Hello, just got a reply:
Further to the letter from my colleague, Mr Wigmore, please find attached my review of your complaint. If I may be forgiven the observation, I think my report bears careful reading, but I am all too conscious that the overall outcome will be a disappointment to you - and I am sorry for that. However, my judgement is that the DVLA has acted properly and in line with its responsibilities.
My report gives details of how you can escalate further to the Parliamentary and Health Service Ombudsman, should you so choose.
With my good wishes.
Stephen Shaw
Stephen Shaw
Department for Transport
DfT Complaints Team - for the attention of Stephen Shaw
Great Minster House
33 Horseferry Road
London
SW1P 4DR
His reply in attachment:YOUR COMPLAINT AGAINST THE DRIVER AND VEHICLE LICENSING AGENCY (DVLA)
I write further to the correspondence of 18 June from my colleague, Mr Jon Wigmore,
regarding the independent review of your complaint against the DVLA.
I am one of the other Independent Complaint Assessors (ICAs) contracted to the
Department for Transport, and your case has been allocated to my queue for my
consideration.
Mr Wigmore indicated that, given the pressures on the ICA scheme at the moment, it might
be 14-18 weeks before your complaint would be considered. But I am pleased to say that in
practice this has not proved to have been the case, and your complaint has been reviewed
well within our three-month time target.
2
Complaint
Your complaint is that the DVLA provided your personal data to a parking company (Parking
Control Management (UK) Ltd) that the company misused after its disclosure. You say
there has been a string of breaches of the law, KADOE (Keeper at Date of Event contracts),
The Protection of Freedoms Act 2012 and the industry Code of Practice, and what amounts
to a regulatory failure on the part of the DVLA in its oversight of the disclosure regime.
For its part, the DVLA says that your grievance is a matter for the relevant Accredited Trade
Association – in this case, the International Parking Community (IPC) - or for the
Independent Appeals Service (IAS).
Jurisdiction
Before setting out the facts of this case and my views, I should first explain the nature of the
ICA role. 1 The Introduction to the ICA terms of reference reads as follows:
“The overall aims of the independent complaints assessor (ICA) process are to:
put right any injustice or unfairness suffered by members of the public as
customers or in consequence of the actions, inactions, or decisions of DfT
improve services delivered through DfT and its public bodies
provide assurance that DfT has followed proper procedures, and that
maladministration has not occurred”
Further paragraphs read:
“Relevant factors for a detailed review are:
the complainant has, or might have, suffered significant injustice, loss or hardship
DfT’s handling of the complaint has been poor. For example, it has failed to
conduct a proportionate and reasonable investigation and has failed to apply an
appropriate remedy
DfT has asked the ICA to review the case
an ICA review may assist in a wider process of organisational learning from the
complaint and of promoting consistency and fairness
“Relevant factors against a detailed review are:
1 As Mr Wigmore pointed out in his acknowledgement letter, more information about the ICA terms of
reference is readily available online at:
https://www.gov.uk/government/publications/dft-independent-complaint-assessors-terms-of-reference/dft-independent-complaint-assessors-terms-of-reference. Previous
annual reports are also available at:
https://www.gov.uk/government/collections/independent-complaints-assessors-for-the-department-for-transport.
3
DfT has investigated the complaint properly and has found no administrative
failure or mistake
the complainant objects to the DfT policy or legislation
the complainant has exercised or has a right of appeal, reference or review
through another avenue, for example tribunal or legal proceedings
the essence of a complaint is a contractual or commercial dispute
a detailed review would be disproportionate
“Having considered the previous factors, the ICA may decide that subjecting the
complaint to a detailed review would not meet the overall aims of the ICA review
process.”
The protocol to the terms of reference sets out a list of exclusions to the ICA remit. These
include:
disputes where the principal focus is upon government or DfT policy
complaints about the law
In his acknowledgement letter, Mr Wigmore also emphasised that the ICAs cannot
adjudicate on the legality of the DVLA’s supply of keeper data to private parking companies.
He continued:
“Nor is the DVLA an actual or proxy regulator for this sector, so complaints about the
legal footing and procedural basis behind a PCN need to go down the prescribed
appeal route, not to the agency or us. As you know, the ICO has fully approved the
DVLA’s practice of releasing keeper data for the investigation of potential liability
under the reasonable cause provision (in other words, the DVLA does not have to
satisfy itself of the legitimacy of a request before data release (I say this
understanding that you are not complaining about the disclosure itself)).
