Free Traffic Legal Advice

Thank you for your support, I truly appreciate your help and will return with updates (except the debt recovery letters)

So send a formal complaint to the DVLA. Here’s how to make a DVLA complaint:


The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.

For the text part of the complaint the webform could use the following:

I am submitting a formal complaint against Parking Control Management (UK) Ltd, an IPC AOS member with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) and misusing my personal data obtained from the DVLA.

While PCM may have had reasonable cause at the time of their KADOE request, their subsequent conduct—specifically, their misuse of my data in breach of the PPSCoP and the Protection of Freedoms Act 2012 (PoFA)—renders that use unlawful. Continued access to DVLA data is conditional on compliance with the Code and the KADOE contract.

The DVLA, as the Data Controller, is required under UK GDPR and the Data Protection Act 2018 to investigate and take action when personal data is misused following release.

This complaint is not about whether PCM had a lawful reason to obtain my data, but about how they used it unlawfully after the fact. I have attached a full supporting statement and request that you investigate this matter thoroughly.

Please confirm receipt and provide a reference number for this complaint.

Then you could upload the following as a PDF file for the formal complaint itself:

SUPPORTING STATEMENT

Complaint to DVLA – Breach of KADOE Contract and PPSCoP

Operator name: Parking Control Management (UK) Ltd
Date of PCN issue: 11/02/2025
Vehicle registration: [INSERT VRM]

I am submitting this complaint to report a misuse of my personal data by Parking Control Management (UK) Ltd (PCM), who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.

Although the parking company may have had reasonable cause to request my data initially, the way they have used that data afterwards amounts to unlawful processing. This is because they have acted in breach of the Private Parking Single Code of Practice (PPSCoP) and the Protection of Freedoms Act 2012 (PoFA), both of which are mandatory for access to DVLA keeper data. The KADOE contract makes clear that DVLA data may only be used to pursue unpaid charges in accordance with these rules.

In this case, PCM has breached both PoFA and the PPSCoP in the following ways:

1. Failure to Specify “Relevant Land” – PoFA 8(2)(a)

The NtK issued by PCM on 19/02/2025 refers only to “Queens Road Estate.” This is not a precise or identifiable location. The estate is large and includes multiple blocks, roads, and parking areas. There is no mention of a specific road, bay number, or other detail that would help identify where exactly the vehicle was said to be parked.

This is a clear failure to meet the PoFA requirement to “specify the land on which the vehicle was parked.” Without this, the recipient cannot assess the allegation or verify the presence or terms of any signage. As a result, keeper liability cannot apply.

2. Failure to Specify a “Period of Parking” – PoFA 8(2)(a)

The NtK includes only a single timestamp (“14:56”) and does not mention any period of parking. This is not a valid “period” under PoFA. The law requires a duration of parking to be stated so the keeper can assess whether a contravention occurred and how long the vehicle was said to be parked.

There is no evidence that the vehicle remained on site for more than a minute or two, and no evidence that it stayed longer than the minimum five-minute “consideration period” required by the PPSCoP. That five minutes is the time allowed to review signage and leave without entering into a contract.

If a driver leaves during the consideration period, no contract can be formed and no parking charge is valid. This was confirmed in the persuasive appellate case of Brennan v Premier Parking Solutions (2023) [H6DP632H], where the court ruled that a timestamp is not sufficient and that PoFA requires a defined period. PCM has failed to provide this and therefore cannot invoke keeper liability.

3. Misrepresentation of Keeper Liability – PPSCoP 8.1.1(d)

Despite the above PoFA failures, PCM’s NtK still states that they are entitled to recover the charge from the keeper. This is false. The PPSCoP prohibits misleading statements about keeper liability. An operator cannot assert PoFA rights when their NtK fails to comply with the law.

This is a clear breach of Section 8.1.1(d) of the PPSCoP and an attempt to mislead the recipient into thinking they are liable when they are not.

4. Failure to Provide Proof of Posting – PPSCoP 8.1.2(e) Note 2

The PPSCoP requires operators to retain and disclose the date that a Notice to Keeper was actually posted, not just the date it was printed or generated. I requested evidence from PCM confirming the method and date of posting, including whether a mail consolidator was used. They have not provided any evidence or explanation.

Without proof of posting, it cannot be shown that the NtK was delivered within the statutory timeframe under PoFA. This is another compliance failure.

5. Failure to Consider a Formal Complaint – PPSCoP Section 11.3

I submitted a formal complaint to PCM, clearly stating that it was not an appeal but a complaint about legal and procedural breaches, including misuse of DVLA data and non-compliance with the PPSCoP. PCM responded with a generic appeal rejection and refused to treat it as a complaint, falsely stating that the complaints process does not apply to parking charges.

