[ En Te See] NTK ignored :( [Bee UU Legal] follow up advice please

In addition to the SAR to NTC, is this one suitable for the DVLA? and is it ok to email them this one to
"SubjectAccess.Requests@dvla.gsi.gov.uk"

Restriction of automated decision-making and data release under GDPR Article 22

Dear Sir/Madam,

I understand from reading the privacy notice provided by DVLA here:

https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter

that DVLA will release my personal details to private and public-sector organisations providing they can demonstrate reasonable cause to receive it. It is also my understanding that this information is released electronically and automatically without human intervention using the Keeper at Date of Event (KADOE) system.

This arrangement falls under the scope of Article 22 of the GDPR, which states:

“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” [GDPR Article 22(1)]

My concern is that this automated process does not:
i. check that reasonable cause exists, or;
ii. check that the KADOE System user has met their contractual requirement with DVLA, which includes verification:
a) that information from the records are used for the reason given;
b) that evidence exists that an unauthorised parking incident occurred;
c) there is a valid and current agreement in place between the private parking operator and the landowner of the specific site in question to authorise the private parking operator to operate the parking scheme on their land and to take legal action to recover a charge on their behalf.

As such, I now request that any and all DVLA records containing my personal details as Registered Keeper of AA11BBB be marked as frozen so that all future decision-making involves human intervention and that - where the request is not from the Police or a Local Authority - I am always contacted by the DVLA in advance of the release of my data, so that as the data subject with rights as set out in the GDPR, I can express my point of view, obtain an explanation of the decision to share data and, if applicable, challenge it.

Please take express note that I am not requesting for a restriction of processing under Article 18 of GDPR but am instead exercising the rights for data under Article 22(3) which states:

“… the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.” [GDPR Article 22(3)]

In this case, automated decision making is not required for entering into, or performance of, a contract between the data subject (in this instance, me as Registered Keeper of a vehicle) and a data controller (in this instance, either the DVLA or the appropriately named individual in a private company). Hence the exclusion given in Article 22(2)(a) does not apply.

Further, I note that while Regulation 27 of the Road Vehicle (Regulations and Licensing) Regulations 2002 provides a legal gateway for release of this information, it does not specify the means by which this data release should occur. I therefore contend that there is no Union, nor Member State, law applicable in this regard under Article 22(2)(b), and the provisions of Article 22(1) thus apply.

The only remaining applicable exclusion for automated decision-making therefore is given in Article 22(2)(c), which relies on the explicit consent of the data subject. This explicit consent had not previously been given, and by this letter you are now notified of this in addition to the withdrawal of any implied consent on which you may have been previously assumed and/ or been reliant.

Please confirm by return that you have fully understood the content of this letter, specifically my rights as a data subject and the provisions under GDPR Article 22(3), and that my records will be appropriately marked for human intervention and written contact to me, as the data subject, prior to release to any and all private companies.

Failure to acknowledge this request will immediately be met with letters of complaint to the ICO and my MP.

Yours Sincerely



Or is the simpler:-

separate email to SubjectAccess.Requests@dvla.gsi.gov.uk of the following form for each of my cars with date ranges covering the entire period of my ownership

“Subject : Subject Access Request VRM 123 ABC

DVLA Vehicle Record Enquiries section
Longview Road
Morriston
Swansea
SA99 1AJ

Dear Sirs

Re: VRM 123 ABC

As the Registered Keeper of the above VRM could you advise who has accessed my personal details with regards to this marque, how often and when did the DVLA send the keeper details ou?. Please advise the information with regards to events between 01/01/2011 and 10/11/2018.

I understand there is no charge for this information and look forward to your speedy reply.

Reg Keeper
Current address
xxxxx
xxxxx
xxxxx”


has there been a ‘better or more reliable set of responses with either approach? I would add something regarding the request to prevent further use of my data .??