“Approaching 41,000 drivers are issued with PCNs by private firms each day,
underlining the operational necessity for high level oversight of KADOE compliance.
We are not going to criticise the agency for formulating and applying policy in this
domain. In my view, a political move in an area of widespread public concern is
required to change the current arrangements. You may know, however, that
initiatives to address public discontent have not seemingly progressed since the then
government ‘temporarily’ withdrew the Private Parking Code of Practice in June 2022
after lobbying from the private parking sector.” 2
2 The parking industry introduced its own Code of Practice which it says is largely based on the former
Government’s Private Parking Code of Practice. The latest version of the industry code is at:
https://www.britishparking.co.uk/write/Documents/AOS/Sector%20Code%20Templates/sectorsingleCodeofPracticeVersion1.1130225.pdf. Earlier this July, the present Government sought comments on a new code of
practice (
https://www.gov.uk/government/consultations/private-parking-code-of-practice). The consultation
includes the following description of current arrangements:
4
Review
The DVLA records show that you first contacted the Agency on 10 April 2025. You said you
were submitting a formal complaint against Parking Control Management (UK) Ltd, a
member of the International Parking Community (a trade association accredited by the
DVLA) with access to DVLA data under a KADOE agreement. You accused the company
of breaching the Private Parking Code of Practice and misusing your personal data obtained
from the DVLA.
You argued that, while Parking Control Management (UK) Ltd (PCM) may have had
‘reasonable cause’ to have requested your data, their subsequent conduct (in breach of the
Code of Conduct and the Protection of Freedoms Act 2012) had rendered that use unlawful.
You said that, as the data controller, the DVLA was required (under GDPR and the Data
Protection Act 2018) to investigate and take action when personal data was misused
following release.
You emphasised: “This complaint is not about whether PCM had a lawful reason to obtain
my data, but about how they used it unlawfully after the fact.”
In a supporting statement, you set out the ways in which you said PCM had breached the
Code of Practice and the Protection of Freedoms Act: Failure to specify ‘relevant land’;
Failure to specify a ‘period of parking’; Misrepresentation of keeper liability; Failure to
provide proof of posting; Failure to consider a formal complaint.
“To send parking charge notices by post or enforce unpaid parking charge notices issued at the time of
contravention, parking operators must contact the vehicle’s registered keeper. The law permits this
information to be provided by the Driver and Vehicle Licensing Agency (DVLA), subject to appropriate
safeguards.
“To access that data, operators must demonstrate that they have a reasonable cause to receive it as well as
be a member of a DVLA-accredited trade association. To become an accredited trade association, the DVLA
requires a trade body to have a code of practice, provide guidance on how it expects its members to operate,
as well as setting standards for operators, covering, for example, signage, dealing with complaints, managing
appeals against parking charges, setting caps for parking charges and debt recovery fees, and setting
expectations for early payment discounts. They are also required to have a mechanism to enforce their code
of practice, and they must provide an independent, second stage appeals service.”
The Government proposes a new compliance framework:
“Only parking operators certified under the Scheme will be able to have access to the DVLA data, which is
needed to identify the vehicle keeper and issue or pursue parking charges. In practice, this means that only
parking operators who are compliant with the new Code and have a valid certificate of conformity from the
UKAS accredited Conformity Assessment Body will be able to enforce parking charges. In circumstances
where a parking operator is found in breach of the Code after it has been certified, they will risk being
suspended until the problem is rectified or their certification withdrawn. This would preclude operators from
requesting the registered vehicle keeper data from the DVLA.”
The consultation exercise continues until 5 September.
5
In conclusion, you wrote:
On 16 April, the DVLA replied in what I think may fairly be described as standard terms.
The Agency’s letter focussed on the ‘reasonable cause’ issue (which, of course, you had not
challenged) in the following terms:
6
On 23 April, you escalated your complaint. You said the initial response (which you
characterised as petty, evasive and obstructive) had not addressed the substance of your
complaint which was not about ’reasonable cause’ but the subsequent use of your data.
The DVLA replied on 21 May (quite rightly, an apology was offered for the delay). The letter
reiterated the advice that your course of action was to the International Parking Community.
Two days later, you asked for an independent review. 3
On 26 June, while the ICA papers were being prepared, the DVLA wrote to you once more.
