You should also drop them in the mire with a formal complaint about them to the DVLA. Here’s how to make a DVLA complaint:
• Go to:
https://contact.dvla.gov.uk/complaints• Select: “Making a complaint or compliment about the
Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Britannia Parking Group Ltd, a BPA AOS member with DVLA KADOE access, for breaching the Private Parking Sector Single Code of Practice (PPSCoP) and misusing my personal data, which they obtained from the DVLA.
It is questionable whether Britannia had reasonable cause to request my data at all. The alleged contravention is based entirely on ANPR timestamps from two separate visits — a known failure mode referred to as a “double dip.” Under PPSCoP 7.3(d), operators are required to carry out manual checks for “orphan images” to ensure ANPR records are accurate before issuing a PCN. Had Britannia conducted the required quality control checks, they would have identified the error and had no cause whatsoever to request my data. Their failure to do so undermines any claim of reasonable cause from the outset.
Moreover, Britannia then issued a Notice to Keeper which falsely claimed that the keeper could be held liable under the Protection of Freedoms Act 2012. This was legally impossible due to the late issue date. They later admitted in writing that the NtK was not PoFA compliant, yet continued to pursue the keeper, and attempted to justify this using discredited pre-PoFA arguments. This constitutes a breach of Paragraph 8.1.1(d) of the PPSCoP and reflects a serious and deliberate misuse of my data.
The DVLA remains the data controller for personal data released via KADOE, and therefore bears responsibility for how that data is used. This complaint raises serious concerns under the UK GDPR and the Data Protection Act 2018, and I request that the DVLA report this matter to the Information Commissioner’s Office (ICO), and investigate both Britannia’s conduct and the DVLA’s own data sharing practices in this instance.
Please confirm receipt and provide a reference number for this complaint. Supporting evidence is attached.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract, PPSCoP and UK GDPR
Operator name: Britannia Parking Group Ltd
Date of PCN issue: 06/02/2025
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report the unlawful acquisition and misuse of my personal data by Britannia Parking Group Ltd, who accessed my DVLA keeper details via the KADOE (Keeper At Date Of Event) service.
Britannia Parking’s request for my data was made without reasonable cause, which makes the request itself — not just any later actions — a breach of:
• the KADOE contract,
• the UK General Data Protection Regulation (UK GDPR), and
• the Private Parking Sector Single Code of Practice (PPSCoP).
1. The KADOE request was unlawful – no reasonable cause due to failure to conduct mandatory checks
Britannia issued a PCN based on ANPR images showing my vehicle entering and exiting a site nearly two hours apart. That access road leads to a Waitrose car park monitored by a different ANPR system. The facts clearly establish that two separate visits occurred — a well-documented ANPR failure known as a “double dip”.
Before accessing any keeper data, operators are required under PPSCoP Paragraph 7.3(d) to conduct full quality control checks — including manual review of all ANPR captures — to identify orphan images and rule out double visits.
Britannia Parking failed to carry out these mandatory checks. Had they done so, they would have seen the two separate visits and realised that no contravention had occurred. There was never any reasonable cause to request DVLA data.
Accordingly, their KADOE request itself was unlawful. This is not just a breach of the Code and KADOE contract terms — it is a breach of the UK GDPR, because the personal data was obtained and processed without a lawful basis.
This breach occurred at the point of the request — not merely through subsequent use. The DVLA, as data controller, must treat this as a clear misuse of its data-sharing system.
2. False legal claims in the NtK – misrepresentation of keeper liability under PoFA 2012
Britannia then compounded the breach by issuing a Notice to Keeper dated 06/02/2025, falsely stating that the keeper was liable under Paragraph 9(2)(f) of the Protection of Freedoms Act 2012 (PoFA). However, the alleged contravention occurred on 26/01/2025, meaning the NtK was deemed delivered 15 days later — outside the statutory 14-day window required to establish keeper liability.
This wasn’t a clerical error. In correspondence dated 26/02/2025 (attached), Britannia again asserted PoFA liability, continuing to mislead the recipient about the legal basis for the charge. It was only in a subsequent letter dated 20/03/2025 (also attached) that they admitted the NtK was non-compliant — but even then, they attempted to justify their position using long-rejected “pre-PoFA” legal arguments.
This constitutes a deliberate breach of PPSCoP Paragraph 8.1.1(d), which prohibits operators from claiming keeper liability under PoFA unless the notice meets all statutory conditions — which this one did not.
3. Unlawful processing of personal data – breach of UK GDPR continues
Having obtained my data unlawfully, Britannia then used it to pursue a charge they had no legal authority to enforce, issuing misleading legal threats in an effort to extract payment. This is a textbook example of unlawful processing under the UK GDPR and Data Protection Act 2018, in violation of the principles of lawfulness, fairness, transparency, and purpose limitation.
As the data controller for keeper data released via the KADOE system, the DVLA has an obligation to investigate serious misuse and to protect data subjects whose personal data has been wrongly obtained.
I therefore request that the DVLA:
• Confirms that a breach has occurred
• Takes enforcement action against Britannia Parking Group Ltd
• Refers both the operator and this incident to the Information Commissioner’s Office (ICO)
• Reviews its internal data release procedures to ensure future requests meet the required threshold of lawful basis and reasonable cause
Britannia Parking’s conduct represents a fundamental abuse of the data access rights conferred under KADOE. This is not a minor infraction. They failed to carry out the required checks, had no reasonable cause to request my data, misrepresented their legal position in formal correspondence, and continued to misuse my personal data with no lawful basis.
I have attached the relevant supporting evidence.
Name: [INSERT NAME]
Date: [INSERT DATE]
Remember to include the copies of the relevant responses from Britannia. You'll have to combine it all into a single PDF. Use this free website to combine all the copies and the statement into a single pdf file:
https://www.pdf2go.com