This is a blatant breach of PPSCoP Section 11.3, which requires operators to handle formal complaints separately from appeals and respond accordingly. Section 11.3 makes clear that motorists have the right to raise complaints about poor practice or misuse of data, which this clearly was. PCM’s refusal to follow the proper complaints process is itself a breach of the Code and undermines their suitability to retain DVLA data access.

Conclusion

PCM has failed to meet the legal requirements to pursue keeper liability. They have misrepresented their position, breached both PoFA and the PPSCoP, and continued to pursue me using DVLA data to which they are no longer entitled.

The KADOE contract is clear: data must only be used for lawful purposes in line with PoFA and the Code of Practice. PCM has not done so.

I am therefore asking the DVLA to investigate this matter and take appropriate action under the terms of the KADOE contract. This may include:

• Confirming that a breach has occurred
• Taking enforcement action against the operator
• Suspending or terminating their KADOE access if warranted

I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.

Name: [INSERT YOUR NAME]
Date: [INSERT DATE]

When you get a response, show it to us.

As normal... a complete obfuscation of what was complained about. You now escalate this complaint to the DVLA Head of Complaints"



The format is the same as for the step 1 complaint. So, copy and paste this into the complaint webform:

This is a Step 2 escalation of my original complaint submitted on 10 April 2025 regarding Parking Control Management (UK) Ltd’s misuse of my personal data obtained via a KADOE request.

The Step 1 response failed to address the actual substance of my complaint. I am not disputing that PCM had reasonable cause to obtain the data — my complaint concerns their unlawful use of the data after acquisition, in breach of PoFA, the BPA/IPC Private Parking Single Code of Practice (PPSCoP), and the KADOE contract.

I have uploaded a full Step 2 supporting statement in PDF format. Please confirm this has been escalated appropriately and provide a reference number.

...and then attach the following as a pdf on the next page:

SUPPORTING STATEMENT

Step 2 Complaint – Misuse of Keeper Data by Parking Control Management (UK) Ltd

DVLA Complaint Reference: [INSERT REFERENCE]
Date of Original Complaint Submission: 10 April 2025
Vehicle Registration: [INSERT VRM]

This is a formal escalation to Step 2 of the DVLA’s complaints procedure. It follows the Step 1 response dated [insert date], issued by Carly Williams of the Data Assurance Team.

That response failed entirely to address the substance of my complaint. Instead of reviewing the issues raised, it resorted to a generic explanation about “reasonable cause” — something I never disputed. I consider the response to have been petty, evasive, and obstructive, and a complete failure to engage with the legal and procedural breaches I set out.

To be clear:

• I did not dispute that PCM may have had reasonable cause to request my data at the time of their DVLA enquiry.
• My complaint concerns PCM’s subsequent misuse of that data, in breach of the Protection of Freedoms Act 2012 (PoFA), the BPA/IPC Private Parking Single Code of Practice (PPSCoP), and the KADOE contract — all of which are binding conditions for access to DVLA keeper data.

As Data Controller, the DVLA has a responsibility not only to ensure data is disclosed lawfully, but that it is also used lawfully after disclosure. Where a company breaches the conditions under which DVLA data was obtained, continued use becomes unlawful and enforcement action must follow.

In this case, PCM:

• Issued a Notice to Keeper (NtK) that fails to comply with PoFA Schedule 4, Paragraph 8(2)(a):

• It did not identify the “relevant land” (it stated only “Queens Road Estate”)
• It did not specify a “period of parking” — only a single timestamp, which is legally insufficient

• Falsely claimed keeper liability applied, despite the NtK not meeting PoFA conditions — a clear breach of PPSCoP Section 8.1.1(d)
• Refused to investigate a formal complaint, breaching PPSCoP Section 11.3 — they treated it as an appeal, contrary to the Code
• Failed to provide proof of posting when asked, breaching PPSCoP Section 8.1.2(e) Note 2

All of these breaches were clearly outlined in my original complaint and supporting material. It is unacceptable that the DVLA's Step 1 review ignored these matters entirely.

This document is submitted as a formal Step 2 supporting statement, and I request that the DVLA now properly investigate PCM’s misuse of my personal data under the terms of the KADOE contract and Code of Practice.

Please confirm this has now been escalated to Step 2 and provide a new reference, if applicable. I am happy to provide all correspondence again if needed.

