Free Traffic Legal Advice

I am escalating my complaint to Step 2, having received a wholly inadequate and dismissive response from Carly Williams (Ref: 0405058). Ms Williams’ reply fails to address the core of my complaint, which concerns the misuse of DVLA Keeper data after it was disclosed to Vehicle Control Services Ltd (VCS), a private parking company operating at Liverpool John Lennon Airport.

The DVLA has a legal obligation to ensure that data released under the KADOE contract is used lawfully and in compliance with the relevant Code of Practice. While the Step 1 response focuses entirely on the original request (reasonable cause), it ignores the key issue of how VCS subsequently misused the data in breach of the KADOE contract and UK GDPR.

I attach a detailed supporting statement explaining exactly how the data was used unlawfully by VCS, including evidence that they issued a Notice to Keeper falsely implying that the Keeper could be pursued under the Protection of Freedoms Act 2012—despite the land being excluded from that Act. This is a textbook case of unlawful post-access use and misrepresentation, which DVLA remains jointly responsible for as data controller at the point of disclosure.

Please confirm escalation of my complaint and provide a reference number.

SUPPORTING STATEMENT

Step 2 Complaint to DVLA – Misuse of Keeper Data by Vehicle Control Services Ltd (VCS)

Operator name: Vehicle Control Services Ltd
Date of PCN issue: 8 May 2025
Vehicle registration: [INSERT VRM]
DVLA Ref: 0405058
Step 1 responder: Carly Williams, Data Customer Auditor

I am escalating this complaint to Step 2 because the Step 1 response from Carly Williams demonstrates a fundamental failure to understand the nature of my complaint, the legal duties of the DVLA, and the conditions of data release under the KADOE contract.

1. Misunderstanding of the Complaint

The Step 1 reply wrongly treats this as a challenge to the initial release of data based on "reasonable cause." That is not the basis of this complaint. As I made clear, my concern is the subsequent unlawful use of DVLA-supplied Keeper data after disclosure, in breach of the:

• KADOE contract,
• Private Parking Single Code of Practice (PPSCoP), and
• UK GDPR.

The DVLA, as data controller at the point of release, has a duty to ensure that data is only used for the limited purpose for which it was disclosed: the fair and lawful pursuit of a parking charge under the Code of Practice. Once an operator breaches the Code post-access, the continued use of that data becomes unlawful. That is the crux of this complaint, and it was entirely ignored by Ms Williams.

2. Misstatement of Data Controller Responsibility

Ms Williams claimed that once DVLA has released data, the private parking operator becomes the Data Controller. While operators do become independent controllers, the DVLA retains responsibility as the original controller and data provider under the Data Protection Act 2018 and UK GDPR. The DVLA is responsible for ensuring that personal data is not misused as a direct result of its own disclosures.

This position is well established in ICO guidance and reflects the DVLA’s ongoing obligation to enforce the KADOE contract and suspend access where misuse is identified.

3. Breach of KADOE and PPSCoP by VCS

VCS has misused the data by issuing a Notice to Keeper which falsely implies that they can hold the Keeper liable under Schedule 4 of PoFA 2012, despite the location (Liverpool John Lennon Airport) not being “relevant land” for the purposes of that Act.

Specifically, the Notice states:

“If... we do not know both the name of the driver and a current address for service for the driver, we may pursue you (the Keeper) on the assumption you were the driver.”

This copies the language of PoFA 9(2)(f) and is intended to mislead the Keeper into believing they can be held liable. This is legally false and in direct breach of the PPSCoP (Section 3.3), which requires operators to act fairly, professionally, and transparently. It is also a breach of the purpose limitation and lawfulness principles under UK GDPR.

4. VCS Has Already Lost on This Point in Court

In the appellate case VCS v Ian Mark Edward [2023] (HOKF6C9C), HHJ Gargan ruled unequivocally at paragraph 5.3 that it is not appropriate to assume the Keeper is the driver without evidence. The judge explained that the assumption is unsound and that there are many common situations where the Keeper is not the driver. The continued use of this tactic by VCS demonstrates a deliberate and knowing misuse of personal data.

5. VCS Are Not a Statutory Authority

It must be stressed that VCS is a private, unregulated parking company with no statutory powers. They cannot issue fines or penalties. The charge is framed to appear like a penalty, when in fact it is nothing more than a speculative invoice, with no lawful basis in contract or statute. This misrepresentation, when linked to DVLA-supplied data, further compounds the breach.

