The NtK has arrived and it is still not PoFA compliant, so they cannot transfer liability to you as keeper.
This was a windscreen ticket on 28/11/2025. The NtK is dated 30/12/2025. The timing is within the PoFA window for a Notice to Keeper following a Notice to Driver, so you cannot win on service timing.
However, the NtK fails a mandatory PoFA requirement. Schedule 4 paragraph 8(2)(h) requires the Notice to Keeper to identify the creditor. This NtK does not do that. It uses the trading name “Ace Security Services” and then says “We, the Creditor…”, but it does not clearly identify any legal person who is for the time being entitled to recover the unpaid parking charge. A trading name is not a legal person for PoFA purposes. Because PoFA requires strict compliance, the failure to identify the creditor is fatal to keeper liability.
They also state that they requested keeper details from the DVLA because they “do not know both the name of the driver and a current address for service for the driver”. That is irrelevant to keeper liability. The issue is that they have not complied with PoFA, so they have no right to recover anything from you as keeper in any event.
At this stage you should not identify the driver, should not enter into further debate with Ace, and should simply file everything. If they attempt a court claim against you as keeper, the defence is that PoFA keeper liability does not arise because the NtK does not identify the creditor as required by paragraph 8(2)(h), and the claimant is put to strict proof of their legal standing and entitlement to recover the charge.
Separately, a DVLA and ICO complaint is now arguable because you had already written to Ace as the registered keeper and Ace had acknowledged that correspondence, yet they still say they obtained keeper data from the DVLA. Obtaining personal data from the DVLA when they already held your name and address is unnecessary and excessive processing, contrary to the data minimisation principle in Article 5(1)(c) UK GDPR, and it is not necessary for any legitimate interests lawful basis under Article 6(1)(f). This is exactly why you were told in advance not to go to the DVLA.
So the advice now is: do nothing further with Ace, do not name the driver, keep the paperwork, and if you want to apply pressure, proceed with a formal DVLA complaint (with your keeper email date and Ace’s acknowledgement attached) and escalate to the ICO if needed.
You can use this as the core of your DVLA complaint:
I am the registered keeper of vehicle [VRM]. I am making a formal complaint regarding Ace Security Services/Pace Recovery & Storage Ltd obtaining my personal data from the DVLA without reasonable cause.
On [date] I contacted the operator directly as the registered keeper in relation to Charge Notice [PCN number]. In that correspondence I provided my full name and a current address for service (the address shown on the V5C). The operator replied on [date], acknowledging receipt of my email and engaging with my correspondence. The operator therefore already held my keeper identity and serviceable address.
Despite already holding my personal data, the operator subsequently requested and obtained my registered keeper details from the DVLA. Their Notice to Keeper dated 30/12/2025 expressly states that they obtained my details from the DVLA. This DVLA request was unnecessary and excessive because my name and address were already known to the operator and had been acknowledged in writing.
In these circumstances, the operator did not have “reasonable cause” to obtain my data from the DVLA. The stated purpose of requesting keeper data is to identify and contact the registered keeper. That purpose had already been fulfilled before the DVLA request was made.
Obtaining my data from the DVLA when it was not necessary constitutes a breach of the data minimisation principle under Article 5(1)(c) UK GDPR, which requires that personal data be adequate, relevant and limited to what is necessary for the purposes for which it is processed. It is also not “necessary” for any lawful basis under Article 6(1)(f) UK GDPR (legitimate interests), because the operator could already correspond with me as keeper without any DVLA disclosure.
I therefore ask the DVLA to investigate and confirm:
1. The date on which my personal data was disclosed to the operator and under what justification.
2. What reason the operator provided to the DVLA to demonstrate “reasonable cause”, given that they already held my name and address.
3. Whether the operator’s request complied with the KADOE contract requirement that keeper data must only be requested where it is necessary.
4. Whether DVLA considers it lawful for an operator to obtain DVLA keeper data where the keeper has already provided the same information directly and that information has been acknowledged.
I request confirmation of the outcome of the DVLA’s investigation and any action taken.
Evidence enclosed:
– Copy of my email to the operator dated [date/time] providing my keeper details
– Copy of the operator’s reply dated [date/time] acknowledging my correspondence
– Copy of the Notice to Keeper dated 30/12/2025 confirming that my data was obtained from the DVLA
You can use the following as the core of your ICO complaint:
I am the registered keeper of vehicle [VRM]. I am making a complaint about unnecessary and excessive processing of my personal data by Ace Security Services/Pace Recovery & Storage Ltd.
On [date] I contacted the organisation directly as the registered keeper regarding Charge Notice [PCN number]. In that correspondence I provided my full name and a current address for service (the address shown on the V5C). The organisation replied on [date], acknowledging receipt and engaging with my correspondence. They therefore already held my personal data (name and address) sufficient to correspond with me.
Despite already holding my details, the organisation then requested and obtained my registered keeper data from the DVLA. Their Notice to Keeper dated 30/12/2025 states that they obtained my details from the DVLA. This additional acquisition of my personal data from a third party was unnecessary and duplicative.
