Free Traffic Legal Advice

I am submitting a formal complaint against Universal Parking Enforcement Ltd, an IPC Accredited Operator Scheme (AOS) member with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.

While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—by pursuing keeper liability without complying with the statutory requirements under the Protection of Freedoms Act 2012 (PoFA)—renders their processing unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about the initial data access, but rather the misuse that followed.

I have uploaded a supporting statement outlining the breaches committed by the operator and I request that the DVLA investigates and confirms a breach of the KADOE contract and PPSCoP.

Please acknowledge receipt and confirm the reference number for this complaint.

SUPPORTING STATEMENT

Complaint to DVLA – Breach of KADOE Contract and PPSCoP

Operator name: Universal Parking Enforcement Ltd
Date of PCN issue: 02/01/2025
Vehicle registration: [INSERT VRM]

I am submitting this complaint to report a misuse of my personal data by Universal Parking Enforcement Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.

Although the company may have had reasonable cause to request my data, their subsequent use of it was unlawful due to breaches of the governing Code of Practice (PPSCoP), which forms a mandatory condition of KADOE access. The KADOE contract only permits use of DVLA keeper data for the fair pursuit of unpaid parking charges in accordance with the Code.

In this case, the operator has breached the Code and misused my data in the following ways:

• Unlawful pursuit of keeper liability: The Notice to Keeper was issued on 02/01/2025, nearly five months after the alleged incident on 06/08/2024. Under PoFA Schedule 4, Paragraph 9(4)(b), keeper liability can only apply if the notice is delivered within 14 days of the parking event. As this was not done, the operator had no lawful basis to pursue me as the registered keeper.
• Failure to respect statutory limits on data use: Despite being informed that I was not the driver and presented with evidence of this (including my flight itinerary and boarding pass showing I was abroad at the time), the operator continued to pursue me without any legal basis under PoFA. They also refused to acknowledge that I am under no legal obligation to identify the driver.

These breaches are not minor. They represent a fundamental misuse of DVLA keeper data and a disregard for the conditions attached to its release. By acting outside the boundaries set by PoFA and the PPSCoP, Universal Parking Enforcement Ltd lost the lawful basis for continued processing of my personal data.

The DVLA remains the data controller for all data disclosed under KADOE and is therefore responsible for ensuring that this data is not misused. I respectfully request that DVLA investigate this complaint and confirm whether Universal Parking Enforcement Ltd has breached the terms of their KADOE contract.

I ask the DVLA to consider the following actions:

This may include:

• A formal finding of breach
• Enforcement action as appropriate
• Suspension or revocation of KADOE access if warranted

Supporting documents, including my original appeal and evidence proving I was not the driver, have been uploaded with this statement.

Name: [INSERT YOUR NAME]
Date: [INSERT DATE]

Also: was a notice(to driver) left on the vehicle on 6 August, or was the first communication the Notice to Keeper dated 2 Jan. 2025?