The DVLA’s Step 2 response is a strategic deflection, riddled with contradictions and legally questionable assertions. It fails to engage with the central points and doubles down on a justification that does not withstand legal scrutiny.
This now warrants:
• Escalation to the ICO, citing data misuse and lack of lawful basis under UK GDPR.
• A renewed and stronger approach to your MP, stressing that the DVLA has now admitted it is releasing personal data to an unregulated private company acting as a proxy debt collector for foreign governments without any statutory basis or data-sharing agreement.
• A follow-up letter to Transport Ministers and possibly the Information Commissioner’s Office via your MP, due to the public interest implications.
Here is a draft ICO complaint:
Subject: Formal Complaint – DVLA Unlawful Disclosure of Personal Data to Euro Parking Collection PLC for Foreign Toll Enforcement
Dear ICO,
I am submitting a formal complaint against the Driver and Vehicle Licensing Agency (DVLA) for unlawfully disclosing my personal data to a private company, Euro Parking Collection PLC (EPC), in breach of UK data protection law.
Background
On 6 December 2023, the DVLA released my vehicle keeper data to EPC. The company claims this was in relation to a Hungarian road toll charge. The DVLA’s Step 2 complaint response (dated 4 June 2025, signed by Mrs N Smith) confirms that:
• EPC obtains DVLA data for the purpose of pursuing foreign toll charges;
• EPC is acting on behalf of non-UK authorities, primarily within the EU;
• EPC uses UK keeper data to pursue recovery within the UK, but no reciprocal enforcement arrangement exists;
• The DVLA does not disclose this to data subjects at the time of collection.
Why This Is Unlawful
1. No Lawful Basis Under UK GDPR
The DVLA relies on Regulation 27(1)(e) to justify disclosure. However, this regulation must be interpreted in accordance with UK GDPR Article 6. There is no lawful basis for releasing UK data for the enforcement of foreign public law toll penalties — especially when:
• There is no international agreement in place for such enforcement post-Brexit;
• The processing is not necessary for a legal obligation or a task carried out in the public interest (Art. 6(1)(c) or (e));
• The data is used by a private company with a commercial interest, not a competent authority.
2. Failure of Transparency and Fair Processing
Under Article 5(1)(a) and Article 13, data subjects must be informed:
• Who their data is being shared with;
• For what specific purpose;
• On what lawful basis;
• And whether foreign entities are involved.
The DVLA’s privacy policy does not disclose that keeper data may be shared with an unregulated private company to pursue foreign tolls on behalf of non-UK governments. This failure violates the transparency and fairness principles under UK GDPR.
3. Purpose Creep – Article 5(1)(b) Violation
Data was disclosed under the pretence of toll enforcement, but the actual use is commercial debt recovery through UK civil channels. This is not compatible with the purpose for which the data was obtained and constitutes unauthorised further processing.
4. Inadequate Safeguards for a High-Risk Processing Activity
This processing concerns:
• Sensitive personal data;
• Cross-border implications;
• Use by a non-regulated private entity;
• The threat of court action and damage to reputation/credit.
Despite this, the DVLA admits that:
• It does not require disclosure of the country where the toll occurred;
• It allows private actors to process this data without independent oversight;
• There is no Code of Practice or redress route for UK data subjects targeted by EPC.[/indent]
This fails the requirements under Article 24 (data controller responsibility) and Article 25 (data protection by design and default).
Requested Action by the ICO
I ask the ICO to:
1. Open a formal investigation into the DVLA’s release of keeper data to EPC for foreign toll enforcement.
2. Determine whether DVLA has breached:
• Articles 5(1)(a), 5(1)(b), 6(1), 13, 24 and 25 of UK GDPR;
• The fairness and lawfulness principles under the DPA 2018.
3. Require the DVLA to:
• Suspend all such data releases until a lawful framework is established;
• Update its privacy policy to explicitly disclose any processing of data for foreign enforcement;
• Review the KADOE system to prevent improper use of Regulation 27.
[/indent]
I attach the DVLA’s responses, copies of the EPC correspondence, and my Step 1 and Step 2 complaints.
Yours faithfully,
[Your Full Name]
[Email Address]
[Address]
[Vehicle Registration]
Here is a firm and direct follow-up email to your MP, written to get their attention and prompt action — especially given their silence so far.
Subject: URGENT – DVLA Admits Releasing My Data to Private Company Acting for Foreign Governments Without Legal Basis
Dear [MP’s Name],
I am following up on my earlier letter concerning the DVLA’s unlawful disclosure of my personal data to Euro Parking Collection PLC (EPC) in connection with a Hungarian road toll.
