays out the complaint in detail. Please confirm a reference for this escalation and confirm whether a full internal review will be undertaken. If not, I will pursue this matter with the ICO and the Independent Complaints Assessor.

And for the supporting statement, you can use this:

SUPPORTING STATEMENT
Step 2 Complaint to DVLA – Misuse of Personal Data and Potential Fraud by APCOA Parking (UK) Ltd

Operator: APCOA Parking (UK) Limited
Date of Penalty Notice (PN): [INSERT DATE]
Vehicle Registration: [INSERT VRM]

This Step 2 complaint is being submitted because the Step 1 response completely ignored the basis of the original complaint. This is not about whether APCOA had “reasonable cause” to request my data from the DVLA under Regulation 27. It is about their subsequent misuse of that data after it was obtained — conduct that clearly breaches the Private Parking Single Code of Practice (PPSCoP), the KADOE contract, UK GDPR, and potentially the Fraud Act 2006.

APCOA issued a document labelled “Penalty Notice” which refers to Railway Byelaws and uses language that gives the impression a criminal offence has been committed. The notice is designed to intimidate and falsely suggest that prosecution is imminent. However, in formal correspondence, APCOA admitted they are not enforcing a criminal penalty, but instead pursuing a civil contractual invoice. Despite this, they have continued to use language that misrepresents the legal position, creating the false impression that the recipient faces statutory consequences when in fact no such criminal process is in motion or available to them.

This is a deliberate and dishonest false representation, made with the intention of inducing payment from the recipient. It constitutes unlawful use of my data under the KADOE contract and the PPSCoP, which both require that DVLA-supplied data be used only for the fair and lawful enforcement of parking charges in accordance with the applicable code. APCOA’s conduct also amounts to unlawful processing under the UK GDPR, as they are using personal data for a misleading and unlawful purpose that was not disclosed at the point of data collection.

More seriously, their conduct may amount to fraud. Section 2 of the Fraud Act 2006 defines fraud by false representation, which includes dishonestly making a false representation with the intent to make a gain or cause a loss. APCOA have clearly misrepresented a civil claim as a statutory penalty, with the intention of securing payment under false pretences. That is fraud. The DVLA, as data controller, must take responsibility for what its data recipients are doing with keeper data. Passing the buck to a private trade body like the BPA is not acceptable and does not discharge the DVLA’s legal duties.

I am therefore asking the DVLA to investigate this matter properly and determine whether APCOA’s actions breached the KADOE contract and the PPSCoP, and whether their conduct in issuing misleading “Penalty Notices” while admitting no criminal enforcement is being pursued amounts to a false representation under the Fraud Act. Enforcement action should follow, including suspension or termination of KADOE access if necessary. If the DVLA fails to act, I will escalate this matter to the Information Commissioner’s Office, the Independent Complaints Assessor and my MP.

Name: [INSERT YOUR FULL NAME]
Date: [INSERT DATE]

LillacIris

Thank you so much for this! I have made the step 2 complaint and now we wait for their response.

LillacIris

I have gotten a response back from DVLA... This says it all ''There is no evidence that APCOA has breached any statutory provisions or other legal requirement affecting the KADOE service''

Dear ____,

Thank you for your email dated 10 July about the release of information from our vehicle

register for vehicle registration number ending ___. As a member of the DVLA Complaints

Team, I have been asked to formally review your case at Step 2 of our complaints

procedure.

I am sorry that my colleague earlier reply did not resolve matters. I would like to reassure

you that as my colleague has explained, we take the protection and security of the data we

hold very seriously, and we have appropriate procedures in place to handle personal data.

It may help if I explain that the DVLA cannot regulate directly the manner in which a parking

management company is operated. The Government’s policy is to operate a system of

industry self-regulation in the private parking industry. The approach seeks to balance the

need to protect the motorist whiles ensuring private parking facilities can be managed

properly, maintaining their availability for use by consumers.

The DVLA accredits trade associations to ensure that those who request information are

legitimate companies that operate within an enforceable Code of Practice. Accredited Trade

Associations (ATAs) have responsibility for ensuring compliance with their code of practice.

Should you feel that any of the practices employed by APCOA do not comply with the

relevant code of practice you should contact the ATA of which the company is a member.

The DVLA’s role in the context of your enquiry is to consider whether the release of

information to APCOA Parking (UK) Limited (APCOA) met the reasonable cause provision,

and to address the wider concerns you have raised about APCOA’s use of the Keeper at

Date of Event (KADOE) service.

DVLA are aware that private parking companies sometimes issue penalty notices when

managing land covered by railway byelaws, in such circumstances, registered keeper

information can be released from DVLA under Regulation 27 of the Road Vehicles

(Registration & Licensing) Regulations 2002, as the release of information to car parking

companies working under railway byelaws is considered to be a reasonable cause.

There is no evidence that APCOA has breached any statutory provisions or other legal

requirement affecting the KADOE service.

The ICO website contains more information about its role at www.ico.org.uk. You have the

right to complain to the ICO if you believe that the DVLA has not handled your personal

data appropriately. You can write to the ICO at the following address:

The Information Commissioners Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

Yours sincerely

Mrs _____

DVLA Complaints Team

James_Poisson

It's just another expected brush off, how can you have "self regulation" in such a rogue industry, any time that the BPA has been pinned down on these matters they are keen to point out they are "not a regulator" only a trade body.

A COP is also just a set of guidelines for best practices, supposedly used as a benchmark, it has been ignored by PPC's for years, and the trade bodies bend its use and revise it all the time in their members favour.

The DVLA have more restrictive blinkers than an old cart horse.

patient_dream

"The DVLA accredits trade associations to ensure that those who request information are"

It is very sad that a government dept  / agent fail to see that they are allowing MONEY SCAMMERS to operate .... the scam is getting worse day by day.

THE DVLA accept money from money scammers @ £2.50 a pop and then breach data protection  by giving the money scammer your info

LoneStarState

patient_dream said:

"The DVLA accredits trade associations to ensure that those who request information are"

It is very sad that a government dept  / agent fail to see that they are allowing MONEY SCAMMERS to operate .... the scam is getting worse day by day.

THE DVLA accept money from money scammers @ £2.50 a pop and then breach data protection  by giving the money scammer your info

What is the actual accreditation process?  Has anyone ever found out?  Presumably would be appropriate for an FOI request?