There is a credible argument that ParkingEye may have breached data protection principles by disclosing the content of your appeal to the DVLA without a lawful basis.
While the DVLA is the data controller for the keeper data it provides under the KADOE contract, it is not a party to the dispute between you and the private parking operator, nor is it an adjudicator or regulator of dispute content. Disclosing information from your appeal to the DVLA probably constitutes unlawful further processing under UK GDPR, particularly if the content of your message was not necessary or proportionate to the DVLA’s inquiry.
Key issues to consider:
there is a credible argument that ParkingEye may have breached data protection principles by disclosing the content of your appeal to the DVLA without a lawful basis.
While the DVLA is the data controller for the keeper data it provides under the KADOE contract, it is not a party to the dispute between you and the private parking operator, nor is it an adjudicator or regulator of dispute content. Disclosing information from your appeal to the DVLA may constitute unlawful further processing under UK GDPR, particularly if the content of your message was not necessary or proportionate to the DVLA’s inquiry.
Key issues to consider:
1. Purpose Limitation (UK GDPR Article 5(1)(b))
Data collected from you for the purposes of handling a parking appeal must not be repurposed arbitrarily. The DVLA’s investigation is into the lawful use of keeper data, not the substance of any appeal. Disclosing your appeal content risks breaching this principle unless the disclosure was strictly necessary and justified.
2. Data Minimisation (Article 5(1)(c))
Even if ParkingEye considered it appropriate to respond to a DVLA inquiry, they should have disclosed only what was necessary. Quoting or paraphrasing your appeal content goes beyond verifying that an appeal was received.
3. Confidentiality and Fairness
You were not told that appeal content might be shared with third parties outside the appeal process. This kind of disclosure, particularly to a non-judicial body, may also infringe your Article 8 ECHR privacy rights and breach the transparency obligations under Articles 12–14 of the UK GDPR.
4. Lack of Legal Basis
There’s no clear legal basis (Article 6(1)) under the UK GDPR for disclosing your statements to the DVLA unless:
You consented (which you didn’t), or
It was necessary for legal obligations, contracts, or legitimate interests, none of which obviously apply here.
Data collected from you for the purposes of handling a parking appeal must not be repurposed arbitrarily. The DVLA’s investigation is into the lawful use of keeper data, not the substance of any appeal. Disclosing your appeal content risks breaching this principle unless the disclosure was strictly necessary and justified.
2. Data Minimisation (Article 5(1)(c))Even if ParkingEye considered it appropriate to respond to a DVLA inquiry, they should have disclosed only what was necessary. Quoting or paraphrasing your appeal content goes beyond verifying that an appeal was received.
3. Confidentiality and FairnessYou were not told that appeal content might be shared with third parties outside the appeal process. This kind of disclosure, particularly to a non-judicial body, may also infringe your Article 8 ECHR privacy rights and breach the transparency obligations under Articles 12–14 of the UK GDPR.
4. Lack of Legal BasisThere’s no clear legal basis (Article 6(1)) under the UK GDPR for disclosing your statements to the DVLA unless:
• You consented (which you didn’t), or
• It was necessary for legal obligations, contracts, or legitimate interests, none of which obviously apply here.
If you've not sent the stage two complaint yet, I suggest you add the following paragraph:
Additionally, I must raise a data protection concern regarding ParkingEye’s response to your internal inquiry. Your Step One reply states that “ParkingEye have advised that they received an appeal stating that you would not identify the driver of the vehicle at the time.” This amounts to ParkingEye disclosing the content of my private appeal to a third party (the DVLA), despite the DVLA not being a party to the dispute. This disclosure was made without my knowledge or consent and was not necessary for the DVLA to determine whether there had been a breach of the KADOE contract. Such a disclosure likely contravenes the principles of data minimisation and purpose limitation under UK GDPR Article 5(1)(b) and (c), and I reserve the right to raise this matter separately with the Information Commissioner’s Office (ICO) if necessary.