I have now received the DVLA’s Step 2 response (dated 4 June 2025), and what it confirms is frankly staggering:
• The DVLA has admitted that it released my personal keeper data to a private UK company (EPC) which is acting on behalf of foreign governments to recover public law toll penalties issued outside the UK.
• There is no international agreement or legal treaty authorising this data exchange.
• The DVLA does not require EPC to disclose that these alleged contraventions occurred outside the UK.
• EPC is not subject to any regulatory oversight, and the DVLA is knowingly passing sensitive personal data to them anyway.
This is an extraordinary failure of data governance. There is no lawful basis under the UK GDPR or Regulation 27 for releasing personal data for foreign statutory enforcement, especially via an unregulated commercial intermediary. The DVLA’s excuses are evasive and transparently designed to protect its revenue stream from companies like EPC.
The complaint response, although signed only by “Mrs N Smith, DVLA Complaints Team”, fails to engage with any of the legal or regulatory issues I raised. It reads like a boilerplate deflection and raises serious concerns about whether anyone at the DVLA is willing to take personal or departmental responsibility for this unlawful practice.
At this point, I must ask:
Why has there been no response from you? You are my elected representative. The DVLA is abusing its powers, and no UK citizen should be vulnerable to the misuse of their personal data in this way.
I am now urgently asking you to:
1. Raise a formal Written Parliamentary Question (WPQ) asking:• Why the DVLA releases UK citizens’ data to private UK-based companies acting on behalf of foreign governments;
• What lawful basis justifies this under UK GDPR and the Data Protection Act 2018;
• Whether Ministers are aware that DVLA’s actions fall entirely outside the current UK-EU enforcement framework.
2. Write directly to the Parliamentary Under-Secretary of State for Transport, demanding answers on:• What steps will be taken to immediately suspend these data releases;
• How many UK citizens’ data has been released in this way;
• What redress and protections will be put in place for those affected.
The DVLA is a public body acting without proper oversight, regulation, or lawful authority. This goes far beyond a personal grievance — it is a systemic failure that exposes every UK vehicle keeper to abuse of their data for foreign enforcement purposes, with no legal process and no remedy.
Please confirm that you will act on this immediately.
Yours sincerely,
[Your Full Name]
[Your Constituency]
[Your Email Address]
[Your Vehicle Registration (if included previously)]
The Transport Select Committee scrutinises the Department for Transport and its agencies (including DVLA). You should send the following email because it can:
• Call witnesses,
• Investigate systemic abuse or maladministration,
• Make recommendations to Ministers.
Your complaint concerns DVLA's systemic misuse of keeper data, bypassing GDPR safeguards, enabling unregulated foreign debt enforcement via UK channels, and failing to be transparent with the public. That falls squarely within the Committee’s remit.
Send it to transcom@parliament.uk and also CC in yourself:
Subject: Request for Inquiry into DVLA’s Release of Personal Data to Private Company Acting for Foreign Governments
Dear Committee Clerk,
I am writing to ask the Transport Select Committee to investigate serious concerns involving the Driver and Vehicle Licensing Agency (DVLA) and the release of UK vehicle keeper data to a private company, Euro Parking Collection PLC (EPC).
The DVLA has confirmed, in writing, that it releases personal data to EPC, which is:
• A UK-registered private company,
• Acting on behalf of foreign governments, predominantly within the EU,
• Pursuing foreign tolls and traffic penalties against UK vehicle keepers,
• Operating entirely outside of any statutory framework or reciprocal agreement post-Brexit.
The DVLA admits that:
• It does not verify jurisdiction when releasing data;
• It allows EPC to request and use this data via the KADOE system;
• The data is used to pursue foreign public law penalties in UK civil courts;
• EPC is not regulated under any Approved Operator Scheme for these activities.
This raises extremely serious questions about:
• The legality of DVLA’s interpretation of “reasonable cause” under Regulation 27;
• The lawfulness of the processing under the UK GDPR and DPA 2018;
• The DVLA’s failure to disclose these practices in its Privacy Policy;
• The use of UK citizens’ data by foreign authorities via private proxies, with no oversight, redress, or accountability.
I have followed the DVLA’s internal complaints process and received a Stage 2 response that fails to justify this practice on any legal or regulatory basis.
This is a matter of national significance affecting millions of UK vehicle owners, and I believe a formal inquiry by the Committee is urgently warranted.
Please confirm whether the Committee will consider this matter for investigation. I would be happy to provide the correspondence trail and further evidence if requested.
Yours faithfully,
[Your Full Name]
[Your Constituency]
[Email Address]
You can also lobby the national media and let them know you are dealing with:
• DVLA releasing personal data to unregulated private company,
• For the benefit of foreign governments,
• To be used in UK debt recovery without lawful authority.