Hello, as you have previously mentioned that they would do that, I’ve just received a debt recovery letter from Trace Debt Recovery. They are threatening to pursue a County Court Judgment (CCJ), which I understand could negatively impact my credit rating. I’m quite concerned about this situation. Am I safe to ignore the letters

Thank you for explaining that

That response is yet another template-driven brush-off. It avoids engaging with the substance of the complaint, namely the unlawful use of your data in breach of the KADOE contract, PoFA, and the PPSCoP.

They claim:


But the complaint was not about the release of data — it was about how PCM used it after obtaining it. They’ve shifted the scope of the complaint back to Step 1 territory, ignoring the arguments about ongoing misuse.


This is a clear dereliction of duty. The DVLA, not the IPC, is the data controller and party to the KADOE contract. You are not complaining about a Code of Practice breach in isolation — you are complaining that DVLA data was processed unlawfully after release, which only the DVLA can deal with under UK GDPR and the terms of the KADOE contract.

They then falsely conclude the procedure is over:


That’s not entirely correct. Because this is a data protection matter concerning the lawful basis for data processing, you can now escalate to the Information Commissioner’s Office (ICO).

The DVLA has now formally closed its complaints process. Since they are the data controller and have dismissed a valid data misuse complaint without proper investigation, you can now escalate to the ICO.

You can copy and adapt the following:

I am submitting a formal complaint concerning the misuse of my personal data by Parking Control Management (UK) Ltd (PCM), which was obtained from the DVLA via a KADOE request. The DVLA, as data controller, failed to act upon a complaint regarding unlawful processing of this data.

My original complaint to the DVLA (Step 1 on 10 April 2025; Step 2 on 23 April 2025) explained that PCM issued a Notice to Keeper (NtK) that did not comply with Schedule 4 of the Protection of Freedoms Act 2012 (PoFA), and that they misrepresented keeper liability, in breach of the Private Parking Single Code of Practice (PPSCoP).

These breaches mean the parking operator had no lawful basis to continue processing my data. As per the DVLA’s KADOE contract, data must only be used in accordance with PoFA and the applicable Code of Practice.

The DVLA closed the complaint at Step 2 without any investigation, stating only that no error was found in the release of the data. However, my complaint was not about the release, but about the subsequent use of my personal data — which the DVLA is obligated to regulate.

I am therefore asking the ICO to investigate both:

• The unlawful use of my data by PCM in breach of the KADOE contract and data protection law, and
• The DVLA’s failure, as data controller, to investigate or take action despite being fully informed of the misuse.

I am happy to provide all supporting documents and correspondence from the DVLA if required.

You can also make a complaint about the DVLA handling of your case to the Independent Complaints Assessor (ICA). The ICA can review how your complaint was handled (delay, rudeness, procedural errors etc.) and look at administrative failings in the complaints process

What the ICA cannot do is to overturn a DVLA decision, investigate policy decisions, investigate misuse of DVLA data (that’s the ICO’s job) or enforce compliance with the KADOE contract.

You can only contact the ICA after the DVLA’s internal process is complete — which it now is. However, you cannot make the complaint yourself and the DVLA must refer it to the ICA themselves.

Email back to the Head of Complaints with the following:

Subject: Request for DVLA to Refer Complaint to the Independent Complaints Assessor (ICA)

Dear DVLA Head of Complaints,

I am writing in regard to your Step 2 response dated 21 May 2025 (Ref: [INSERT]), which closed my complaint regarding Parking Control Management (UK) Ltd’s misuse of my keeper data obtained via a KADOE request.

Your response states that “further options can be found in the attached leaflet (MIS 582), which outlines the remit of the Independent Complaints Assessor (ICA)”, but you did not refer my complaint to the ICA, nor did you offer to do so — which you are required to do under the Department for Transport’s published ICA Terms of Reference:

“The final response to a complaint from the DfT agency should inform the complainant of the option of referral to the ICA.”

“Referrals to the ICA must be made by the DfT agency concerned.”

I am therefore requesting that you now make a formal referral to the ICA.

In addition to this procedural failure, the way my complaint was handled at both Step 1 and Step 2 was entirely inadequate and, in my view, obstructive. The core of my complaint was not about whether PCM had reasonable cause to obtain my data, but about their misuse of that data after acquisition — in breach of:

• The Protection of Freedoms Act 2012 (PoFA)
• The Private Parking Single Code of Practice (PPSCoP)
• The DVLA’s KADOE contract

Despite explaining this in detail — with references to specific statutory and Code of Practice breaches — your Step 1 and Step 2 responses ignored every substantive point and instead responded solely on the issue of “reasonable cause”, which I had clearly stated was not in dispute. No evidence has been presented that any investigation took place.

