Usual DVLA fob-off. Send the following email to dvla.complaints@dvla.gov.uk and CC kadoeservice.support@dvla.gov.uk and yourself:
Subject: Step 2 Escalation – Misuse of DVLA Data by SABA UK Ltd – Reference 0413745
Dear Data Assurance Team,
DVLA Reference: 0413745
Date of DVLA Step 1 Response: 5 August 2025
I am writing to formally escalate my complaint to Step 2 of the DVLA complaints process, following the unsatisfactory response I received at Step 1.
My original complaint, dated 31 July 2025, concerned the misuse of DVLA-supplied vehicle keeper data by SABA Park Services UK Ltd, a British Parking Association (BPA) member operating under the Approved Operator Scheme (AOS). The penalty notice issued by SABA relates to an alleged breach of Railway Byelaw 14 and falsely asserts that, in addition to criminal prosecution, “legal action may be taken via the Civil Procedure in the County Court”.
This is factually and legally incorrect. A breach of Railway Byelaw 14 is a summary-only criminal offence, enforceable exclusively via prosecution in the Magistrates’ Court. There is no legal basis for recovery via civil litigation or the Civil Procedure Rules. The claim that a civil court route is available is not only misleading — it is a fiction invented to coerce payment.
The Step 1 response entirely failed to engage with the substance of this complaint. The following issues remain unresolved:
1. Failure to assess whether the use of DVLA data breaches the KADOE contract
The use of keeper data to send misleading notices falsely implying civil recovery is not authorised under Regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002 or under the KADOE contract. The data was supplied for a specific lawful purpose, not to facilitate misrepresentation of enforcement options.
2. Failure to respond to the question of lawfulness
I asked whether the DVLA accepts that keeper data is being used by SABA in connection with an enforcement route that is not legally available. The response merely reiterated standard policy on “reasonable cause,” ATA membership, and the BPA’s role, without addressing whether this particular usage is lawful, accurate, or contractually compliant.
3. Failure to confirm referral to compliance/enforcement team
I explicitly requested that the matter be referred to the DVLA’s compliance and enforcement team for investigation under the KADOE contract. The Step 1 response does not confirm whether any such referral was made.
4. Failure to consider data misuse under UK GDPR and section 171 of the Data Protection Act 2018
If keeper data is used for a purpose that was not lawful, fair or transparent, or used in a misleading and coercive manner, this may constitute a breach of data protection law. This aspect was entirely overlooked.
The DVLA's reliance on BPA membership as a safeguard is insufficient in this context. BPA membership cannot legitimise the misuse of personal data or override the statutory framework governing criminal offences. Moreover, the BPA is not a statutory regulator and does not have legal authority to determine the lawfulness of enforcement methods.
In summary, I am not seeking DVLA arbitration in a contractual dispute. I am raising concerns about the systematic misuse of DVLA-supplied data, which:
• misrepresents the legal status of a penalty notice,
• threatens enforcement methods not permitted under law, and
• thereby breaches the DVLA's own KADOE contract and possibly the UK GDPR.
I expect DVLA, as the data controller, to assess whether SABA's practices are compatible with the stated purposes for which the data was released, and to confirm whether the matter has been referred to its internal compliance or enforcement function.
Please treat this as a formal Step 2 complaint. I would appreciate confirmation of receipt and a timeline for your review.
Yours faithfully,
[Full name]
[Address or other identifying details, if needed to match the case]
[Optional: Attach the SABA notice again for reference]
You should also make a formal complaint to the DVLA. Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint about the use of DVLA-supplied keeper data by SABA UK Ltd, BPA AOS member, in connection with a Penalty Notice issued for an alleged breach of Railway Byelaw 14.
The notice states: “An offence has been committed... our Client has the option to pursue you through the Magistrates Court by way of a private criminal prosecution. Alternatively, legal action may be taken via the Civil Procedure in the County Court...”
This is legally false and deeply misleading. A breach of Railway Byelaw 14 is a summary-only criminal offence and can only be pursued via prosecution in the magistrates’ court. It is not a civil debt and cannot be recovered via the Civil Procedure Rules. No such debt exists unless a magistrates’ court convicts and imposes a fine.
SABA’s use of DVLA data to issue this hybrid criminal/civil threat is not only dishonest but arguably fraudulent within the meaning of the Fraud Act 2006, section 2 (fraud by false representation), as it misrepresents enforcement options with intent to secure payment.
Further, this conduct constitutes a misleading commercial practice under the Digital Markets, Competition and Consumers Act 2024 (DMCC), which now governs unlawful and unfair trading. The threat of civil litigation for a criminal byelaw breach is simply a fiction invented to coerce payment.
I am not disputing the “reasonable cause” basis for the DVLA’s release of keeper data under Regulation 27(1)(e). I am asking whether the DVLA accepts that its data is being used to issue penalty demands that falsely suggest civil recovery is available, when only a criminal prosecution can apply.
This is a misuse of personal data obtained under KADOE and a manipulation of the statutory enforcement process. I ask that the DVLA refer this conduct to its compliance and enforcement team and confirm whether such notices are authorised and lawful use of DVLA data.
If not, I expect the DVLA to take appropriate enforcement steps against the company under the KADOE contract.
