Private Parking Companies (use of data)

Amanda Briggs made this Freedom of Information request to Driver and Vehicle Licensing Agency

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was partially successful.

Dear Driver and Vehicle Licensing Agency,

Please could you clarify a few questions surrounding how data is managed and protected in the following scenarios:

B7.1. The DVLA shall take all reasonable steps to ensure that the Data is accurate and up to date before it is transmitted to the Customer, but the DVLA cannot warrant the accuracy of the Data provided. The DVLA does not accept any liability for any inaccurate information supplied to it by the keeper of the vehicle or any other source beyond its control
requirements of the ATA Code of Practice or conduct
Question: If there is an admin/technical error and DVLA did not update the details on receipt of the V5C and later rectified this; but during this time a KODOE request was made; how should the agents proceed. For example should the agent of a private parking company accept an official letter from the DVLA as proof that the details have since been updated and the data subject was not the registered keeper at the time of the KODOE request?

C3.1. The Customer shall complete the list at ANNEX B (“Customer’s Key Staff”) of the individuals who have direct responsibilities for the use of the Data and for the Customer’s other obligations under this Contract, giving their names and business addresses and other contact details and specifying the capacities in which they are concerned with the Data
Question: How is the key staff or individuals audited for example can a data subjects details be passed to a third party to chase payments?

D2.1. Both Parties shall ensure the safe transportation/transmission of the Data in accordance with the appropriate technical and organisational measures.
Question: can you confirm how this is governed and audited if data subject data is passed from 1 company to a third party?

D6.1. In accordance with Data Protection Legislation, the Customer shall retain each item of Data only for as long as is necessary with reference to the Reasonable Causes for which it was shared.
Question: if the data subjects data was unfairly obtained and proved that the data subject is not liable for a fine, how will the data be permanently removed; for example incorrect data was proved to be the fault of DVLA and the data subject requests to delete their data has been ignored by the third party - how is this governed and what steps are in place to protect the data subject.

Last question is there a process under the GDPR to ensure that my data is not sold to any third parties and if so can you confirm the steps I need to take to put this in place (this question excluded the police and legally binding obligations).

Yours faithfully,

Mrs Briggs

Dear Driver and Vehicle Licensing Agency,

Please can you urgently reply to my request as it is now over the expected legal timeline.

Yours faithfully,

Amanda Briggs

Dear Driver and Vehicle Licensing Agency,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Driver and Vehicle Licensing Agency's handling of my FOI request 'Private Parking Companies (use of data)'.

There has been no response..

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

Amanda Briggs

Dear Driver and Vehicle Licensing Agency,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Driver and Vehicle Licensing Agency's handling of my FOI request 'Private Parking Companies (use of data)'.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

Amanda Briggs

Dear Driver and Vehicle Licensing Agency,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Driver and Vehicle Licensing Agency's handling of my FOI request 'Private Parking Companies (use of data)'.

This request has been ignored.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

Amanda Briggs

FOI FOI, Driver and Vehicle Licensing Agency

Dear Ms Briggs

Thank you for your request about how data is managed in the DVLA. I apologise for the time taken to respond.

Question: If there is an admin/technical error and DVLA did not update the details on receipt of the V5C and later rectified this; but during this time a KADOE request was made, how should the agents proceed. For example should the agent of a private parking company accept an official letter from the DVLA as proof that the details have since been updated and the data subject was not the registered keeper at the time of the KODOE request?

When the DVLA release vehicle keeper data to the KADOE customer, it is correct at the date of event. There may be instances when a record is updated with new keeper details and this has been backdated to a point in time in the past.

If the KADOE customer was to make another request for keeper details using the same date of contravention, and the record had been updated, then they would get the new keeper details returned via the response.

The DVLA may issue the previous keeper with a letter, as evidence that they have informed DVLA that they are no longer the keeper of a vehicle and that our records have been updated. However, DVLA does not regulate the Private Parking industry, so is not in a position to instruct/mandate private parking companies to cancel charge notices.

Question: How is the key staff or individuals audited for example can a data subjects details be passed to a third party to chase payments?

The DVLA carries out audits of all private parking companies that request DVLA vehicle keeper data. We do not audit staff, that is the responsibly of the company. The purpose of the audit is to confirm the reasons for each data request, to examine what evidence is available to support these requests, and to assess whether data is being accessed, used, and protected in line with the conditions of its release.
In accordance with the KADOE contract private parking companies are permitted to pass DVLA vehicle keeper data to a third party organisation (e.g. a debt collection company) who is acting on the parking companies behalf as their sub-contractor and data processor. This is on the basis that the requirements of Schedule 2 (Minimum Data Security Requirements) and Schedule 3 (Required Terms for Sub-Contractors) are flowed down in a sub-contracting agreement between the KADOE Customer and the Sub-Contractor.

Question: can you confirm how this is governed and audited if data subject data is passed from 1 company to a third party?

It may help if I explain that Clause D2.1 refers to “Parties”, which is defined in the KADOE Contract as the Customer (the private parking company) and DVLA. D2.1 does not refer to passing data to third parties.

As stated in response to your previous question about clause C3.1. A sub-contracting agreement needs to be in place for the parking company to share data with a third party. Details of the sub-contract will be examined as part of DVLA’s auditing regime.

Question: if the data subjects data was unfairly obtained and proved that the data subject is not liable for a fine, how will the data be permanently removed; for example incorrect data was proved to be the fault of DVLA and the data subject requests to delete their data has been ignored by the third party - how is this governed and what steps are in place to protect the data subject.

In line with the KADOE contract the parking company would become data controller of the vehicle keeper data upon receipt from DVLA. Therefore it is for the parking company as the data controller to decide how this data is permanently deleted in line with their data retention policy. The DVLA requirement is stated in clause D6.1 and D6.2 in the KADOE contract. D6.2 states “The Customer shall arrange for the secure destruction or deletion of each item of Data, in accordance with the requirements of Data Protection Legislation, as soon as it is no longer necessary to retain it.”

Audits carried out by DVLA and Government Internal Audit Agency (on DVLA’s behalf) will check that data customers, including private parking companies, have a data retention policy in place.

Last question is there a process under the GDPR to ensure that my data is not sold to any third parties and if so can you confirm the steps I need to take to put this in place (this question excluded the police and legally binding obligations).

Information about registered keepers of vehicles can be released by the DVLA under the provisions of the Road Vehicles (Registration and Licensing) Regulations 2002. This legislation allows vehicle keeper details to be disclosed to third parties who can demonstrate that they have a reasonable cause to receive it and is not based on the consent of the data subject. Reasonable cause is not defined in legislation but the Government’s policy is that it should relate to the vehicle or its use, following incidents where there may be liability on the part of the driver. Guidance on what constitutes reasonable cause is published online at www.gov.uk/request-information-from-dvla
This situation has not changed with the implementation of the General Data Protection Regulation which came into effect in May 2018. The DVLA will continue to share personal data with third parties where the law allows us to do so.

Kind regards,

David A Morgan
Freedom of Information Team
Data Sharing & Protection Group | Strategy, Policy and Communications Group | C2 | DVLA | Swansea | SA6 7JL
Twitter: @dvlagovuk

We can always spot an untaxed car. Tax it or lose it.
Rydym wastad yn llwyddo i ddod o hyd i gar heb dreth. Trethwch ef neu byddwch yn ei golli.
Go to/Ewch i www.gov.uk/vehicletax

show quoted sections