You do have grounds to report Universal to the DVLA based on the misuse of DVLA keeper data, which is a serious matter.
Grounds for complaint are:
• The Notice to Keeper was issued five months after the alleged contravention.
• This is well outside the time limits set under Schedule 4 of the Protection of Freedoms Act 2012 (PoFA) to lawfully pursue the Keeper for payment.
• The operator explicitly relied on PoFA in their NtK, implying they could hold the Keeper liable.
• The IAS appeal was withdrawn after the Keeper raised the lack of PoFA compliance—confirming that the operator had no legal basis to pursue the Keeper.
Therefore, the operator appears to have accessed and used DVLA data under false pretences, i.e., on the basis that they had a lawful reason to pursue the Keeper when they did not. Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Universal Parking Enforcement Ltd, an IPC AOS member with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—through conduct that contravenes the PPSCoP—renders that use unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: Universal Parking Enforcement Ltd
Date of PCN issue: 27 November 2024
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report a misuse of my personal data by [INSERT PPC NAME], who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although the parking company may have had reasonable cause to request my data initially, the way they have used that data afterwards amounts to unlawful processing. This is because they have acted in breach of the BPA/IPC Private Parking Single Code of Practice (PPSCoP), which is a mandatory requirement for access to DVLA keeper data. The PPSCoP forms part of the framework that regulates how parking companies must behave once they have received keeper data from the DVLA.
The KADOE contract makes clear that keeper data may only be used to pursue an unpaid parking charge in line with the Code of Practice. If a parking company fails to comply with the PPSCoP after receiving DVLA data, their use of that data becomes unlawful, as they are no longer using it for a permitted purpose.
InIn this case, Universal Parking Enforcement Ltd has breached the PPSCoP in the following way:
– They issued a Notice to Keeper dated 27 November 2024 for an alleged contravention on 27 June 2024, i.e. over five months after the event.
– Despite this delay, the NtK purports to hold the registered keeper liable, using language that closely mirrors the requirements of Schedule 4 of the Protection of Freedoms Act 2012 (PoFA).
– The NtK fails to clarify that PoFA does not apply, and instead implies that the Keeper will be held liable if driver details are not supplied.
– The operator subsequently pursued the registered keeper as liable under PoFA until the IAS appeal highlighted the lack of compliance, at which point they withdrew their case entirely.
These are not minor or technical breaches. They show a clear disregard for the standards required under the current single Code. As a result, the operator is no longer entitled to use the keeper data they obtained from the DVLA, because the purpose for which it was provided (a fair and lawful pursuit of a charge under the Code) no longer applies.
The DVLA remains the Data Controller for the data it releases under KADOE, and is therefore responsible for ensuring that personal data is not misused by third parties. This includes taking action against AOS operators who breach the conditions under which the data was provided. I am therefore asking the DVLA to investigate this breach and to take appropriate action under the terms of the KADOE contract.
This may include:
• Confirming that a breach has occurred
• Taking enforcement action against the operator
•Suspending or terminating their KADOE access if warranted
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
What date did you receive this rejection, today?
I will include below an adapted version of a suggested IAS appeal, taken from another ongoing case at this exact location, taken from this thread: Universal Parking Enforcement, PCN, Parking on a no Parking Area, Kellys Storage LU2 9LF (https://www.ftla.uk/private-parking-tickets/universal-parking-enforcement-pcn-parking-on-a-no-parking-area-kellys-storage-lu/msg63296/#msg63296)
Be under no illusions that the IAS are not fit for purpose, and there's a strong chance they will reject your appeal. However, it costs nothing to try, and the result is not binding on you. I usually don't recomend bothering with the IAS, but of the very small number of successful IAS appeals I have seen, they've nearly all been cases like this where the notice was issued far too late.
Again, you are appealing as the registered keeper.
[NAME] (Registered Keeper) (Appellant)
-Vs-
Universal Parking Enforcement (Operator)
Vehicle Registration Mark:[VRM]
Parking Charge Notice Number: [PCN REFERENCE]
Case Overview:
I, the registered keeper (“I”/“the Appellant”) of the above vehicle (VRM: _______), received a parking charge notice via post from Universal Parking Enforcement (“the Operator”), which purported to be a Notice to Keeper. I appealed to the Operator, who acknowledged and subsequently rejected my appeal. It is my position that as the registered keeper of the vehicle I have no liability for the parking charge, and that my appeal should therefore be upheld. My appeal is on the following grounds:
1. No keeper liability: the Parking Charge Notice does not comply with the requirements of Schedule 4 of the Protection of Freedoms Act (“PoFA”/“the Act”):
The operator does not not know the identity of the driver and is therefore seeking to recover the charge from me, the registered keeper of the vehicle. As established in the persuasive appeal case of VCS v Edward (2023) [HOKF6C9C], the Operator may not draw an inference as to who was driving on the basis of who the registered keeper is. They are therefore pursuing me as the registered keeper, and the IAS should therefore consider my lack of liability for the charge as the keeper of the vehicle.
In order to be able to recover any unpaid charges from me as the registered keeper, the operator must comply with the requirements outlined in Schedule 4 of the Protection of Freedoms Act 2012. They have failed to do so. They have failed to deliver the notice within the relevant period of 14 days beginning with the day after that on which the specified period of parking ended, as specified by 9(5) of the Act.
Date of Parking: 27/06/2024
Date of PCN issue: 27/11/2024
Date of presumed service (2 working days after issue, as per 9(6) of the Act): 29/11/2024
Elapsed time period: 155 days
The notice was sent and delivered more than 5 months after the date of the alleged parking event. As Universal Parking Enforcement have clearly not complied with the conditions of PoFA, and as there is no evidence as to who was driving, I cannot be held liable for the charge as the registered keeper, and my appeal should be upheld.
[/quote]