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
Make sure you upload a copy of the Penalty Notice, both sides.
What a wasted effort on your part! A SABA (or any other unregulated private parking firm such as APCOA) Penalty Notice is a fake instrument of fraud.
The wording in the SABA-issued Penalty Notice (PN) is deeply problematic, misleading, procedurally defective, and legally dubious in several respects.
1. Misrepresentation of Enforcement Options (Civil vs Criminal)
The PN states:
"An offence has been committed by breaching Byelaw 14... our Client has the option to pursue you through the Magistrates Court by way of a private criminal prosecution... Alternatively, legal action may be taken via the Civil Procedure in the County Court..."
This falsely implies that the operator can choose between criminal prosecution and civil litigation.
A breach of Byelaw 14 is a criminal matter only. There is no contractual or statutory basis for issuing a civil claim in the county court for a breach of a statutory byelaw. If the operator wishes to pursue a criminal penalty, it must lay information before a magistrates’ court within 6 months as per Magistrates' Courts Act 1980, s.127(1).
The hybrid “pay us or we might prosecute—or sue you in the County Court” message is legally incoherent and is a deliberate attempt to pressure payment by suggesting multiple enforcement routes that do not exist.
A breach of Railway Byelaw 14 is a summary-only criminal offence. No civil liability arises unless the alleged breach can be framed as a separate contractual matter, which this notice does not do.
2. False or Ambiguous Authority for Data Access
"...your data has been released by the DVLA as our client has reasonable cause... Their records indicate you were the registered keeper on the date the offence was committed."
This implies the DVLA released data on the basis of an established offence, not merely a suspected breach. The language is misleading because:
• The operator has not proven an offence has occurred.
• No conviction exists.
• The DVLA provides data under Regulation 27(1)(e) for reasonable cause, but not for enforcement of hypothetical or presumed criminal offences.
Using DVLA data for private enforcement of alleged criminal offences — especially in a case where no prosecution has been commenced — must be very carefully justified. The language used here is legally sloppy and arguably exceeds what is permitted under the KADOE contract with DVLA.
3. Misuse of the Term "Penalty"
"The above penalty is now due..."
This uses the term “penalty” as if it is a fixed fine backed by law, when in fact:
• No court has imposed a fine.
• No legal process has occurred.
• A Penalty Notice of this kind is a voluntary out-of-court disposal with no legal compulsion to pay unless or until the matter is prosecuted and proven.
Any notice demanding payment for an alleged breach must clearly state that payment is voluntary and does not constitute an admission of guilt or a statutory penalty, unless such a penalty has been lawfully imposed by a court. Failure to provide this information constitutes a misleading commercial practice under Sections 225 to 229 of the Digital Markets, Competition and Consumers Act 2024, and may also involve an omission of material information prohibited under Section 227:
• Section 226 covers false or misleading information, deceptive presentation, and confusion with other traders
• Schedule 20 of the DMCC Act (Banned Practices) includes falsely claiming to have authority to impose fines or penalties
4. Reference to “Additional Costs” Lacks Legal Basis
Additional costs will be incurred should the case progress through either the Civil or Magistrates courts."
In a criminal case, prosecution costs may be awarded upon conviction — but:
• That’s a matter for the court to decide, not the private operator.
• In civil claims, no claim can be brought for a byelaw breach unless an entirely separate contractual cause of action exists (which this PN does not assert).
Suggesting additional costs may apply if payment is not made misleads the recipient into believing they must pay now to avoid a guaranteed penalty later — when in fact no legal process has even begun.
5. Lack of Clarity About Who “Our Client” Is
"...our Client has reasonable cause..."
"...our Client has the option to pursue you..."
Nowhere does the PN explicitly confirm who “our Client” is, or whether they are a Train Operating Company (TOC) or just a parking subcontractor.
For enforcement under Railway Byelaws to be valid:
• The prosecuting party must be the "relevant person" under Byelaw 24(1) — i.e. the TOC.
• A private parking contractor must clearly state it is acting on behalf of the TOC, and not purport to act in its own right.
• Failure to do so is unlawfully exercising a public function and renders the notice misleading and unenforceable.
So, in summary... The Penalty Notice issued by SABA contains a number of serious legal deficiencies. It misrepresents the available enforcement mechanisms by implying that both criminal prosecution and civil action are viable for a single statutory byelaw offence, when in fact only prosecution in a magistrates’ court is lawfully available. The reference to an “offence” having already been committed is misleading, as no such determination has been made by a court.
Furthermore, the notice fails to make clear whether the issuer is the relevant prosecuting authority under Byelaw 24(1), or acting with authority from a Train Operating Company (TOC). These ambiguities, along with the implied threat of additional costs and penalties absent a court process, breach the Digital Markets, Competition and Consumers Act 2024 (DMCC), particularly under Section 226 and Schedule 20. Any such Penalty Notice must clearly and transparently distinguish between an actual court-imposed penalty and a voluntary offer to dispose of an alleged matter without formal prosecution.
You are a victim of fraud by false representation and it should be reported under the Fraud Act 2006 to the police. Do not use Action Fraud. You will need to contact your local police force Economic Crime unit although they my refer you to the British Transport Police. Mention The Fraud Act 2006, s.2 – Fraud by false representation.