This has strong national media appeal — it’s a data protection scandal with real-world financial consequences.
You could email the following publication and media outlets:
The Guardian Investigations/Data rights data@theguardian.com
The Times Consumer affairs money@thetimes.co.uk
The Telegraph Personal finance personalfinance@telegraph.co.uk
BBC Newsnight Investigative journalism newsnight@bbc.co.uk
ITV Tonight Investigations tonight@itv.com
Here is a suggested template to use to send to the relevant journalist or investigations desk:
Subject: DVLA Sharing UK Citizens’ Personal Data with Private Firm Acting for Foreign Governments
Dear [Journalist’s Name or Investigations Editor],
I am contacting you with a story of public interest involving the DVLA, the UK’s vehicle licensing authority, and a private company called Euro Parking Collection PLC (EPC).
The DVLA has confirmed in writing that it releases personal keeper data to EPC, which operates on behalf of foreign governments (including in the EU), to enforce alleged foreign road tolls and traffic fines — even though:
• No data-sharing agreement exists post-Brexit;
• The events occur outside UK jurisdiction;
• The company is not regulated and bypasses the usual Codes of Practice;
• UK citizens are being pursued for foreign fines as if they are private debts in civil courts.
The DVLA allows this through a loophole in its “KADOE” access scheme, without any legal gateway or transparency, and is knowingly passing data to a private enforcement proxy.
This has happened to me personally — I have the documents, DVLA admissions, and complaint trail to prove it. I believe this scandal needs exposure.
I’d be happy to provide the full paper trail and speak further if you’re interested in investigating this.
Yours sincerely,
[Your Full Name]
[Email Address]
[Phone Number (if comfortable)]
Typical obfuscation and fob off by the DVLA. They are trying to avoid responsibility and whoever penned that response has not even bothered to identify themselves, most likely because they know they are out of order.
1. DVLA confirms no UK-Hungary agreement exists
“There is no direct agreement between the UK and foreign authorities to share information for this purpose.”
• This reinforces the position that no lawful gateway exists for the exchange of vehicle data relating to foreign tolls post-Brexit.
2. DVLA does not require EPC to declare the foreign nature of the toll
“Information relating to the location of the toll road is not required to be provided when EPC submit requests.”
• This represents a regulatory weakness, not a defence. The DVLA is effectively allowing a UK company to access UK citizens' personal data without disclosing whether the incident occurred in a foreign jurisdiction, thereby undermining transparency and lawful purpose.
3. EPC’s BPA membership does not cover foreign toll road data
“BPA membership only relates to requests made for parking in the UK; requests for toll roads is a separate issue and ATA membership is not required in these circumstances.”
• This confirms EPC’s toll-related access operates outside the usual KADOE governance framework tied to the BPA or IPC. The protection offered by Code of Practice oversight is absent here, raising concerns over the lack of accountability.
4. DVLA cannot verify EPC’s GDPR compliance
“EPC’s compliance with the UK GDPR ... is not something the DVLA can comment on.”
• While this is a standard disclaimer, it supports escalation to the ICO, who does have jurisdiction to investigate data misuse and processing without lawful basis.
You now escalate this to a Step 2 complaint to the Head of Complaints at the DVLA. The process is exactly the same as for your original complaint except the URL is https://contact.dvla.gov.uk/head-of-complaints.
For the text part of the complaint webform, use this:
I am escalating my complaint to Step 2 of the DVLA complaints process.
My complaint concerns the unlawful release of my personal data to Euro Parking Collection PLC for an alleged toll road contravention in Hungary.
The Stage 1 response received from the DVLA Data Protection Policy team on 29 April 2025 failed to address the core legal issues and factual concerns raised. The response was unsigned, with no named officer taking responsibility, which is particularly alarming given the gravity of the matter.
I have attached a fully detailed supporting statement, identifying multiple breaches of data protection law, the KADOE contract, and regulatory failings by the DVLA itself.
Please confirm receipt and provide a reference number for this Step 2 escalation.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT – STEP 2 DVLA COMPLAINT
Subject: Release of Personal Data to Euro Parking Collection PLC – Misuse of Keeper Data and Failures of Governance
Background
This Step 2 escalation concerns the release of my personal vehicle keeper data by the DVLA to Euro Parking Collection PLC (EPC) on 6 December 2023, relating to an alleged unpaid toll on a Hungarian motorway.
The Stage 1 response issued by the DVLA on 29 April 2025 is wholly inadequate. It failed to address the core concerns about legality, transparency, proportionality, and data governance, and was notably unsigned, raising concerns over the integrity of the complaints handling process.
