This is the standard Step 1 fob-off, which:
• Avoids addressing any specific PoFA or PPSCoP breach,
• Falls back on the “reasonable cause” at time of request excuse, and
• Repeats that the DVLA “cannot determine liability” — which is irrelevant to your complaint.
They did not engage with your actual complaint, which was not about whether there was reasonable cause at the time of the request, but whether the subsequent use of your data breached the KADOE contract and UK GDPR after receipt.
Their statement that:
"Pace Recovery & Storage Ltd confirmed the Charge Notice was issued… due [to] parking… without a valid permit…"
completely ignores that the Notice to Driver and Notice to Keeper were PoFA non-compliant, and that no evidence of contract formation exists.
They incorrectly rely on “no appeal received” as justification. But you intended to appeal within the 28 days but didn’t, you later provided your full Keeper details voluntarily and they then obtained them from DVLA after already being in possession of them, and they pursued Keeper liability without complying with PoFA or the PPSCoP.
DVLA’s refusal to “determine liability” is irrelevant. You are not asking them to do that — you are asking them to determine whether data was misused once obtained in breach of the KADOE contract and/or PPSCoP.
The DVLA is still the Data Controller and is responsible for ensuring its data is used lawfully after disclosure. You have provided evidence that the operator:
• Breached PoFA by failing to specify a “period of parking,”
• Breached PoFA by misstating the 28-day liability warning,
• Breached the PPSCoP by issuing a charge where no contract could have been formed,
• Breached the KADOE contract by using your data for an illegitimate purpose once it was clear no recovery could lawfully be made from the Keeper.
The Step 2 complaints procedure is exactly the same as the first step but the link is to "Head of Complaints" here:
https://contact.dvla.gov.uk/head-of-complaintsUse the following as the content for the webform:
This is a Step 2 escalation regarding a complaint already submitted and acknowledged under DVLA reference 0401979.
Your Step 1 response dated 14 May 2025 fails to address the actual basis of my complaint. You have wrongly assumed that my concern was about the initial request for data (reasonable cause), when in fact the issue is with the subsequent misuse of that data in breach of the KADOE contract, the Private Parking Single Code of Practice (PPSCoP), and UK GDPR.
The parking operator, Ace Security Services (trading as Pace Recovery & Storage Ltd), used my DVLA data to pursue a parking charge in circumstances where:
- No valid “period of parking” was recorded (PoFA breach),
- No evidence of any contract being formed exists (PPSCoP breach),
- The NtK misstates the 28-day period under PoFA (Schedule 4, para 8(2)(f)),
- Therefore, the use of my data for enforcement purposes was illegitimate.
The DVLA remains the data controller and is responsible for ensuring that third parties with KADOE access do not misuse that data once obtained. My complaint is about post-access misuse, not the initial request. I am now requesting a formal internal review at Step 2.
A revised supporting statement is attached. Please escalate this matter accordingly and confirm the new reference number.
You save the following as a PDF file and upload it as before:
SUPPORTING STATEMENT – STEP 2 COMPLAINT
Misuse of DVLA Data by Ace Security Services (Pace Recovery & Storage Ltd)
DVLA Ref: 0401979
Vehicle: DF14KYP
Date of CN: 13 March 2025
This is a formal Step 2 escalation following the DVLA’s response dated 14 May 2025. That response did not address the substance of my original complaint and failed to distinguish between a complaint about initial data access and a complaint about subsequent misuse.
What the DVLA got wrong:
Your Step 1 response focused entirely on whether the operator had “reasonable cause” at the time of requesting data. This was never in dispute. My complaint is about how the data was used after it was obtained — which falls under your obligations as Data Controller under the KADOE contract and UK GDPR.
Summary of misuse and code breaches:
Ace Security Services obtained my data and then:
• Issued a Notice to Keeper without specifying a “period of parking”, as required by Schedule 4, paragraph 8(2)(a) of PoFA. The NtD and NtK only referenced a single timestamp, not a duration.
• Failed to evidence that the vehicle remained in situ beyond the consideration period (as required by the PPSCoP). Therefore, there is no basis to claim a contract was formed.
• Issued a Notice to Keeper that misstates the 28-day warning under PoFA. It said: "28 days from the date given," instead of: "28 days beginning with the day AFTER the day on which the notice is given" (per paragraph 8(2)(f)).
• Pursued Keeper liability despite failing to comply with PoFA — invalidating their legal basis to do so and rendering the use of my DVLA data unlawful.
Why this breaches the KADOE contract and UK GDPR:
The KADOE contract explicitly states that keeper data must only be used to pursue a parking charge in full compliance with the applicable Code of Practice.
Ace Security Services has not done so. By breaching PoFA and the PPSCoP, their use of my data falls outside the “permitted purpose” for which it was provided — making it a misuse of personal data under both the KADOE contract and data protection law.
Action requested:
I am now formally requesting that the DVLA:
• Conduct a proper internal review of this complaint,
• Confirm that a breach of the KADOE contract has occurred,
• Take enforcement action against Ace Security Services / Pace Recovery & Storage Ltd,
• Provide me with a new reference number and outcome in writing.
The DVLA remains the data controller and is duty-bound to act when personal data it provides is misused. You cannot lawfully ignore a complaint about post-access abuse simply because the initial request may have had “reasonable cause.”
Please confirm that this has been escalated to Step 2 and provide an appropriate response. I am also willing to provide additional material if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
