Use this form another thread with the same issue:
1. Duty to Update Personal Data (Article 5(1)(d))Under UK GDPR Article 5(1)(d), data must be accurate and, where necessary, kept up to date. You have now informed them of a new address for service, and they are obliged to update their records accordingly. Their obligation to retain a historical address for audit or evidential purposes (e.g. why the PCN was sent there) does not override your right to have your current address used for ongoing or future correspondence.
2. Right to Rectification (Article 16)Article 16 gives you the right to have inaccurate personal data rectified and, where applicable, to have incomplete data completed. Their refusal to update your address on the basis that they used the V5C address at the time of the event is irrelevant to ongoing or future processing. They are now processing the data for debt recovery, and must use your up-to-date address.
3. Erasure of Old Address (Article 17)You requested erasure of the old address, which can be justified under Article 17(1)(c) where the data is no longer necessary for the purpose for which it was collected. If they argue it is still necessary (e.g. for evidential purposes), they must retain it securely but must not use it for service or further correspondence. That would be a misuse of out-of-date personal data.
4. Legitimate Interests (Article 6(1)(f))While they may rely on legitimate interests for processing, this does not negate your rights under Articles 16 and 17, nor does it excuse them from complying with your rectification request.
5. Misuse of Address for ServiceContinuing to send letters or legal proceedings to the outdated address, despite being notified of the current one, would constitute unreasonable behaviour under the Civil Procedure Rules and also has Data Protection implications.
Respond to that letter/email you received with the following:
Subject: Data Rectification Under UK GDPR – Notice of Formal Non-Compliance
Dear Data Compliance Team,
I write further to your response regarding my data rectification request, and I must express serious concern at your apparent failure to understand your legal obligations under the UK General Data Protection Regulation (UK GDPR). Your refusal to update your records with my current address, or to mark my previous address as obsolete, is both legally and procedurally unacceptable.
Let me be clear: you have now been formally notified of my current address for service. Continuing to process my personal data using an outdated address – including passing it to third parties – is a breach of your obligation under Article 5(1)(d) and Article 16 of the UK GDPR, which require personal data to be accurate, kept up to date, and rectified without delay. Continued use of an outdated address, despite formal notice, may constitute a misuse of my personal data and could be deemed unreasonable behaviour under the Civil Procedure Rules in the event of any legal proceedings.
Your reference to Article 6(1)(b) and (f) is entirely misplaced. The lawful basis for processing personal data does not exempt you from compliance with the data subject’s right to rectification or erasure where applicable. The fact that you obtained my previous address via the DVLA does not give you a perpetual right to rely on it once you have been notified it is no longer valid for service.
Your refusal to erase or mark the old address as obsolete also breaches Article 17(1)(c), as that data is no longer necessary for the purposes for which it was originally collected. While you may retain the historic address internally for evidential purposes, it must not be used for further correspondence or shared with third parties.
If this letter is received by someone who still cannot grasp your obligations under data protection law, I insist it be immediately passed to someone within your organisation who has the required competence and authority to respond appropriately. This is not a matter of discretion or internal policy – it is a matter of statutory compliance.
I also take this opportunity to make my position regarding DRP or any other so-called ‘debt recovery’ agent entirely clear. I will not be engaging with them under any circumstances. I am well aware that they are not a party to any alleged contract, have no lawful authority in this matter, and serve merely as data processors acting under your instruction. As the data controller, you remain uniquely and solely responsible for the processing of my personal data, including any transmission to third parties.
Accordingly, you are now formally required to:
1. Update your records with my current address for service and confirm in writing that this will be used for all future correspondence, including communications issued by your agents or legal representatives.
2. Confirm that the previous address has been erased or permanently marked as obsolete, and that it will not be used again for any form of contact or processing.
3. Acknowledge your full accountability as data controller for all data sharing to date and confirm that my current address has been provided to any third parties who were previously given the outdated information.
If you fail to act on this request within 14 days, I will escalate the matter to the Information Commissioner’s Office (ICO). I also reserve the right to pursue all available legal remedies, including seeking damages or costs where misuse of data or procedural abuse occurs.
Yours sincerely,
[Your Full Name]