Grounds for Escalation
1. No Reasonable Cause for Data Disclosure
Legal Reference:
• Regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002;
• UK GDPR Article 6(1)(c) (processing necessary for legal obligation).
Explanation:
Regulation 27 requires that disclosure of vehicle keeper data is based on reasonable cause. In the absence of a direct agreement between the UK and Hungary for civil enforcement of toll road charges, no reasonable cause exists to permit the disclosure of keeper data for a Hungarian road toll alleged breach.
The DVLA’s admission that there is “no direct agreement” governing the sharing of data for toll enforcement outside the UK confirms that no lawful framework existed. Therefore, the release of my data was made without a valid lawful basis under the Regulation and without meeting the requirements of Article 6 of the UK GDPR.
2. Failure of Transparency – Breach of UK GDPR Article 5(1)(a)
Legal Reference:
• UK GDPR Article 5(1)(a): “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”
Explanation:
The DVLA admitted that EPC is not required to disclose whether the alleged toll incident occurred within or outside the UK when submitting a data request. This absence of a mandatory jurisdictional declaration allows data to be obtained under misleading circumstances, preventing data subjects from understanding how and why their data is processed.
This practice is a direct breach of the transparency principle under Article 5(1)(a). Without knowledge of the foreign nature of the alleged event, data processing cannot be deemed fair or transparent.
3. Breach of Purpose Limitation – UK GDPR Article 5(1)(b)
Legal Reference:
• UK GDPR Article 5(1)(b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.”
Explanation:
The DVLA released my data to EPC for the purpose of recovering a toll charge. However, EPC and Moorside Legal are now pursuing the matter as a private civil debt in the UK courts, reframing a foreign public law toll as a contractual claim.
This represents further processing for a purpose incompatible with the one originally specified when the data was obtained. Under UK GDPR, this is unlawful unless new consent or legal authority is obtained, neither of which has occurred.
4. No Effective Safeguards for Toll Data Requests – Regulatory Failure
References:
• Data Protection Act 2018 Section 71 (Data Protection by Design and Default);
• KADOE Contract Schedule 2 (Obligations on Recipients of Data).
Explanation:
Unlike BPA or IPC regulated parking operators, EPC’s toll-related requests are not governed by any Code of Practice oversight. Despite this, the DVLA continues to release personal data based solely on EPC’s self-certification, without verification or mandatory audit of the true nature of each toll request.
This absence of regulatory control breaches the DVLA’s obligations under DPA 2018 Section 71 to implement appropriate technical and organisational measures to ensure, and be able to demonstrate, that processing is performed in accordance with the UK GDPR.
5. Procedural Irregularities in Complaints Handling – Serious Governance Concerns
References:
• DVLA Complaints Policy (Internal standards);
• Civil Service Code (Accountability and Integrity Principles).
Explanation:
The Stage 1 response was issued without any named officer, contrary to standards of public sector accountability. In serious matters involving potential breaches of the law, unsigned responses without any officer identification violate basic governance norms and suggest either an intent to obscure accountability or a culture of evasion.
Given the public interest in lawful data processing by government bodies, this unexplained omission justifies serious concern and raises the appearance of maladministration or even a deliberate attempt to frustrate scrutiny.
Requested Outcomes
I request that the DVLA:
• Reassess the lawfulness of EPC’s KADOE request and the DVLA’s disclosure of my data in light of the absence of reasonable cause.
• Confirm whether EPC’s failure to declare the foreign nature of the toll incident constitutes material misrepresentation.
• Review and reform internal policies to require jurisdictional disclosure for all toll-related KADOE requests.
• Identify and disclose the named individual(s) responsible for the Stage 1 response.
• Investigate potential maladministration within the DVLA's complaints handling and governance process.
• Confirm what enforcement or disciplinary action will be taken if breaches are upheld.
Should this Step 2 complaint not be satisfactorily resolved, I will escalate the matter to the Information Commissioner’s Office (ICO) and my Member of Parliament.
Name: [INSERT FULL NAME]
Date: [INSERT DATE]
Vehicle Registration: [REDACTED]
DVLA Reference (if applicable): [INSERT]
I also suggest you email your MP with the following request:
[Your Address]
[City, Postcode]
[Email Address]
[Date]
[MP’s Name]
House of Commons
London
SW1A 0AA
Dear [MP’s Name],
Subject: Urgent Request to Raise Serious Failings by the DVLA Over the Release of Personal Data to an Unregulated Private Company
I am writing as your constituent to ask you to urgently raise a matter of serious public concern involving the Driver and Vehicle Licensing Agency (DVLA) and the unlawful release of my personal data.
