I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint.
I am submitting a formal complaint against National Car Parks Ltd (NCP), a BPA AOS member with DVLA KADOE access, for breaching the BPA/IPC Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—through conduct that contravenes the PPSCoP—renders that use unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: National Car Parks Ltd (NCP)
Date of PCN issue: 16/05/2025
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report a misuse of my personal data by NCP, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although NCP may have had reasonable cause to request my data initially, the way they have used that data afterwards amounts to unlawful processing. This is because they have acted in breach of the BPA/IPC Private Parking Single Code of Practice (PPSCoP), which is a mandatory requirement for access to DVLA keeper data. The PPSCoP forms part of the framework that regulates how parking companies must behave once they have received keeper data from the DVLA.
The KADOE contract makes clear that keeper data may only be used to pursue an unpaid parking charge in line with the Code of Practice. If a parking company fails to comply with the PPSCoP after receiving DVLA data, their use of that data becomes unlawful, as they are no longer using it for a permitted purpose.
In this case, NCP has breached the PPSCoP in the following way:• NCP failed to deliver the Notice to Keeper within 14 days of the alleged event on 03/05/2025. The notice was issued on 16/05/2025 and, under PoFA Schedule 4, is deemed ‘given’ two working days later (20/05/2025), outside the statutory 14-day period. Therefore, NCP cannot rely on the Protection of Freedoms Act 2012 to hold the registered keeper liable.
• Despite this, NCP’s Notice to Keeper contains a paragraph that misleadingly states:“…we will have the right to recover from you, so much of that Parking Charge as remains unpaid.”
• This statement falsely asserts a right to hold the keeper liable, when in fact such a right does not exist. This is in clear breach of PPSCoP Section 8.1.1(d), which states:“The parking operator must not serve a notice which in its design and/or language: state the keeper is liable under the Protection of Freedoms Act 2012 where they cannot be held liable.”
This is not a technicality—it is a serious breach of both the Code and the legal framework governing keeper data use. It misleads recipients into believing they are legally obliged to pay a charge when no such liability exists under law.
The DVLA remains the Data Controller for the data it releases under KADOE, and is responsible for ensuring that personal data is not misused by third parties. This includes taking enforcement action against AOS operators who breach the conditions under which the data was provided. I am therefore asking the DVLA to investigate this breach and take appropriate action under the terms of the KADOE contract.
This may include:• Confirming that a breach has occurred
• Taking enforcement action against the operator
• Suspending or terminating their KADOE access if warranted
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
I am the keeper of the vehicle and I dispute your 'parking charge'. I deny any liability or contractual agreement and I will be making a complaint about your predatory conduct to your client landowner.
As your Notice to Keeper (NtK) does not fully comply with ALL the requirements of PoFA 2012, you are unable to hold the keeper of the vehicle liable for the charge. Partial or even substantial compliance is not sufficient. There will be no admission as to who was driving and no inference or assumptions can be drawn. NCP has relied on contract law allegations of breach against the driver only.
The registered keeper cannot be presumed or inferred to have been the driver, nor pursued under some twisted interpretation of the law of agency. Your NtK can only hold the driver liable. NCP have no hope at POPLA, so you are urged to save us both a complete waste of time and cancel the PCN.