The DVLA, as Data Controller, is responsible for ensuring that data released from the vehicle register is used lawfully. The failure to even address whether PCM’s subsequent use of my data was lawful is, in my view, a serious failure of duty.

I ask that this complaint now be formally referred to the ICA under the DfT’s published procedure, and that you confirm once this referral has been made.

Yours sincerely,

[YOUR NAME]
[ADDRESS / EMAIL]

Hello, have received the following email reply from the Department of Transport:


"COMPLAINT AGAINST THE DRIVER & VEHICLE LICENSING AGENCY (DVLA)

I write further to your correspondence with the DVLA about the independent complaint
assessor (ICA) review of your complaint. I confirm that a file containing your dealings with
the DVLA has been received by the ICAs, and your complaint is being queued for allocation.
Please note that what follows is not an attempt at defining your complaint, and will not
inform or shape the review. It is, rather, a brief reference at this acknowledgement stage to
some of the difficulties described in the file.

You complained after the DVLA sold your data to a parking company, alleging misuse of the
data after its disclosure. Like many others who come to us with these complaints, you allege
a string of breaches of the law, KADOE, the PPSCoP and what amounts to a regulatory
failure on the part of the DVLA in its oversight of the disclosure regime.
I have set out our jurisdiction as ICAs in an annex to this letter. We are not employees of the
DfT or any of its public bodies. We cannot challenge or overturn a decision made by a
public body in line with its policies. However, we can assess if the public body has
administered its policies correctly, acted consistently with them and provided a reasonable
standard of administration and customer service. The DVLA is in the jurisdiction of the
Parliamentary Ombudsman and we refer where relevant to his Principles and UK Central
Government Complaints Framework in judging whether the DfT or one of its delivery bodies
has acted reasonably. 1 In doing so, we must be clear that we do not function as an appeals
1 More information about ICA jurisdiction and reviews, including a library of our annual reports/casebooks, is
available here: https://www.gov.uk/government/publications/dft-independent-complaint-assessors-terms-of-
reference/dft-independent-complaint-assessors-terms-of-reference &

2

body for enforcement or regulatory decisions made by DfT public bodies. Nor can we re-
make a decision based on the correct pursuit of policy and/or the public body’s approach to
resource allocation.
I should emphasise that we cannot adjudicate on the legality of the DVLA’s supply of keeper
data to private parking companies (you will know that the ICO is the authority that oversees
data law, and that it is content with the DVLA’s activities in this controversial sphere). Nor is
the DVLA an actual or proxy regulator for this sector, so complaints about the legal footing
and procedural basis behind a PCN need to go down the prescribed appeal route, not to the
agency or us. As you know, the ICO has fully approved the DVLA’s practice of releasing
keeper data for the investigation of potential liability under the reasonable cause provision
(in other words, the DVLA does not have to satisfy itself of the legitimacy of a request before
data release (I say this understanding that you are not complaining about the disclosure
itself).

Approaching 41,000 drivers are issued with PCNs by private firms each day, underlining the
operational necessity for high level oversight of KADOE compliance. We are not going to
criticise the agency for formulating and applying policy in this domain. In my view, a political
move in an area of widespread public concern is required to change the current
arrangements. You may know, however, that initiatives to address public discontent have
not seemingly progressed since the then government “temporarily” withdrew the Private
Parking Code of Practice in June 2022 after lobbying from the private parking sector.
At this stage, bearing the scope (above) in mind, it would be of assistance to know what
your main outstanding concerns are, and what you hope to achieve through your complaint.
We work remotely from the DfT, part time, and will not usually be able to reply immediately
to communications. Due to the high numbers of complex referrals we have received in
recent months, it will in all likelihood take us 14-18 weeks (possibly longer) to complete the
review. Until your case is allocated to a colleague (currently I’m sorry to say taking 3 to 4
months), please contact me about any aspect and I will get back to you as soon as I can.
Please tell us if we should adjust our approach to communicate better with you.
We prefer email communications as they get to us directly (terrestrial post is referred on to
us by the DfT, adding time to the process). We will make any adjustment that we can to be
of assistance.

https://www.gov.uk/government/collections/independent-complaints-assessors-for-the-department-for-
transport

3

If you intend to write to us using Royal Mail it would be helpful to know in advance so we
can ask DfT staff to be sure to refer correspondence to us as soon as possible.
Yours sincerely

Jonathan Wigmore
Independent Complaints Assessor
Encl: Annex setting out ICA jurisdiction