On 6 December 2023, the DVLA released my vehicle keeper information to an unregulated private company, Euro Parking Collection PLC (EPC), in connection with an alleged unpaid road toll in Hungary.
There was no legal basis whatsoever for the DVLA to provide my data to this company:
• The alleged contravention occurred outside of the United Kingdom.
• There is no bilateral agreement between the UK and Hungary allowing such data exchanges for civil toll enforcement.
• EPC is not regulated for toll matters under any Approved Operator Scheme (such as the BPA or IPC).
• EPC was not required by the DVLA to disclose that the incident took place outside the UK.
The DVLA's own written response to my complaint (dated 29 April 2025) admits:
• They do not ask companies requesting data to specify whether the event occurred outside the UK.
• They do not check or audit this basic information.
• There is no legal framework that permits such data releases for foreign toll contraventions.
• EPC's toll requests are unregulated and are not subject to any industry Code of Practice.
This means that an unregulated private company has been allowed to obtain and exploit my highly sensitive personal data based on a misleading and incomplete request, with the DVLA's full cooperation and without any lawful authority.
The DVLA's actions are an absolute betrayal of the trust placed in them by millions of vehicle owners.
It is abundantly clear from the response I received that the DVLA is more interested in preserving its income stream from private companies than protecting the rights of data subjects under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
I am absolutely incensed that a government agency can behave with such disregard for legality, transparency, and accountability — and I believe you should be equally outraged.
In light of the above, I am asking you to take urgent action:
1. Submit a Written Parliamentary Question (WPQ) to the Secretary of State for Transport asking:
Why the DVLA releases personal keeper data for alleged contraventions occurring outside the UK;
• What lawful basis the DVLA relies upon for releasing such data in the absence of any international enforcement agreement;
• What measures will be introduced to stop unregulated private companies exploiting DVLA data for foreign toll enforcement.
2. Write directly to the Parliamentary Under-Secretary of State for Transport (Minister responsible for DVLA) demanding:
• An explanation as to why the DVLA does not verify jurisdiction when releasing data;
• An explanation as to why unregulated companies are allowed access to sensitive personal data without oversight;
• Details of any action being taken to investigate this practice and prevent its continuation.
This is not a mere technical issue.
It is a serious systemic failure in data protection governance at the DVLA, affecting every single vehicle keeper in the UK.
Unless challenged, it risks setting a dangerous precedent where any private company — whether UK-based or foreign — can obtain, misuse and monetise UK citizens' personal data without any proper regulation or scrutiny.
I ask that you treat this matter with the utmost seriousness and urgency.
Please confirm whether you will raise these issues in Parliament and write to the responsible Minister, and keep me informed of any responses you receive.
Yours sincerely,
[Your Full Name]
[Your Constituency]
As it has been pointed out to me, I mistakenly thought that EPC was not a member of any ATA. However, they are BPA members. So, here is the adjusted DVLA complaint:
drafted states that ¨EPC is not a member of the BPA or IPC Approved Operator Scheme" However looking at the BPA website it does indeed list them as members.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Euro Parking Collection PLC (EPC), a current British Parking Association (BPA) Approved Operator Scheme (AOS) member, for unlawful access and misuse of my personal data obtained from the DVLA under the KADOE contract.
According to a Subject Access Request response from the DVLA, EPC obtained my keeper data on 6 December 2023 in relation to a vehicle alleged to have "failed to pay the appropriate fee at a Toll road/bridge." However, this toll allegedly relates to a Hungarian motorway, not a UK road. No disclosure was made in the data request that this was a foreign event.
Since Brexit, there is no legal basis for exchanging keeper data for foreign tolls, and EPC's description of the event appears to have been materially misleading. BPA membership does not entitle an operator to use DVLA data for foreign statutory enforcement, especially when that purpose is misrepresented as a civil parking issue.
I request a full investigation and have attached a supporting statement with details. Please confirm receipt and provide a reference number.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Unlawful Data Access by Euro Parking Collection PLC
Operator name: Euro Parking Collection PLC
Date of DVLA data access: 06/12/2023
Vehicle registration: [Vehicle VRM]
Nature of incident: Alleged unpaid toll in Hungary
I am submitting this formal complaint to report the unlawful acquisition and misuse of my personal data by Euro Parking Collection PLC (EPC), who accessed my details from the DVLA in relation to an alleged unpaid toll in Hungary.
The DVLA’s Subject Access Request (SAR) response confirms that on 6 December 2023, EPC requested my keeper data in connection with “a vehicle which failed to pay the appropriate fee at a Toll road/bridge.” However, no indication was given that this incident occurred outside the UK.
