KADOE Contract and Data Protection Impact Assessments

GrannyKate

I made an FOIA request to the DVLA asking for any DPIAs associated with their KADOE contract with three parking management companies. Their response was to send a redacted DPIA from when they migrated their service to the new KADOE API (Application Programming Interface) in 2022/3. It is an interesting read (100 plus pages) but not exactly what I asked for. I will go back to seek clarification if this means that companies do not have to do a DPIA as part of the contracting process and also to ask for the Statement of Control (SOC) from the parking companies (Annex D of the response) - these appear to be mandatory either as part of the 'onboarding' or audit process.

Their response letter. FOI13805

Freedom of Information Request

Thank you for your email of 12 September, requesting information under the terms of

the Freedom of Information Act 2000 (FOIA).

You asked:

Please can you provide me with copies of the Data Protection Impact

Assessments done in relation to the award of KADOE contracts to the following

organisations.

I understand the following companies will have contracts with yourselves, and

it is any DPIAs related to their contracts that I am seeking.

1. Excel Parking Services Ltd

2. Parkingeye Ltd.

3. APCOA - Companies House lIsts three iterations of this name and I believe

you may have contracts with one or all of them.

a) APCOA Parking (UK) Ltd

b) APCOA Parking Services (UK) Ltd

c) APCOA Parking Holdings (UK) Ltd

The recorded information held within scope of your request can be found in the

attached pdf document.

This provides the Driver and Vehicle Licensing Agency’s (DVLA) Data Protection

Impact Assessment for the Keeper at Date of Event (KADOE) Application

Programming Interface (API).

The KADOE API is a service by which users may request registered keeper

information from the DVLA using a date of event. Users of this service may be local

authorities / agencies or private companies. These users will have entered a contractwith the DVLA to obtain this information. Some information has been withheld under

the following exemptions:

• Section 40(2) – Personal information (names and details of civil servants).

• Section 43(2) – Commercial interests.

• Section 31(1)(a) – Prevention or detection of crime.

The attachment contains names and personal details of civil servants, and these have

been withheld under section 40(2) as it is considered to be personal information.

The attachment also contains security posture and supplier / service information and

is being withheld under Section 43(2). Information is exempt if its disclosure would, or

would be likely to, prejudice the commercial interests of any person (including the

public authority holding it). This is a qualified exemption and is therefore subject to a

public interest test.

This requires us to balance the public interest arguments for disclosing the information,

against those for withholding it.

Public interest test – Section 43(2)

Factors for disclosure:

• Promotes transparency and accountability.

• Enables public understanding of how public services operate.

Factors for withholding:

• Disclosure of supplier / service and security-related information, which could

cause harm to the organisation or the vendor.

On balance, the DVLA considers that the public interest favours withholding this

information.

In addition, the attachment contains information that the DVLA considers to be

prejudicial to its IT security, and this has been withheld under section 31(1)(a) of the

FOIA.

Public interest test – Section 31(1)(a)

Factors for disclosure:

• Promotes transparency and accountability.

• Enables public understanding of how public services operate.

Factors for withholding:

• Disclosure would be likely to increase the risk of a successful cyber-attack

against the DVLA.

• The DVLA must take all reasonable steps to ensure the security and integrity

of all its IT systems.

On balance, the public interest favours maintaining the exemption.The information which follows concerns the procedures for making any complaint you

might have about the reply. Please quote the reference number of this letter in any

future communications about it.

Yours sincerely,

Freedom of Information Team

The attached DPIA is a PDF so I will have to screenshot and post separately - may take me a while

GrannyKate

FOI 13805 DVLA Kadoe DPIA attachments - I am struggling with how to upload this - it was a PDF but I have screenshot pages to make word documents but can't upload these either. Any suggestions welcome.

1505grandad

Do you have to have a certain number of characters before posting the screenshot?

GrannyKate

I can post individual screenshots but there are 100 plus - I may just go through and post a few bits of interest

GrannyKate

I have sent a further email to DVLA this morning as follows;

Thank you for your response to my FOIA request.  Please can I clarify some issues about your response.  I appreciate that you have supplied me with a DPIA completed internally at DVLA at the time which you were moving to the KADOE API system.  I recognise that this fits within the category of ‘related’ to contracts with the individual parking companies listed.  Please can you confirm that this means you do not require DPIAs from individual contractors and thus will not hold them. 

In reading the information which you have supplied it appears that ,rather than DPIAs, mandatory Statements of Control (SOC) are required at ‘onboarding’ and for annual audits from all bodies with access to the KADOE system.  I would, therefore, request the SOCs  obtained from the same companies listed in my previous request.
1) Excel Parking Services Ltd2) ParkingEye Ltd3) APCOA Parking (UK) Ltd4) APCOA Parking Services (UK) Ltd5) APCOA Parking Holdings (UK) Ltd
I appreciate that some degree of redaction may be appropriate and that you may wish to answer my first paragraph and then consider my request for SOCs as a separate FOIA request.