I think I should quote from this further letter at length:
“I understand you feel that Parking Control Management (UK) Ltd (PCM) did not
meet the requirements set out in the Protection of Freedoms Act (POFA) 2012, and
that they have breached the Private Parking Single Code of Practice. I also
appreciate you feel that as the data controller, we have not acted on the concerns
3 You criticised the DVLA for not having made the ICA review automatically, but I think that may have been
based on a misreading of the relevant guidance. In any event, there was no delay incurred.
7
you have raised regarding how PCM used your data after it was released by us.
However, I must advise that it is not a matter for the DVLA to decide on the merits of
individual cases or to arbitrate in any civil disputes between motorists and private
companies or other enforcement agencies. We cannot regulate any aspect of a
company’s business. Any representations should be made to the
landowner or their agent.
...
“The DVLA’s primary role in the context of your enquiry is to consider whether
the release of your information to a third party met the reasonable cause provision.
While reasonable cause is not defined in legislation, the government’s policy is that
requests should relate to the vehicle or its use following incidents where there may
be liability on the part of the driver.
...
“I fully appreciate you feel that although the company had reasonable cause to
request your information, the information was then misused. Under the regulations,
we disclose keeper information as a first point of contact for parking companies to
investigate and take the appropriate action on behalf of the landowner to enforce
their rights. Recipients of information from our records are bound by contract and
subject to audit. The supporting evidence relevant to each request must be held and
stored securely by the company. Anyone making a false declaration to obtain
information may be leaving themselves open to prosecution under data protection
laws. It may help to explain that PCM, separately from us, is the data controller of
each item of data received from us from the point of receipt. PCM has a duty to
comply with data protection legislation and any data protection principles in relation
to any further processing.
...
“The Government is very much aware of public concern about the enforcement
practices adopted by some companies managing private car parks. We are working
closely with the parking sector to improve procedures and to encourage compliance
with relevant codes of practice. The ATA carries out stringent checks on companies
before allowing them to join and monitors the compliance of their code of practice.
While I note your concerns regarding PCM’s potential non-compliance, we will not
investigate alleged breaches of a code of practice. In such circumstances, the
motorist would need to raise any concerns directly with the ATA who have
procedures in place to deal with such issues ...If you have not already done so, you
will need to raise your concerns with the IPC.
8
...
I understand you have made a complaint to PCM, and that they considered this to be
your appeal, and issued a response. We are unable to comment on this aspect of
your complaint and you would need to take this up with PCM. You can also raise
your concerns regarding PCM’s working practices with the IPC. You also have the
option of contacting the Independent Appeals Service (IAS) providing the timescale
has not passed ...
“In closing, I can assure you we have followed the correct procedures in releasing
your data and we cannot become involved in the dispute that may now have arisen
between you and the parking company since the information was released. I
understand you are unhappy with our earlier replies, and I can assure you it is not
our intention to be obstructive. However, the core issues you have raised are not
within the remit of the DVLA ... If you cannot resolve this matter through appeal or via
the IPC’s process, you have the option of seeking independent legal advice.
Ultimately it would be for a court to determine the validity of any claim.”
Further information
Although I know you are very familiar with the legislation, for the sake of completeness I
should quote from Regulation 27 of The Road Vehicles (Registration and Licensing)
Regulations 2002 (
https://www.legislation.gov.uk/uksi/2002/2742/regulation/27) as follows:
Disclosure of registration and licensing particulars
27.—(1) The Secretary of State may make any particulars contained in the register
available for use—
...
(e)by any person who can show to the satisfaction of the Secretary of State that he
has reasonable cause for wanting the particulars to be made available to him.
In June 2022, the Information Commissioner’s Office (ICO) published an important
document entitled The lawful basis for the processing of vehicle keeper data by the Driver
and Vehicle Licensing Agency (DVLA) (
https://ico.org.uk/media2/migrated/4020676/dvla-opinion-20220613.pdf). Again, it may be helpful to quote from the document. The ICO
found as follows:
“Following consideration of the evidence and legal analysis, the Commissioner
concluded that the DVLA’s correct lawful basis is public task, not legal obligation.
This is because Regulation 27(1)(e) provides the DVLA with a power, rather than a
9
legal duty, to disclose vehicle keeper information to car park management companies
in these circumstances ...