The toll allegedly relates to a Hungarian motorway vignette, a matter governed by foreign law. Since the UK’s exit from the European Union, the Cross-Border Enforcement Directive (2015/413) is no longer in force. Therefore, there is no longer any mutual legal assistance framework in place for the exchange of vehicle keeper data for foreign traffic or toll-related offences.
While EPC is listed as a current BPA Approved Operator Scheme (AOS) member, this status does not authorise the use of DVLA data for foreign statutory charges or tolls. Since the UK's departure from the EU, there is no legal framework—such as the repealed Directive 2015/413—that permits cross-border enforcement or data sharing for traffic or toll violations originating from EU countries.
While EPC may act on behalf of Transport for London (TfL) in certain limited circumstances (e.g., ULEZ enforcement against foreign vehicles), this complaint is not related to any TfL matter, and there is no suggestion that EPC acted under statutory authority in this instance.
Instead, EPC appears to have submitted a KADOE request in its own name, describing the alleged offence in vague, neutral terms without disclosing that the event occurred abroad. This omission resulted in the DVLA releasing keeper data for a purpose that is no longer lawful under UK data protection law or the terms of the KADOE contract.
Why This Breach Matters
- The DVLA is the data controller for personal data it releases and must ensure that such data is not misused or accessed without reasonable cause.
- Under UK GDPR and the Data Protection Act 2018, personal data must be processed lawfully, fairly, and transparently.
- Accessing data to pursue a foreign toll charge under civil contractual grounds in a UK court is not a permitted purpose.
- EPC’s use of KADOE in this way exceeds any authority granted via TfL and violates the spirit and intent of DVLA’s data-sharing framework.
Request for Investigation and Action
I ask the DVLA to:
- Confirm whether EPC’s access request breached the KADOE contract;
- Determine whether EPC provided misleading or incomplete information in its data request;
- Take appropriate enforcement action against EPC, including a review of their data access privileges;
- Clarify the circumstances under which DVLA data may be used to pursue foreign toll charges post-Brexit.
This complaint concerns the initial access to the data as well as its subsequent misuse. No reasonable cause existed, and EPC has pursued an alleged Hungarian toll as though it were a UK contractual parking matter — a misrepresentation which now forms the basis of a Letter of Claim from a UK firm (Moorside Legal).
Please acknowledge receipt of this complaint and confirm a reference number.
Name: [INSERT FULL NAME]
Date: [INSERT DATE]
Email: [INSERT EMAIL ADDRESS]
Vehicle registration: [REDACTED]
Evidence: DVLA DSAR response (attached)
You should make a formal complaint to the DVLA and also get your MP involved. There have already been several questions raised about this to the London Assembly which they have not provided answers except to state that they are investigating. That was over a year ago. You can also read about a BBC Watchdog report here. (https://www.bbc.co.uk/programmes/articles/1vPypvCymt4JSrVjMzrpTPX/watchdog-european-parking-collection-plc)
Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Euro Parking Collection PLC (EPC) for unlawfully obtaining my personal data from the DVLA in relation to an alleged unpaid Hungarian road toll.
According to a DVLA Subject Access Request response, EPC obtained my keeper data on 6 December 2023 citing a need “to identify the registered keeper/driver of a vehicle which failed to pay the appropriate fee at a Toll road/bridge.” However, this alleged event took place in Hungary, not the UK, and no lawful gateway exists for such cross-border enforcement since Brexit.
EPC is not a member of the BPA or IPC Approved Operator Scheme. While EPC may act on behalf of Transport for London for enforcement related to ULEZ or congestion charges, this complaint is not connected to any TfL matter. EPC appears to have accessed my data in its own name, not as an agent of a statutory body.
The DVLA should not have released my data for a foreign contravention, and EPC had no reasonable cause to request it. I believe this request was misleading and unlawful. I have attached a supporting statement and request a full investigation. Please acknowledge receipt and provide a reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Unlawful Data Access by Euro Parking Collection PLC
Operator name: Euro Parking Collection PLC
Date of DVLA data access: 06/12/2023
Vehicle registration: [Vehicle VRM]
Nature of incident: Alleged unpaid toll in Hungary
I am submitting this formal complaint to report the unlawful acquisition and misuse of my personal data by Euro Parking Collection PLC (EPC), who accessed my details from the DVLA in relation to an alleged unpaid toll in Hungary.
The DVLA’s Subject Access Request (SAR) response confirms that on 6 December 2023, EPC requested my keeper data in connection with “a vehicle which failed to pay the appropriate fee at a Toll road/bridge.” However, no indication was given that this incident occurred outside the UK.
