Driver and Vehicle Licensing Agency
Head of Data Sharing
D16
DVLA
Longview Road
Swansea
Mr Graham Payne
SA6 7JL
[FOI #36656 email]
Telephone
Fax
Textphone
Email
Website
www.direct.gov.uk/motoring
Your Ref
Our Ref
FOIR1982/10
Date:
18 June 2010
Dear Mr Payne
Thank you for your request made under the Freedom of Information Act 2000 (FOIA)
which was received on 7 June 2010.
You asked for clarification relating to the release of information from DVLA’s records to
Debt Collecting Companies (DCCs).
You specifically asked the following:-
1) If my understandings are incorrect in any way.
The information provided in the FOI request, FOIR 1209-08 refers to DVLA’s use of Debt
Collection Companies (DCCs) to help recover unpaid penalties for non-payment of vehicle
excise duty or for failure to declare a Statutory Off-Road Notification (SORN). This does
not refer to wider disclosure to DCCs for non DVLA purposes.
In this instance the DCC is a data processor acting on behalf of the Secretary of State for
Transport to help fulfil his functions. Relevant data is passed to the debt collection agency
in order to recover payment on DVLA’s behalf. As data controller, DVLA continues to be
responsible for the data and ensures that processing is in accordance with the Data
Protection Act (DPA), and processed under strict terms of contract. This is carried out in
accordance with the provisions of the DPA and does not require the consent of the
individual concerned. In this circumstance, data is not disclosed under Regulation 27 of the
Road Vehicles (Registration and Licensing) Regulations 2002.
Page 1 of 5
DVLA may also release information to DCCs under the provisions of Regulation 27. This
allows information to be provided where there is liability on the part of the motorist. In the
case of DCCs, this relates to unpaid charges relating to the vehicle.
2) What, if any, Statutory Provision entitles DVLA to release personal data to Debt
Collection Companies (DCCs) for the purpose of 'efficient and effective' collection
of civil debt?
As detailed in the response to question 3 below, the ‘reasonable cause’ provisions of
Regulation 27 allow for information to be provided to DCCs to pursue a civil debt where
that debt relates directly to that vehicle.
3) What 'reasonable cause' the DCCs have to request and /or receive personal data
from DVLA except that which I understand and state above, if any?
DCCs are used when a person has failed to pay charges that are due and, where a debt is
owed, so the release of information in these circumstances would fall under the reasonable
cause provisions, as DVLA takes the view that the release of information under these
provisions should relate to the vehicle or its use, following incidents where the driver or
keeper of the vehicle has a liability to the third party.
As explained above, DCCs are used by DVLA where Late Licensing Penalties (LLPs) are
not paid. It is a legal requirement for the registered keeper to ensure that their vehicle is
currently licensed at all times, or to ensure that a (SORN) declaration is made. The use of
DCCs is required to ensure collection of these penalties.
Information is also released to DCCs for other purposes, relating to unpaid debts relating to
the vehcile or its use. For example, the DVLA accepts that some companies use DCCs to
recover unpaid charges on that company’s behalf.
It should be noted that any information passed on is only permitted to be used for the
purpose for which it was initially requested.
The DVLA would be concerned if information were to be used for a purpose other than
that it was requested for. If this were to occur, DVLA would ask the Information
Commissioner to investigate the matter.
4) By whom, and on what Lawful Authority is this practice 'accepted'?
The provision of information to DCCs is lawful as it is released to enable the pursuit of a
civil debt, and this falls under the ‘reasonable cause’ provisions for release. These allow
for redress to be sought where charges owed have not been paid.
5) Why does DVLA NOT disclose publicly to ALL motorists that it is their policy to
release personal data to DCCs in certain circumstances?
Page 2 of 5
Information is provided on the information leaflet (INS160), which accompanies the
Registration Certificate. This advises motorists that regulations allow information to be
released to the police and local authorities, to assist with the investigation of offences and
parking violations, and to anyone who can demonstrate ‘reasonable cause’ for their request.
The leaflet also directs the motorist to the web-site if they would like to know more about
the circumstances in which personal data is released and what the Agency considers to be
‘reasonable cause’. The address i
s www.direct.gov.uk/dvladataprotection
The web-site contains comprehensive information relating to the release of information and
provides examples of organisations that have previously met the reasonable cause criteria.
This includes the release of information for debt collection purposes.
Full details on the release of vehicle keeper information and where personal data may be
dislcosed are available on the website at
http://www.direct.gov.uk/en/Motoring/OwningAVehicle/AdviceOnKeepingYourVehicle/D
G_4022066
6) What criteria is applied to the selection of DCCs used by DVLA?