“It is important to note that in coming to this conclusion, the Commissioner does not
doubt that car park management companies have reasonable cause to request
keeper information from the DVLA in these circumstances, and that the DVLA is
generally required to provide it. However, Regulation 27(1)(e) creates a power rather
than a duty as there is a discretion for the DVLA to refuse a request for keeper
information in exceptional cases. For example, if the keeper was on a national
security protection list. This applies even if the requestor has demonstrated
reasonable cause. Public task is the correct legal basis in these circumstances,
because Regulation 27(1)(e) creates a task (a power, rather than a legal duty) to be
carried out in the public interest (hence the reasonable cause requirement).
Disclosing vehicle keeper data is necessary for this task.” (Emphasis added.)
I also note this extract:
“Paragraph 11 of Schedule 4 of POFA [Protection of Freedoms Act 2012] contains an
enforceable legal right of the car park management company to claim the charges
from the vehicle keeper. It is not for the DVLA to determine the validity of claims
against the vehicle keeper. Car park management companies can use the
exception. It would be for a court or parking tribunal to determine the validity of any
claim. It is the Commissioner’s view is that [sic] the DVLA could refuse an Article
21(1) objection by the vehicle keeper in these circumstances.” (Emphasis added.)
Consideration
Before offering any views, I need to re-emphasise the extent of my jurisdiction:
I am neither qualified nor authorised to make legal judgments (for example, on the
powers of the DVLA to provide keeper data to parking companies or others, or
whether it ensures sufficient safeguards against misuse of such data).
I have no authority whatsoever in regard to Parking Control Management (UK) Ltd or
the International Parking Community Ltd.
It is also worth adding, as did Mr Wigmore, that the DVLA is not the regulator of the parking
industry. Whether there should be tighter (or statutory) regulation is a matter for the political
process (as I explained in footnote 2, the Government has now initiated a formal
consultation exercise to which you may wish to respond).
All that said, I can offer the following comments:
10
My lay reading of Regulation 27 and the Information Commissioner’s assessment of
the legal framework is that parking companies generally have ‘reasonable cause’ to
request keepership data and the DVLA is not required to first adjudicate upon the
accuracy of the allegations made against a vehicle keeper before releasing the data
requested (“It is not for the DVLA to determine the validity of claims against the
vehicle keeper”). It is sufficient that the DVLA carries out regular audits of those
requesting data and requires parking companies to be a member of an accredited
trade association like the International Parking Community Ltd. I do not think you
disagree with those judgments, but should you do so I think you might have to take
independent legal advice or pursue your case further with the Information
Commissioner’s Office.
So far as the use of data following its release is concerned, I am content that the
DVLA has no legal or administrative duty (or, indeed, power) to investigate
complaints against private parking companies. The Agency has correctly referred
you to the IPC and to the appeals route against parking charges.
My lay view is that the DVLA has also been right to argue that PCM becomes the
data controller of each item of data it receives from the DVLA from the point of
receipt. Again, if you disagree with the DVLA’s analysis, you should seek legal
advice or approach the Information Commissioner.
Turning more broadly to the handling of your grievance, I share your irritation that the
initial responses did not really engage with the points you had made. In particular,
unlike many of those who complain to the DVLA in relation to private parking
enforcement, you had not questioned the Agency’s release of your data under the
‘reasonable cause’ provision. Despite this, the step 1 letter focussed unnecessarily
upon Regulation 27 (although, to be fair, both the step 1 and step 2 letters also said
your grievance should be addressed to the International Parking Community).
I was pleased to see the comprehensive letter sent by the DVLA on 26 June. In my
view, this addressed all the outstanding issues in a comprehensive fashion. I am
also content that the DVLA’s correspondence has been courteous (as of course you
and I have every right to expect).
Conclusions
In consequence of what I have written above, I cannot uphold your complaint. Nor are there
any formal recommendations I can make to the DVLA. I fear you may have anticipated that
outcome given the terms of Mr Wigmore’s acknowledgement in June.
This letter thus brings all stages of the Department for Transport complaints process to a
close. However, if you remain dissatisfied, you have the right to ask an MP to refer your
11
complaint to the Parliamentary and Health Service Ombudsman. There is a readily
downloadable form for this purpose at
www.ombudsman.gov.uk (please note: there is a
time limit for making a complaint to the Ombudsman; further information is available on the
PHSO website or call 0345 015 4033). The Ombudsman would then consider the extent of
any further review he considered necessary.
I will also send a copy of this letter to the DVLA.
Please do accept my good wishes.
Yours sincerely
Stephen Shaw
Show Posts