This DVLA response does not properly address the complaint and amounts to a fob-off.
Your complaint was not about whether a PCN exists, whether Euro Car Parks are BPA members, or whether a vehicle was parked. It was about whether DVLA lawfully released keeper data where the operator is asserting PoFA keeper liability on land that is excluded from PoFA by statute.
The response completely fails to engage with PoFA Schedule 4 paragraph 3. There is no consideration at all of whether the land is “relevant land”. There is no consideration of whether the parking place is provided or controlled by a traffic authority. There is no analysis of council ownership, traffic authority status, or off-street parking provision. Those are mandatory considerations, because PoFA can only apply on relevant land.
Instead, DVLA rely on generic statements about “reasonable cause” and simply repeat what Euro Car Parks have told them. That is not an assessment. DVLA are required to make their own lawful decision before releasing personal data. Accepting the operator’s assertion at face value is not sufficient, particularly where Parliament has expressly excluded local authority parking from Schedule 4.
Reasonable cause cannot exist where the stated cause relied upon by the operator is legally unavailable. Euro Car Parks are asserting statutory keeper liability under PoFA. PoFA does not apply to a parking place provided by a traffic authority. Once that statutory exclusion applies, the foundation for keeper liability collapses and DVLA data cannot lawfully be released for that purpose.
The response also mischaracterises DVLA’s role. While DVLA do not regulate parking companies generally, they do regulate their own disclosure of personal data under Regulation 27. That duty cannot be delegated to the BPA, to the operator, or avoided by saying DVLA do not regulate parking enforcement. This complaint concerns DVLA’s own statutory decision-making, not the parking company’s business model.
The response therefore demonstrates a failure to take into account relevant considerations, reliance on irrelevant considerations, and a failure to apply the correct legal test. That is maladministration.
The correct next step is a Step 2 DVLA complaint stating clearly that DVLA have failed to consider PoFA Schedule 4 paragraph 3(1)(b), failed to determine whether the land is relevant land, and have unlawfully relied on operator assertions rather than applying the statute. If DVLA maintain this position at Step 2, the matter should be escalated to the Independent Complaints Assessor and, in parallel, to the Information Commissioner’s Office on the basis that DVLA disclosed personal data without properly assessing lawfulness.
I advise you to submit the following Step 2 complaint in response:
Subject: Step 2 complaint – failure to consider PoFA Schedule 4 paragraph 3 and unlawful release of keeper data
Dear Mrs Boucher,
This is a Step 2 escalation of my complaint concerning the DVLA’s release of registered keeper data to Euro Car Parks Ltd.
I am dissatisfied with the Step 1 response dated 22 December 2025, which fails to address the substance of the complaint and amounts to a fob-off.
My complaint was not about whether a Parking Charge Notice was issued, whether Euro Car Parks are members of an Accredited Trade Association, or whether a vehicle was parked. It was about whether DVLA lawfully released keeper data in circumstances where the operator is asserting keeper liability under Schedule 4 of the Protection of Freedoms Act 2012 on land where that statute is expressly excluded.
The Step 1 response does not address PoFA Schedule 4 paragraph 3 at all. There is no consideration of whether the land is “relevant land”. There is no consideration of whether the parking place is provided or controlled by a traffic authority. There is no analysis of council ownership, traffic authority status, or off-street parking provision. These are mandatory considerations because keeper liability under PoFA can arise only on relevant land.
Instead, the response relies on generic statements about “reasonable cause” and simply repeats assertions made by Euro Car Parks. That is not a lawful assessment. DVLA are required to make their own independent decision before releasing personal data. Accepting an operator’s assertions at face value, without applying the statutory exclusions enacted by Parliament, is a failure of that duty.
Reasonable cause cannot exist where the cause relied upon is legally unavailable. Euro Car Parks are asserting statutory keeper liability under PoFA. PoFA does not apply to a parking place provided by a traffic authority. Once paragraph 3(1)(b) applies, the statutory foundation for keeper liability falls away and DVLA data cannot lawfully be released for that purpose.
The Step 1 response also mischaracterises DVLA’s role by stating that DVLA do not regulate parking companies. That is irrelevant. This complaint concerns DVLA’s own statutory decision-making under Regulation 27 of the Road Vehicles (Registration and Licensing) Regulations 2002 and DVLA’s obligations as a data controller. Those obligations cannot be delegated to the operator or the BPA.
The Step 1 response therefore demonstrates a failure to consider relevant matters, reliance on irrelevant matters, and a failure to apply the correct legal test. That amounts to maladministration.
I request that this Step 2 review addresses the following points directly and substantively:
1. Whether the land in question is a parking place provided or controlled by a traffic authority for the purposes of PoFA Schedule 4 paragraph 3(1)(b).
2. Whether PoFA keeper liability is legally capable of applying at that location.
3. On what lawful basis DVLA considered “reasonable cause” to exist for the release of keeper data where PoFA is statutorily excluded.
4. Why these matters were not considered at Step 1.
If the Step 2 response again fails to engage with the statutory exclusion in PoFA Schedule 4 paragraph 3, or simply repeats generic statements without applying the law, I will escalate the matter without further notice to the Independent Complaints Assessor as a case of maladministration. I will also refer the matter to the Information Commissioner’s Office in relation to unlawful disclosure of personal data, and to my Member of Parliament with a view to further escalation to the Parliamentary and Health Service Ombudsman.
I expect a substantive Step 2 response that directly addresses the legal issues raised.
Yours sincerely,
[name]
