Never, mind, I see I already gave you the substance to put in the complaint. The DVLA’s response is typically disappointing, generic and fails to engage with the substance of the complaint—particularly the allegation of misuse of data after lawful acquisition, which is a crucial distinction under UK GDPR and the KADOE contract.
Respond with the following as a step 2 escalation:
Step 2 Complaint – Data Misuse by G24 Ltd
To: [DVLA Step 2 Complaint Contact – if submitting via email, use data.sharing@dvla.gov.uk or the complaints portal as directed]
Date: [Insert Date]
Reference: [Insert reference number provided in Step 1 response]
Subject: Step 2 Complaint – Misuse of DVLA Keeper Data by G24 Ltd (KADOE Breach)Dear Sir/Madam,
I am writing to escalate my complaint to
Step 2 of the DVLA complaints process. I appreciate the response received from Mrs Lisa Boucher dated 31 March 2025, but must respectfully state that it failed to address the substance of my complaint. I now request a further and more thorough review.
This complaint is not about whether G24 Ltd had reasonable cause to obtain my data at the outset. It concerns the
unlawful subsequent use of that data in breach of the
BPA/IPC Private Parking Single Code of Practice (PPSCoP), a mandatory component of the DVLA's governance framework for data access.
Once a private parking operator is given access to keeper data,
that data may only be used in compliance with the KADOE contract, which incorporates the applicable Code of Practice. Breaches of the Code render further use of that data unlawful, amounting to a misuse of personal information under the UK GDPR and Data Protection Act 2018.
The original complaint identified multiple serious breaches of the PPSCoP, including:
• Failure to provide legally required signage viewable from the vehicle, contrary to Section 4.1;
• Discriminatory conduct towards a disabled occupant of the vehicle, in breach of the Equality Act and the PPSCoP;
• Failure to provide a meaningful response to a formal complaint, contrary to Section 11.2;
• Misrepresentation of the appeals window on the NtK, in breach of Section 8.1.2(e).
Your Step 1 response failed to consider or even acknowledge these points. Instead, it offered a general explanation of DVLA’s role in data release, which is not in dispute. It also incorrectly implies that alleged breaches of the Code are purely a matter for the IPC. This misstates the DVLA’s obligations under the KADOE contract.
As data controller, the DVLA retains legal responsibility for ensuring data obtained under KADOE is only used in accordance with the terms under which it was provided. Deferring responsibility to the ATA is not sufficient where misuse is clearly evidenced and brought to the DVLA’s direct attention.
In summary:
• The original data request may have had reasonable cause;
• However, the subsequent use of that data by G24 Ltd breached the PPSCoP;
• This breach renders the continued use of my personal data unlawful;
• The DVLA, as data controller, must investigate and consider enforcement action under the terms of the KADOE contract.
I now ask for a formal Step 2 review of my complaint, with reference to the above breaches and the attached supporting statement. Please also confirm whether the DVLA has taken steps to audit or review G24’s compliance in light of this complaint.
I await your full response and a new reference number for this escalation.
Yours faithfully,
[Your Name]
[Your Contact Details]
[Vehicle Registration]
[ Guests cannot view attachments ]
