+1
You now have grounds for a complaint to the DVLA, based on the operator’s conduct in this case.
Here’s why:
1. Misuse or Misrepresentation of Data Accessed via the DVLAPrivate parking companies are granted access to DVLA vehicle keeper data under very strict conditions — namely, they must:
• Use the data only for the purpose of pursuing legitimate parking charges.
• Comply with the law, including the Protection of Freedoms Act 2012 (PoFA).
• Act truthfully and transparently when pursuing charges.
In your case:
• The parking operator issued a non-PoFA Notice to Keeper, meaning they could only pursue the driver, not the Keeper.
• Despite this, they pursued you — the Keeper — and then later falsely claimed that you had identified yourself as the driver, using unverifiable backend data.
• They attempted to construct a false narrative to mislead POPLA by using internal system notes that POPLA rightly rejected as unverified and inconsistent.
This conduct raises serious concerns about whether the operator is:
• Abusing their DVLA access by misusing Keeper data when they know they cannot lawfully pursue the Keeper.
• Failing to meet the "reasonable cause" requirement for accessing Keeper data under Regulation 27 of the Road Vehicles (Registration and Licensing) Regulations 2002.
2. Relevant Precedent for DVLA ComplaintsThe DVLA has, in the past, sanctioned operators for:
• Pursuing Keeper liability without complying with PoFA.
• Making misleading claims about liability.
• Using DVLA data when there was no legal basis to pursue the Keeper.
If a parking company accesses data and then knowingly misrepresents the legal position or falsely claims that a Keeper identified themselves as the driver — when the written appeal explicitly denies that — this is a breach the terms of their DVLA KADOE (Keeper at Date of Event) contract.
So, you have solid grounds to complain. The operator used DVLA Keeper data despite knowing they could not rely on PoFA, then tried to misrepresent the status of the appellant in bad faith. That is misuse of DVLA data access, and it undermines the purpose of the KADOE contract. A complaint could contribute to regulatory action or even suspension of DVLA access if part of a pattern.
Here’s how to make a DVLA complaint:
• Go to:
https://contact.dvla.gov.uk/complaints• Select: “Making a complaint or compliment about the
Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Civil Parking Office Ltd, an IPC Accredited Operator with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—through conduct that contravenes the PPSCoP—renders that use unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: Civil Parking Office Ltd
Date of PCN issue: [Insert date of PCN]
Vehicle registration: [Insert your VRM]
I am submitting this complaint to report a misuse of my personal data by Civil Parking Office Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although the parking company may have had reasonable cause to request my data initially, the way they used that data afterwards amounts to unlawful processing. This is because they acted in breach of the Private Parking Single Code of Practice (PPSCoP), which forms part of the framework that regulates how parking companies must behave once they have received keeper data from the DVLA.
The KADOE contract makes clear that keeper data may only be used to pursue an unpaid parking charge in line with the Code of Practice. If a parking company fails to comply with the PPSCoP after receiving DVLA data, their use of that data becomes unlawful, as they are no longer using it for a permitted purpose.
In this case, Civil Parking Office Ltd breached the PPSCoP in the following ways:
• They issued a Notice to Keeper that was not compliant with the Protection of Freedoms Act 2012 (PoFA), meaning they had no legal basis to pursue the Keeper if the driver was not identified.
• Despite this, they pursued me as the Keeper without evidence of who was driving.
• When challenged, they later claimed—falsely and without any reliable evidence—that I had identified myself as the driver during my appeal.
• They submitted backend system notes to POPLA as “proof” that I had selected the “driver” option, despite providing no metadata or verifiable audit trail to support this claim.
• Their own initial appeal rejection made no mention of me identifying as the driver, confirming that they had treated me as the Keeper at that time.
• Their behaviour was found to be misleading and lacking in evidence by the POPLA assessor, who upheld my appeal.
The POPLA assessor stated:
“I can also see that the appellant’s text within the appeal clearly states that they were appealing as the registered keeper of the vehicle... I cannot be satisfied that the snippet of information was from when the appellant’s appeal was submitted as they have not provided any identifiable information from when the appeal was made to show that it was put forward by the appellant.”
These actions demonstrate a serious breach of the PPSCoP and a misuse of DVLA data. The operator’s attempt to misrepresent my status and pursue the charge in bad faith shows a clear disregard for the standards required under the Code. As a result, Civil Parking Office Ltd is no longer entitled to use the keeper data they obtained from the DVLA, because the purpose for which it was provided—lawful pursuit of a parking charge under the Code—no longer applies.
The DVLA remains the Data Controller for the data it releases under KADOE, and is therefore responsible for ensuring that personal data is not misused by third parties. I am therefore asking the DVLA to investigate this breach and to take appropriate action under the terms of the KADOE contract.
This may include:
• Confirming that a breach has occurred
• Taking enforcement action against the operator
• Suspending or terminating their KADOE access if warranted
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
