The SAR response from ParkingEye appears deficient and may well breach Article 15 of the UK GDPR, particularly the subsections you've quoted. Your reading is correct, and your position is well-grounded.
That's a precise, assertive, and well-targeted follow-up. You've clearly invoked the relevant provisions of Article 15 UK GDPR, left no room for obfuscation, and refused to accept their website deflection — which is entirely appropriate.
However, let’s pause for a minute and recalibrate — the original and primary complaint to the DVLA which is about the misuse of keeper data obtained under KADOE, and everything else (SAR failings, GDPR violations) is secondary to that root breach.
ParkingEye had reasonable cause to request the keeper’s data from the DVLA under the terms of the KADOE contract, but only for the purpose of pursuing the Keeper where it is legally allowed. They then issued a Notice to Keeper under PoFA, despite knowing two key facts: first, that the keeper lives in Scotland, and second, that PoFA does not apply to Scottish keepers, even when the alleged contravention took place in England.
By doing this, ParkingEye breached clause 8.1.1(d) of the Private Parking Single Code of Practice, which basically says PoFA notices must not be sent to Scottish addresses. They also breached their KADOE agreement with the DVLA, which only allows use of keeper data in line with the law and the Code of Practice.
This is not a borderline case. It is a clear breach of purpose and an unlawful use of data, both under contract and under regulation.
As for the SAR, it does have a role because it shows what ParkingEye sent to the DVLA. It may also show if they misrepresented your appeal or withheld key attachments, which could further support the DVLA complaint. However, the SAR issues are secondary and should not be allowed to distract from the main point, which is the unlawful use of DVLA data through the issuing of a PoFA notice to a Scottish keeper.
To summarise: the DVLA complaint should focus on the fact that ParkingEye wrongly issued a PoFA-style Notice to Keeper to someone in Scotland. This means they used the DVLA data for a purpose that is not allowed under the KADOE agreement, they broke the Code of Practice, and they failed to meet the conditions for processing data under the UK GDPR. If they had issued a non-PoFA notice instead, there would not be an issue, as they would have to pursue the driver, not the keeper. But they didn’t.
I suggest a follow up to the DVLA complaint with a reference to the SAR issue and concerns that ParkingEye may have withheld key information from the DVLA during their handling of your original complaint:
To the DVLA Data Sharing Team/Head of Complaints,
I am writing to follow up on my earlier complaint about ParkingEye Ltd’s misuse of keeper data obtained under the KADOE agreement.
ParkingEye issued a Notice to Keeper under the Protection of Freedoms Act (PoFA) to a Scottish address, even though they knew that PoFA does not apply to Scottish residents. This action breaches Section 8.1.1(d) of the Private Parking Single Code of Practice, which states that a parking operator must not serve a notice or include material on its website which in its design or language states that the keeper is liable under PoFA where they cannot be held liable. It therefore breaches the KADOE agreement, which requires that keeper data obtained from the DVLA must only be used in accordance with relevant law and the approved Code of Practice.
If ParkingEye had issued a standard non-PoFA notice, this would not have been a problem, because they would have had to pursue the driver rather than the keeper. Instead, they used DVLA data to issue a document that falsely suggested the keeper could be held liable — something which is not legally possible under PoFA for someone residing in Scotland. This is not a minor error. It is a deliberate misuse of data and a misleading attempt to pressure a keeper into payment based on a legal framework that does not apply.
I also wish to raise concerns about how ParkingEye responded to the DVLA’s inquiry into my original complaint. I have now received a copy of ParkingEye’s internal correspondence and documents through a Subject Access Request. Based on what they disclosed, it appears they may have withheld important information when replying to the DVLA. For example, ParkingEye sent the DVLA an email with a .zip file attachment, but they have not told me what was in that file. If it included a copy of my appeal, as seems likely, they failed to explain or disclose this clearly in their SAR response. Additionally, they redacted the names and email addresses of individuals involved and concealed who else was copied into their reply to the DVLA — meaning I do not have a full record of who has seen or handled my data.
This raises serious questions about transparency and whether the DVLA received full and accurate information during its initial investigation. I ask that you reopen or review this matter in light of these concerns, and treat this as an escalation of my original complaint.
Yours sincerely,
[Your Name]
[Address]
[Email]
Vehicle Registration: [VRM]
Date: [Insert]