The toll allegedly relates to a Hungarian motorway vignette, a matter governed by foreign law. Since the UK’s exit from the European Union, the Cross-Border Enforcement Directive (2015/413) is no longer in force. Therefore, there is no longer any mutual legal assistance framework in place for the exchange of vehicle keeper data for foreign traffic or toll-related offences.
EPC is not an Approved Operator Scheme (AOS) member of the BPA or IPC, and as such, should not have direct KADOE access to DVLA data. While EPC may act on behalf of Transport for London (TfL) in certain limited circumstances (e.g., ULEZ enforcement against foreign vehicles), this complaint is not related to any TfL matter, and there is no suggestion that EPC acted under statutory authority in this instance.
Instead, EPC appears to have submitted a KADOE request in its own name, describing the alleged offence in vague, neutral terms without disclosing that the event occurred abroad. This omission resulted in the DVLA releasing keeper data for a purpose that is no longer lawful under UK data protection law or the terms of the KADOE contract.
Why This Breach Matters
- The DVLA is the data controller for personal data it releases and must ensure that such data is not misused or accessed without reasonable cause.
- Under UK GDPR and the Data Protection Act 2018, personal data must be processed lawfully, fairly, and transparently.
- Accessing data to pursue a foreign toll charge under civil contractual grounds in a UK court is not a permitted purpose.
- EPC’s use of KADOE in this way exceeds any authority granted via TfL and violates the spirit and intent of DVLA’s data-sharing framework.
Request for Investigation and Action
I ask the DVLA to:
- Confirm whether EPC’s access request breached the KADOE contract;
- Determine whether EPC provided misleading or incomplete information in its data request;
- Take appropriate enforcement action against EPC, including a review of their data access privileges;
- Clarify the circumstances under which DVLA data may be used to pursue foreign toll charges post-Brexit.
This complaint concerns the initial access to the data as well as its subsequent misuse. No reasonable cause existed, and EPC has pursued an alleged Hungarian toll as though it were a UK contractual parking matter — a misrepresentation which now forms the basis of a Letter of Claim from a UK firm (Moorside Legal).
Please acknowledge receipt of this complaint and confirm a reference number.
Name: [INSERT FULL NAME]
Date: [INSERT DATE]
Email: [INSERT EMAIL ADDRESS]
Vehicle registration: [REDACTED]
Evidence: DVLA DSAR response (attached)
Do respond to the utterly stupid bunch of incompetents at Moorside Legal. They are embarrassingly useless at their purported profession of being legal advisors and should be reported to the SRA for their blatant disregard for the law.
Let them try and issue a claim in the English county court. It's their claim fee they are wasting. Consider these key points:
1. Foreign Public Law Obligations Cannot Be Enforced in UK Courts
English courts do not enforce foreign penal, revenue, or public law obligations. This means that fines, penalties, tolls, or statutory charges issued by a foreign government or public authority cannot be pursued in the UK civil courts.
This principle was established in Government of India v Taylor [1955] AC 491, where the House of Lords ruled that foreign tax debts could not be enforced in the UK courts. The same applies to foreign motoring fines or toll penalties.
Key point:
A private UK debt collector (or law firm) acting on behalf of a foreign government or public body has no legal standing to sue in an English court for a statutory or regulatory charge.
2. Private Companies Must Prove a Contractual Debt
If the alleged toll charge, penalty, or fine is being treated as a contractual debt, the claimant (the English company acting on behalf of the foreign entity, EPC in this case) must demonstrate:
• A valid contract between the Keeper and the toll operator (e.g., clear terms and conditions that the driver agreed to).
• Jurisdiction – If the contract was formed in a foreign country, it likely specifies that any legal disputes must be resolved under that country’s jurisdiction.
• Legal standing – The UK-based company (EPC) must prove they have the right to sue, either as an assignee of the debt or as a party with direct privity of contract.
Key point:
Without a contract binding the Keeper to the payment, there is no enforceable claim in an English court.
3. Brexit Has Weakened Cross-Border Enforcement
Before Brexit, the EU Cross-Border Enforcement Directive (2015/413/EU) allowed mutual recognition of traffic fines across EU countries. Since Brexit, the UK is no longer bound by this directive, meaning foreign motoring fines or toll penalties are not automatically enforceable in the UK.
There is no bilateral agreement between the UK and the EU (or individual EU states) that allows private enforcement of tolls or penalties through UK courts.
Key point:
If the debt is linked to a foreign law (rather than a private contract), the UK courts will not have jurisdiction to enforce it.
4. Data Protection and Unlawful Access to Keeper Details
If the English company (EPC) obtained the Keeper’s details without a lawful basis (e.g., without DVLA permission post-Brexit), then:
• Their possession of the Keeper’s data is likely unlawful under UK GDPR and the Data Protection Act 2018.