Obtaining my personal data from the DVLA when it was not necessary breaches the data minimisation principle in Article 5(1)(c) UK GDPR (personal data must be adequate, relevant and limited to what is necessary). It is also not “necessary” for the purposes of any lawful basis under Article 6(1)(f) UK GDPR (legitimate interests), because they already held my name and address and could correspond with me without making any DVLA request.
I have raised the matter with the DVLA as the data source and asked them to investigate whether there was reasonable cause for the disclosure. However, this complaint concerns the organisation’s processing decision to obtain additional personal data from the DVLA despite already holding it.
I ask the ICO to consider whether the organisation has complied with its UK GDPR obligations, in particular:
1. Article 5(1)(c) data minimisation, given the DVLA request was not necessary once my keeper details were already held.
2. Article 5(1)(a) lawfulness and fairness, because obtaining additional data from the DVLA without necessity is not fair or lawful processing.
3. Article 6(1)(f) necessity under legitimate interests, as the additional DVLA data was not necessary to pursue the stated purpose.
Evidence enclosed:
A. My email to the organisation dated [date/time] providing my name and address.
B. The organisation’s reply dated [date/time] acknowledging receipt.
C. The Notice to Keeper dated 30/12/2025 stating that my data was obtained from the DVLA.
Please confirm whether the ICO considers this unnecessary third-party data acquisition to be compliant with UK GDPR, and what steps the organisation should be required to take to prevent repetition.
OK, rant over – timing was important here because I wanted Ace to be locked into the statutory Notice to Keeper process and to stop them playing games with who they will/won’t deal with.
The good news is that this is still salvageable. You have already contacted them as Keeper and they’ve replied, admitting (a) there is no legal obligation to name the driver and (b) they’ve seen your email.
Next step:
• you send them one final email, expressly as the registered keeper;
• you do not say who was driving;
• you point out that the Notice to Driver is not PoFA-compliant because it fails to identify any creditor (Schedule 4 para 7(2)(e)); and
• you make it clear they now have your keeper details and have no reasonable cause to go to DVLA for the same data.
After that, you ignore any back-and-forth. If a Notice to Keeper turns up, we check it for PoFA compliance. If they go to DVLA anyway, that becomes a DVLA/ICO issue because they’ve requested data they already hold.
On Wednesday 24th December (yes, Xmas eve), you send the following response email to Ace (to “force” them to deal with the keeper)
Subject: Charge Notice [PCN NUMBER] – Registered keeper appeal and data notice
Dear Sir or Madam,
I refer to your recent email regarding Charge Notice [PCN NUMBER].
For the avoidance of doubt, I am the registered keeper of vehicle [VRM]. You have acknowledged that there is no legal obligation on the registered keeper to identify the driver. I have not identified the driver and I will not be doing so. There will be no admission as to the identity of the driver and no inference or assumptions can be drawn.
Your Notice to Driver does not comply with the mandatory requirements of Schedule 4 of the Protection of Freedoms Act 2012. Paragraph 7(2)(e) requires the notice to “identify the creditor”. Your document is merely branded “Ace Security Services” with a PO Box and website. It does not identify any legal person as creditor, nor make it clear whether the creditor is the landowner, a managing agent, or any contracting company such as Pace Recovery & Storage Ltd. A trading style is not a legal entity. PoFA requires strict compliance; partial or substantial compliance is not sufficient. In the absence of strict compliance with paragraph 7, you cannot rely on Schedule 4 to transfer any liability from the driver to the registered keeper.
Your assertion that only the driver can appeal is a self-imposed policy with no basis in statute. There is nothing in PoFA that restricts appeal rights to a driver. Your internal policy does not override statute nor entitle you to ignore an appeal clearly made by the registered keeper.
You now have my full keeper details as a result of this correspondence. You therefore have no reasonable cause to apply to the DVLA for the same data. Any further request for Registered Keeper details from the DVLA would be unnecessary and excessive, in breach of the data minimisation and necessity principles under the UK GDPR and the Data Protection Act 2018. If you nevertheless obtain or misuse DVLA data in these circumstances, I will treat that as grounds for formal complaints to the DVLA and the Information Commissioner’s Office and, if appropriate, a claim for compensation.
For the avoidance of doubt:
• this email is an appeal from the registered keeper;
•I deny any liability or contractual agreement; and
•you are invited to cancel the Charge Notice.
If you refuse to cancel, I require a rejection setting out your position so that a full paper trail of your conduct is preserved. If you maintain that you will disregard this appeal solely because it is from the registered keeper, please confirm that explicitly.
This is my final substantive response. I will not enter into further debate, and there will be no identification of the driver.
Yours faithfully,
[Name]
Registered Keeper
[Address as per V5C]
After that you wait to see if (a) a NtK appears, or (b) they hit DVLA anyway (in which case you’ve got a clean paper trail for DVLA/ICO complaint).