Free Traffic Legal Advice

FORMAL COMPLAINT – STEP 2 ESCALATION

Misuse of DVLA Keeper Data by Parking Control Management (UK) Ltd (PCM)

To: DVLA Data Assurance Team – Step 2 Complaints

[Insert Date]

Dear Sir/Madam,

I am writing to escalate my formal complaint regarding the improper KADOE data request made by Parking Control Management (UK) Ltd (PCM), which was inadequately addressed in your Step 1 response dated [insert date].

Summary of Step 1 Response

Your reply, signed by Mrs L J Mallabum, claims that PCM had "reasonable cause" to request my data because I did not identify the driver in my appeal, and that Schedule 4 of the Protection of Freedoms Act 2012 (PoFA) does not prevent access to DVLA data if the operator decides to pursue under the pre-PoFA common law position.

With respect, this reply fails to address the crux of my complaint: PCM already possessed the very same keeper data they subsequently requested from the DVLA, which means the KADOE access served no necessary or proportionate purpose. This is not a question of PoFA compliance, but of unlawful duplicate data acquisition contrary to both:

• the KADOE Contract, which only permits data requests when “necessary for the purpose of enforcing an unpaid parking charge,” and
• the UK General Data Protection Regulation (UK GDPR), Article 5(1)(c), which mandates the principle of data minimisation.

Misrepresentation of Appeal Rights

Your response accepts PCM’s explanation that only the driver could appeal following a Notice to Driver (NtD). This is incorrect and misrepresents the position under both the BPA/IPC Private Parking Single Code of Practice (PPSCoP) and prior BPA/IPC guidance. A representation made by a registered keeper is a valid appeal, and an ATA member must consider it fairly.

It is concerning that the DVLA accepts as “reasonable cause” a request for personal data based on a process that was itself unfair, obstructive, and non-compliant. PCM’s refusal to consider a valid appeal submitted by the registered keeper does not give rise to a legitimate need to request the same keeper data already held.

No Enforcement Purpose Satisfied

Your reply focuses on the theoretical right of an operator to pursue a charge outside of PoFA if the NtK is not served within 14 days. However, this point is irrelevant because:

1. PCM already had my name and address, willingly provided by me in a valid appeal.
2. There was no enforcement need or lawful basis for a duplicate acquisition of identical data via KADOE.
3. The DVLA’s own contract prohibits data requests unless strict necessity for enforcement is established.

The issuing of a Notice to Keeper to a party who has already submitted all required information voluntarily is not an enforcement activity. It is an administrative duplication used solely to bypass the appeal stage and continue the PCN process, in direct conflict with the expectations of fair processing.

Relief Sought

I respectfully request the following:

1. A proper review of whether PCM’s KADOE request complied with the necessity threshold in the KADOE contract and data minimisation under UK GDPR;
2. Confirmation of whether DVLA agrees that operators may request keeper data even when they already hold that same data, and if so, the legal basis under the UK GDPR;
3. A full explanation as to why DVLA accepts a non-compliant refusal to engage with a keeper appeal as grounds to then access keeper data already provided;
4. Confirmation of whether DVLA will be referring this incident to the Information Commissioner’s Office (ICO) for an independent assessment.

Should this Step 2 response not resolve the matter, I will escalate my concerns to my MP and the ICO, as I believe this situation constitutes a clear misuse of personal data and a breach of statutory obligations.

I would appreciate an acknowledgment of this Step 2 complaint and a timeframe for your full response.

Yours faithfully,

[Full Name]
[Postal Address]
[Email Address]
[Phone Number]