• A complaint to the ICO (Information Commissioner's Office) should be filed, as this constitutes a serious data protection breach.
• If the Keeper is a consumer, they can also demand proof under a Subject Access Request (SAR) to determine how the data was obtained.
Key point:
Unlawfully obtained data makes the claim not only unenforceable but also expose the English company (EPC) to legal consequences.
5. Moorside Legal’s Involvement – An Abuse of Process
• If Moorside Legal (or any similar UK firm) is sending debt demands, they are using scare tactics rather than pursuing a legitimate legal claim.
• If they issue a claim, an application to strike it out under CPR 3.4(2)(a) (no reasonable cause of action) or CPR 24.2 (summary judgment) would be appropriate.
• As they are misrepresenting the legal position, a formal complaint to the SRA (Solicitors Regulation Authority) should be made.
Key point:
Moorside Legal has a reputation for incompetence and procedural failings. Any court action they initiate should be met with a robust challenge.
Conclusion: No Enforceability Without a Contract
• As the demand relates to a foreign statutory fine, toll, or penalty, it is not enforceable in an English court.
• As it is a private contractual debt, the English company (EPC) must prove a valid contract, legal standing, and jurisdiction – which is unlikely.
• If keeper details were obtained unlawfully, EPC is violating UK data protection laws.
• Moorside Legal’s involvement suggests this is a scare tactic rather than a legitimate legal claim.
For now I suggest you respond Moorside Legals embarrassing incompetence with the following:
Moorside Legal
PO Box 1418
Bradford
BD1 9GP
[Date]
Subject: Response to Letter of Claim – [Your Reference]
Dear Sirs,
I write in response to your Letter of Claim dated 27 February 2025 regarding an alleged debt claimed by Euro Parking Collection Plc (EPC).
This letter serves as a formal request under the Pre-Action Protocol for Debt Claims (PAPDC) for the following information:
1. Proof of Assignment and Authority
• Clear documentary evidence demonstrating that your client has a legal right to pursue this matter in its own name.
• Confirmation of whether your client owns the alleged debt or is acting merely as an agent for a foreign entity.
2. Jurisdiction and Legal Basis
• A full legal explanation as to why an alleged toll charge issued under a foreign statutory framework is being pursued as a private contractual matter in the jurisdiction of the courts of England and Wales.
• Evidence that a valid contractual relationship existed between the alleged debtor and the foreign toll operator.
• The specific legal basis that allows a UK-registered company to enforce a foreign public law penalty in a civil court.
3. Proof of Keeper Data Legitimacy
• Full disclosure of how my personal data was obtained, given that EPC no longer has access to the DVLA database post-Brexit.
• Evidence that the data was obtained lawfully and in compliance with UK GDPR and the Data Protection Act 2018.
4. Detailed Breakdown of the Alleged Debt
• A clear itemisation of the amount demanded, including any fees, interest, or adjustments.
• Full disclosure of any attempts at direct enforcement by the original creditor before the involvement of EPC and Moorside Legal.
Failure to Respond and Consequences
As a firm claiming to operate within the legal sector, you are fully aware of your obligations under the Pre-Action Protocol.
• Failure to provide a substantive response to this request within 30 days will be viewed as a breach of the PAPDC and may result in an application for any future claim to be struck out for procedural non-compliance.
• This failure will also be formally referenced in a complaint to the Solicitors Regulation Authority (SRA) regarding Moorside Legal’s repeated breaches of ethical and procedural standards.
• If you proceed with court action without responding to this PAP request, I will seek an adverse costs order against both your client and your firm for unreasonable conduct under CPR 27.14(2)(g).
Finally, I reserve the right to escalate this matter to the Information Commissioner’s Office (ICO) regarding the unlawful processing of my personal data.
This is my only and final correspondence until a full and compliant response is received. Any further attempts to pursue this matter without addressing these legal issues will be considered harassment, which I will report accordingly.
Yours faithfully,
[Your Name]
You can send it as a pdf attached to an email to help@moorsidelegal.co.uk and CC in yourself.
You also need to submit a Subject Access Request (SAR) under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This will provide a Vehicle Record Enquiry Log, which lists all organisations that have requested your details.
You request this information by completing sections 1 and 3 of this form:
DVLA subject access request (SAR) (https://assets.publishing.service.gov.uk/media/62692f63d3bf7f0e7d5b3dc6/make-a-subject-access-request-to-dvla-form-mis1065_270422.pdf)
and then email it as an attachment by email to subjectaccess.requests@dvla.gov.uk and also CC in yourself.
Please let us know how you get on.