The Evaluation Criteria and Weightings are shown below:
Evaluation Criteria
Weighting
Experience in debt collection and ability to manage and operate the
10
contract
Adherence to and understanding of the contract specification
9
Price/percentage fee and structure/value for money
8
Demonstrate an ability to meet specified targets
7
The quality of internal assurance
6
Demonstrate flexibility with regard to operating the contract as
6
directed by DVLA e.g. volumes/NI/new technology/ systems
Ability to maintain secure practices with regard to data
5
Contingency arrangements
5
7) What codes of practice, safeguards and limits are placed on the DCCs to regulate
the behaviour of DCCs, and to restrict the use of and protect personal data
supplied by DVLA?
This information is not held. All DCCs work within their own guidelines and adhere to the
Credit Service Association and Office of Fair Trading guidelines. It is a condition of
working with the DVLA that they must be registered with the Office of Fair Trading and be
a member of an Accredited Trade Association and abide by their Code of Practice.
That said the contract contains DCC specifications, which stipulate that –
Page 3 of 5
The Contractor must sign a Non-Disclosure Agreement in respect of the exchange and
use of data and comply with the guiding principles of the DPA 1998. Written assurance
must be provided that the Contractor will comply with the DPA.
The data should only be used for the purposes of the Contract and not shared with Third
Parties.
8) What monitoring and enforcement provisions are in place to ensure DCCs
compliance with any codes of practice safeguards and restrictions placed on the
DCCs by DVLA?
'DVLA monitors debt collector activity through performance indicators within a Service
Level Agreement. The contract contains provisions for regular audits of debt collector
activities in conducting the contracted services, and all aspects of debt collector
performance are monitored, reported on and discussed at regular contract review meetings
9) Is DVLA aware or any complaints about or breaches of any codes of practice,
safeguards for and limits of use of data placed on the DCCs by DVLA, and what
action has DVLA taken against any DCC in this event?
Where DVLA contracted DCCs are concerned, complaints are forwarded directly to the
respective DCC for attention and are dealt with under their own internal complaints
procedures. The DCCs are regulated by the Credit Service Association and the Office of
Fair Trading who monitor the DCCs complaint procedure.
While there may have been instances in which a general complaint has been received which
contains an element about DCC action, DVLA does not hold statistics to readily identify
these complaints.
I should explain that the Agency transfers approximately 39,000 enforcement cases per
month to the DCCs. To process your request would require a manual interrogation of each
individual enforcement case to determine if a complaint about the DCC had been made and
then review the nature of the complaint independently. While DVLA may hold this
information, the Agency is not obliged to process requests likely to exceed the cost limit of
£600 for provision of information under the FOIA. Therefore this information will not be
made available to you under Section 12 of the FOIA as the cost of compliance exceeds the
appropriate fees limit.
Where DCCs who request information from the DVLA under reasonable cause provisions
are concerned, any complaints received relate in general to the release of information rather
than the behaviour of the companies.
I should explain that the Agency has safeguards in place for the release of information to
private companies. Companies that request vehicle keeper data, via paper-based application
forms, must provide information about their business operations, full details of the incident
leading to their request and how the information will be used. All applications are
scrutinised to ensure that ‘reasonable cause’ has been demonstrated.
Page 4 of 5
Companies who request information electronically, do so under contract which stipulates
clear terms of agreement and outlines when information may be requested, how it can be
used and how it should be stored. DVLA carries out audits of external data users to ensure
compliance with these conditions. Those who supply a high volume of requests and wish to
do so electronically must firstly serve a mandatory six-month probationary period and be a
member of a DVLA Accredited Trade Association (ATA), with a Code of Practice all
members must adhere to, if they are not subject to statutory regulation.
If they fail to abide by the ATA Code of Practice they will lose their ATA membership
and, with it, the ability to request DVLA data.
If you are unhappy with the decisions made by this Agency in relation to your request, you
may ask for an internal review. If you wish to complain, you should write to the Freedom
of Information Best Practice Team, D16, DVLA, Morrision, Swansea, SA6 7JL or email
[DVLA request email].
If you are not content with the outcome of the internal review, you have the right to apply
directly to the Information Commissioner for a decision. Please see attached details of the
complaints procedure and your right to complain to the Information Commissioner.
If you have any queries about this letter, please contact the Freedom of Information Best
Practice Team, D16, DVLA, Morriston Swansea, SA6 7JL or email [DVLA request email]
Please remember to quote the reference above in any future communications.
Yours sincerely
Paul Jeffreys
Head of Data Sharing and Protection Policy
Page 5 of 5