Conclusion and Request

The Step 1 response shows a serious failure to understand:

• The DVLA's continuing data controller obligations,
• The difference between lawful access and unlawful post-access use,
• The KADOE requirement to act in accordance with the PPSCoP,
• And the legal limits on private companies misusing Keeper data under false pretences.

I am therefore requesting that this complaint be fully reviewed by the Head of Complaints and not simply passed back to the same department. The DVLA cannot lawfully continue to allow private companies to obtain data on a “reasonable cause” basis and then wash its hands of how that data is used—especially when the use breaches both contractual and legal safeguards.

Please confirm the escalation and provide a complaint reference number for Step 2. I am willing to provide any further material required.

Name: [INSERT NAME]
Date: [INSERT DATE]

Formal Appeal to Vehicle Control Services Ltd

PCN Ref: VCS23023633
Vehicle Reg: HG65 VMX
Site: Liverpool John Lennon Airport
Date of Issue: 8 May 2025

This is submitted in response to Point 2 of your letter dated 4 June 2025. To be clear, my original appeal still stands in full and is reiterated below with an additional clarification.

I am the registered keeper. VCS cannot hold a registered keeper liable for any alleged contravention on land that is under statutory control. As a matter of fact and law, VCS will be well aware that you cannot use the PoFA provisions because Liverpool John Lennon Airport (LJLA) is not “relevant land” under Schedule 4 of the Protection of Freedoms Act 2012.

If LJLA wished to enforce against keepers under Airport Bylaws, that would be within the landowner’s statutory remit. However, not only is that not pleaded here, it is also not legally viable: VCS is not the Airport authority, and your so-called “charge” is neither a penalty nor a statutory enforcement measure. It is plainly a contractual invoice pursued for your own commercial gain, not for the public purse.

Your Notice to Keeper cannot transfer liability to the registered keeper. It does not (and cannot) rely on PoFA, and your attempt to imply that the Keeper is liable by stating that you “may pursue [the Keeper] on the assumption [they] were the driver” is legally embarrassing and nonsensical.

Let me spell this out: The registered keeper cannot be presumed or inferred to have been the driver, nor pursued under some desperate distortion of agency law. If there is no evidence of who was driving, your claim ends there.

If you have forgotten, may I politely remind you that your company lost this argument spectacularly in your own case:
VCS v Ian Mark Edward (2023) [OKF6C9C] — where HHJ Gargan confirmed that there is no legal or evidential basis to assume the Keeper was the driver. The judgment even laid out common examples where such an inference is clearly invalid. That ruling leaves no room for your tired fiction that Keeper = driver.

So, do not insult my intelligence or waste my time with more of the same template replies.

If you intend to pursue this charge without identifying the driver, and in full knowledge that your case cannot survive judicial scrutiny, then I can only refer you to the well-established position in Arkell v Pressdram (1971).

Yours faithfully,

[Your Name]
Registered Keeper

I am the registered keeper of the vehicle. I deny any liability for this parking charge and appeal in full.

I repeat from my previous correspondence with the operator that their suggestion that they may continue to pursue the Keeper “on the reasonable assumption that [they] were the driver” is baseless. The operator, VCS, know this. The operator has already lost on this point in their own appellate case Vehicle Control Services Ltd v Ian Mark Edward (2023) [HOKF6C9C], where HHJ Gargan ruled that it is not appropriate to assume the Keeper was the driver on the balance of probability without supporting evidence. The operator cannot rely on PoFA to transfer liability, nor can they rely on unsupported inference.

The operator then makes the absurd claim that the byelaws are “not currently in use”. This is legally meaningless. Byelaws do not simply fall into disuse or expire by neglect — they remain in force unless and until they are formally repealed or replaced by statute. Unless the operator can produce definitive proof that the LJLA byelaws have been lawfully rescinded, they remain in effect and the land remains under statutory control. That alone disqualifies it as “relevant land” for the purposes of Schedule 4 of the Protection of Freedoms Act 2012. The operator’s assertion is just another example of the misinformation routinely used to support this long-running scam.

