Car leasing contract issues around data breaches

TooManyPoints

I have already said and agree the details on their system is not correct and they are the only people who can change it.

If you've already said it that's twice you've been wrong.

As above, the DVLA have the correct details. VWFS is the Registered Keeper. The problem lies with the information VWFS is passing on to parking authorities and the police.

WellKnownSid

paul_c123 said:

No, the DVLA have the lease company as the registered keeper, but whenever it gets there, the lease company erroneously has the OP down as the lessee, so is forwarding on the stuff.

The data will be separate systems.  A billing system to handle the day to day financial aspect of the leasing.  A CRM system to handle customer comms.  The OP's complaint another system.

Handling NIPs will be a daily occurrence so there will be an entire department setup to do this.  Very likely this is a separate system altogether because it is a separate operational domain and they have separate reasons for change (single responsibility principle / domain driven design).

When the lease is set up there will be business process orchestration to make sure all the relevant data is copied to all of the relevant places.  There will not be a live sync - for example it is very unlikely the department handling NIPs will require any further updates until the lease is terminated or a completely new billing account set up.  

What the OP is experiencing 'can never happen' or rather was never considered by the contractor (and their best people usually were contractors when I worked with them) when they set up the automation.

My approach will be to continue along the data breach lines - they were always quite a risk-averse organisation.  NO this won't get you out of the lease early but you should get some goodwill. 

Focus on the GDPR principles:

Breach of Principle (d) Right of Accuracy.  They have failed to maintain accuracy.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/accuracy/

Breach of Principle (f) Integrity and Confidentiality.  They have failed to maintain data integrity.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/integrity-and-confidentiality-security/

Make a Data Subject Access Request and critically point out that your wife has been identified by two separate registration numbers (state them) which makes both an identifier i.e. Personal Data within scope of the GDPR.

At some point the 25 watt light bulbs will start to glow and someone, somewhere will figure it out.

Car_54

WellKnownSid said:

Make a Data Subject Access Request and critically point out that your wife has been identified by two separate registration numbers (state them) which makes both an identifier i.e. Personal Data within scope of the GDPR.

It is the OP's wife who needs to do this: 

WellKnownSid

Car_54 said:

WellKnownSid said:

Make a Data Subject Access Request and critically point out that your wife has been identified by two separate registration numbers (state them) which makes both an identifier i.e. Personal Data within scope of the GDPR.

It is the OP's wife who needs to do this: 

Show me where that is written! 

As long as the wife can be identified, who writes the request is irrelevant.  DSARs are written on behalf of others all the time (e.g. by third party companies) - I've written several on behalf of family members.  It's perfectly normal practice.  It is up to the DC to validate the request.

Grey_Critic

And what do you propose doing with the Speeding Ticket - That is personal to your wife. Nothing to do with VWFS That requires a reply 

TooManyPoints

"And what do you propose doing with the Speeding Ticket - That is personal to your wife. Nothing to do with VWFS That requires a reply "



Already sorted, apparently:

I've already replied to the NIP stating VWFS have incorrectly registered it against my wife's name. We can supply emails that will back this up if required. They will have to go back to VWFS for the correct keeper details.