—

A few direct quotes from the DPIA attached to their initial response (not the full text);

(p4) There is an on-boarding process for brand new customers which is followed by a 6-month probationary period

where the use of the service is closely monitored. If a customer were to process data without a valid purpose or

evidence to support the enquiry, their access to the data may be suspended. Customers are set up with codes which

allow them to enquire about keeper details on a vehicle record at a specific point in time.

(p9)

The provision of the tax class of a vehicle, by inference may be

considered special category (medical) data, if it is the disabled tax

class

(p11)

Fee paying customers - will be required to attend an initial set up call with DVLA’s Data Assurance Team

before onboarding to the KADOE service; and a statement of control (SOC) questionnaire (see Annex D) will

be completed (the SOC is part of the new audit regime introduced in May 2022).

• Fee-paying customers will also need to complete a six-month probationary period, involving monthly audits

completed by Government Internal Audit Agency (GIAA), to ensure enquiries are being made in line with

the contract and permitted purpose. The final probation audit will consist of checks made on the answers

provided on the statement of control questionnaire and also a sample of enquiries. This will also be conducted by GIAA.

(p12) Although not within scope of this DPIA, an audit test plan for each customer (i.e. what we want to audit them on,

when we want to audit them and how we will audit them), will be informed by which risk category they fall into.

This could be a remote audit, a site visit where we check their technical security or GIAA may just check a sample

of enquiries. One customer may have regular audits whilst others will just be ad hoc, dependent on their risk

category.

Initially, every customer will complete a SOC which will then feed into their existing customer profile (this applies

to KADOE and, customers). Questions include the broader use of data, what security and retention controls

are in place, contractual compliance, and general awareness for data protection compliance. Other considerations

include the organisation’s approach to data security i.e. culture, training.

(P22-23) Compliance with Data Protection Principles

The DVLA keeps under review the permitted purposes for enquiring on vehicle keeper data via KADOE and any new processing purpose is considered via the Agency's Data Sharing Clearance Process.

If a customer were to enquire on vehicle keeper data outside

of their permitted purpose(s) or without the required evidence,

they would be in breach of the terms of their contract and could

be suspended from using the KADOE service.

In addition to this, the KADOE API system will prevent a

customer from requesting data for a purpose they haven’t

been approved for.

As DVLA release data under Regulation 27 of the Road Vehicles

(Regulation and Licensing) Regulations 2002, we require evidence to demonstrate that the criteria to permit the

disclosure of the data have been met.

Customers whose requests rely on Reg. 27 (1)(e) must provide

evidence that their request demonstrates reasonable cause.

The evidence of this could be photographs of the incident in

question, such as a vehicle not displaying a ticket or not parking

within a marked bay etc.

In the case of a Local Authority, we release information under

Reg. 27 (1)(i) and (iii) which allows them to investigate an

offence or decriminalised parking contravention. The evidence

could be photographs of an incident or a witness statement

completed by the investigating officer or member of the public

that witnessed the offence/incident.

To ensure data is only supplied to customers where

appropriate, KADOE customers are subject to audits based on

their risk profile so that customers who present a higher risk

are audited more frequently until DVLA are satisfied that the

risk has been reduced.

For audits by GIAA, evidence is checked against the enquiry

reason code. The evidence provided will depend on the

customer type and the enquiry reason code. DVLA also carry

out detailed SOC audits which assess a wide range of potential

risks (see Annex D).

A comparison with the contractual agreement we hold for the

enquiring customer, and in line with its permitted purposes

also, forms part of the audit process.

KADOE customers who fail to provide the correct evidence

and/or are found to breach the terms and conditions of use of

the service can be suspended from using the service.

KADOE will use the platform for reporting purposes.

Please see DPIA 195 for more information.

The 850+ users of KADOE have an MoU or contract in place

which will outlines the purposes for which the customers can use the service.

GrannyKate

Annex D from the above DPIA - Statement of Control template - not very clear but readable. I bet they all answer no to question 44.

Coupon-mad

So they haven't updated their DPIA (nor their KADOE application forms, as proved by the Excel one at Warburton) since the DUA Act 2025.

GrannyKate

I received a response to my latest email to DVLA. They have treated my request for completed SOC forms as a new FOIA request which I rather expected. They have not (so far) answered my request for clarification of the previous response ie  Please can you confirm that this means you do not require DPIAs from individual contractors and thus will not hold them.