I challenge a supposedly legally trained IAS assessor to explain how a sign that ONLY states the following can form a contract:

"No Stopping. £100 charge if you stop. Traffic compliance cameras. Private Property. Vehicle Keeper details may be requested from the DVLA. Vehicle Control Services Ltd manage and control this site"

The operator claims their signs create a contractual obligation, but as they well know, and so should any legally trained assessor, the signage does not offer any terms to accept — it is prohibitory in nature. The sign threatens a charge for an act that is forbidden. A contract cannot be formed where the only “offer” is a prohibition, especially when there is no benefit or consideration. This type of sign has been found incapable of forming a contract in multiple persuasive court decisions.

Finally, the operators reference to “continuing to pursue” the Keeper without identifying the driver only further supports my existing complaints to the DVLA and ICO concerning their unlawful misuse of DVLA Keeper data, contrary to the KADOE contract, the BPA/IPC Private Parking Single Code of Practice (PPSCoP), and UK GDPR Article 5 principles.

The operators threat of continued pursuit — despite their admitted lack of evidence and absence of any statutory Keeper liability — is entirely unjustified and amounts to vexatious conduct.

The parking operator bears the burden of proof. It must establish that a contravention occurred, that a valid contract was formed between the operator and the driver, and that it has lawful authority to operate and issue Parking Charge Notices (PCNs) in its own name. I therefore require the operator to provide the following:

1. Strict proof of clear, prominent, and adequate signage that was in place on the date in question, at the exact location of the alleged contravention. This must include a detailed site plan showing the placement of each sign and legible images of the signs in situ. The operator must demonstrate that signage was visible, legible, and compliant with the IPC Code of Practice that was valid at the time of the alleged contravention, including requirements relating to font size, positioning, and the communication of key terms.

2. Strict proof of a valid, contemporaneous contract or lease flowing from the landowner that authorises the operator to manage parking, issue PCNs, and pursue legal action in its own name. I refer the operator and the IAS assessor to Section 14 of the PPSCoP (Relationship with Landowner), which clearly sets out mandatory minimum requirements that must be evidenced before any parking charge may be issued on controlled land.

In particular, Section 14.1(a)–(j) requires the operator to have in place written confirmation from the landowner which includes:

• the identity of the landowner,
• a boundary map of the land to be managed,
• applicable byelaws,
• the duration and scope of authority granted,
• detailed parking terms and conditions including any specific permissions or exemptions,
• the means of issuing PCNs,
• responsibility for obtaining planning and advertising consents,
• and the operator’s obligations and appeal procedure under the Code.

These requirements are not optional. They are a condition precedent to issuing a PCN and bringing any associated action. Accordingly, I put the operator to strict proof of compliance with the entirety of Section 14 of the PPSCoP. Any document that contains redactions must not obscure the above conditions. The document must also be dated and signed by identifiable persons, with evidence of their authority to act on behalf of the parties to the agreement. The operator must provide an agreement showing clear authorisation from the landowner for this specific site.

3. Strict proof that the enforcement mechanism (e.g. ANPR or manual patrol) is reliable, synchronised, maintained, and calibrated regularly. The operator must prove the vehicle was present for the full duration alleged and not simply momentarily on site, potentially within a permitted consideration or grace period as defined by the PPSCoP.

4. Strict proof that the Notice to Keeper complies with the Protection of Freedoms Act 2012 (PoFA), if the operator is attempting to rely on Keeper liability. Any failure to comply with the mandatory wording or timelines in Schedule 4 of PoFA renders keeper liability unenforceable.

5. The IAS claims that its assessors are “qualified solicitors or barristers.” Yet there is no way to verify this. Decisions are unsigned, anonymised, and unpublished. There is no transparency, no register of assessors, and no way for a motorist to assess the legal credibility of the individual supposedly adjudicating their appeal. If the person reading this really is legally qualified, they will know that without strict proof of landowner authority (VCS v HMRC [2013] EWCA Civ 186), no claim can succeed. They will also know that clear and prominent signage is a prerequisite for contract formation (ParkingEye v Beavis [2015] UKSC 67), and that keeper liability under PoFA is only available where strict statutory conditions are met.

If the assessor chooses to overlook these legal requirements and accept vague assertions or redacted documents from the operator, that will speak for itself—and lend further weight to the growing concern that this appeals service is neither independent nor genuinely legally qualified.

In short, I dispute this charge in its entirety and require full evidence of compliance with the law, industry codes of practice, and basic contractual principles.