Dear Sir or Madam,

I note from form V888/3 that:

"DVLA’s authorised personnel shall be permitted access to the
company’s operational areas to check the methods of processing. The
company must agree and make available to DVLA’s authorised
personnel such files and records as may be required for them to be
satisfied that data is only used for the purposes for which it has
been released"

Please let me know:

1. How many such investigations took place over the past 5 years

2. What were the results of these investigations?

3. If there is any other auditing mechanism related to the use of
requested Registered Keeper details, how many of these took place
and what were the results?

In addition I would like to know:

4. What research the DVLA has done, or is aware of, regarding the
appropriateness of disclosing Registered Keeper information to
private parking companies, given that any legal remedy such
companies have is likely to be with the driver, not the keeper. If
any research has been done, please disclose the results of the
research.

5. Has the DVLA commissioned or received any legal advice regarding
the appropriateness of the disclosure mentioned in point 4 above?
If so, what was that advice?

Yours faithfully,

Tony Rush

Dear Mr Rush,

Your request for information surrounding the release of registered
keeper details to private companies is being dealt with under the terms
of the Freedom of Information Act 2000.

If you have any queries about this letter, please contact me, quoting
the reference number above in any future communications.

Yours Sincerely

Unsigned sent via email

Mrs Emily Meredith
Senior Business Planning and Administration Manager

show quoted sections

Tony

Thank you for your e-mail regarding the above.

I am happy to answer the following for you:

1. How many investigations took place over the past 5 years

Since the start of financial year 04-05 to date, it is estimated that
373 audit visits have been carried out. It is likely that the actual
figure is greater then this. This number is increasing every year.

2. What were the results of these investigations?

Audits test the controls and processes in place, with particular
attention to security.
Some recurring issues found were that;
- On some occasions the storage of information was not secure (i.e. not
locked away)
- Passwords and user IDs are sometimes being shared within companies.
- Companies were supplying information through e-mail/fax.
- There were some possible unauthorised accesses that were investigated
further.
- Logs of enquiries (not including keeper information) were not kept
correctly
- Users having not read the user agreement between DVLA and the user
company
- Where computers are used to obtain information, the dial up number to
the web link is not concealed on the screen.

DVLA internal audit services raises the issues found during visits to
the company. The company must comply with all the actions that are
suggested to resolve the issues. For those entities where many issues
are raises re-visits are made to ensure compliance and security.

Where the entity does not resolve the problem, or where breaches recur,
DVLA terminates the supplying of information to the entity.

I hope this is of help to you

Regards

Ritah Begum
Corporate Assurance Services
C3/East
DVLA
Swansea
SA6 7JL

show quoted sections

Dear Ritah Begum,

Many thanks for your speedy reply. Do you have the numbers of
instances of re-visit and of termination?

Also, I would still like answers to questions 4 and 5 in my
original request.

Yours sincerely,

Tony Rush

Tony

I will endeavour to find out the number of revisits and terminations
but I will not be able to deal with questions 4 or 5. This is not my
area of expertise.

You would have to talk to someone from our information assurance
department.

Thanks

Ritah Begum
Corporate Assurance Services
C3/East
DVLA
Swansea
SA6 7JL

show quoted sections

Tony

As an approximation, I can tell you that 3 companies have previously
been removed until their operation was seen to be complying.

In terms of the number of revisits, I have no exact figure but I can
tell you that this occurs when there are many issues arising from the
first visit. A revisit is put in place to ensure that issues raised have
been addressed accordingly and that operations meet our standards.

Thanks

Ritah Begum
Corporate Assurance Services
C3/East
DVLA
Swansea

Ext. 8450
SA6 7JL

show quoted sections

Please find attached the response to your FOI request.

show quoted sections

Dear Sir or Madam,

I note from form V888/3 that:

"DVLA+IBk-s authorised personnel shall be permitted access to the
company+IBk-s operational areas to check the methods of processing. The
company must agree and make available to DVLA+IBk-s authorised
personnel such files and records as may be required for them to be
satisfied that data is only used for the purposes for which it has
been released"

Please let me know:

1. How many such investigations took place over the past 5 years

2. What were the results of these investigations?

3. If there is any other auditing mechanism related to the use of
requested Registered Keeper details, how many of these took place
and what were the results?

In addition I would like to know:

4. What research the DVLA has done, or is aware of, regarding the
appropriateness of disclosing Registered Keeper information to
private parking companies, given that any legal remedy such
companies have is likely to be with the driver, not the keeper. If
any research has been done, please disclose the results of the
research.

5. Has the DVLA commissioned or received any legal advice regarding
the appropriateness of the disclosure mentioned in point 4 above?
If so, what was that advice?

Yours faithfully,

Tony Rush

show quoted sections