The DVLA’s Step 2 response is a strategic deflection, riddled with contradictions and legally questionable assertions. It fails to engage with the central points and doubles down on a justification that does not withstand legal scrutiny.
This now warrants:
• Escalation to the ICO, citing data misuse and lack of lawful basis under UK GDPR.
• A renewed and stronger approach to your MP, stressing that the DVLA has now admitted it is releasing personal data to an unregulated private company acting as a proxy debt collector for foreign governments without any statutory basis or data-sharing agreement.
• A follow-up letter to Transport Ministers and possibly the Information Commissioner’s Office via your MP, due to the public interest implications.
Here is a draft ICO complaint:
Subject: Formal Complaint – DVLA Unlawful Disclosure of Personal Data to Euro Parking Collection PLC for Foreign Toll Enforcement
Dear ICO,
I am submitting a formal complaint against the Driver and Vehicle Licensing Agency (DVLA) for unlawfully disclosing my personal data to a private company, Euro Parking Collection PLC (EPC), in breach of UK data protection law.
Background
On 6 December 2023, the DVLA released my vehicle keeper data to EPC. The company claims this was in relation to a Hungarian road toll charge. The DVLA’s Step 2 complaint response (dated 4 June 2025, signed by Mrs N Smith) confirms that:
• EPC obtains DVLA data for the purpose of pursuing foreign toll charges;
• EPC is acting on behalf of non-UK authorities, primarily within the EU;
• EPC uses UK keeper data to pursue recovery within the UK, but no reciprocal enforcement arrangement exists;
• The DVLA does not disclose this to data subjects at the time of collection.
Why This Is Unlawful
1. No Lawful Basis Under UK GDPR
The DVLA relies on Regulation 27(1)(e) to justify disclosure. However, this regulation must be interpreted in accordance with UK GDPR Article 6. There is no lawful basis for releasing UK data for the enforcement of foreign public law toll penalties — especially when:
• There is no international agreement in place for such enforcement post-Brexit;
• The processing is not necessary for a legal obligation or a task carried out in the public interest (Art. 6(1)(c) or (e));
• The data is used by a private company with a commercial interest, not a competent authority.
2. Failure of Transparency and Fair Processing
Under Article 5(1)(a) and Article 13, data subjects must be informed:
• Who their data is being shared with;
• For what specific purpose;
• On what lawful basis;
• And whether foreign entities are involved.
The DVLA’s privacy policy does not disclose that keeper data may be shared with an unregulated private company to pursue foreign tolls on behalf of non-UK governments. This failure violates the transparency and fairness principles under UK GDPR.
3. Purpose Creep – Article 5(1)(b) Violation
Data was disclosed under the pretence of toll enforcement, but the actual use is commercial debt recovery through UK civil channels. This is not compatible with the purpose for which the data was obtained and constitutes unauthorised further processing.
4. Inadequate Safeguards for a High-Risk Processing Activity
This processing concerns:
• Sensitive personal data;
• Cross-border implications;
• Use by a non-regulated private entity;
• The threat of court action and damage to reputation/credit.
Despite this, the DVLA admits that:
• It does not require disclosure of the country where the toll occurred;
• It allows private actors to process this data without independent oversight;
• There is no Code of Practice or redress route for UK data subjects targeted by EPC.[/indent]
This fails the requirements under Article 24 (data controller responsibility) and Article 25 (data protection by design and default).
Requested Action by the ICO
I ask the ICO to:
1. Open a formal investigation into the DVLA’s release of keeper data to EPC for foreign toll enforcement.
2. Determine whether DVLA has breached:
• Articles 5(1)(a), 5(1)(b), 6(1), 13, 24 and 25 of UK GDPR;
• The fairness and lawfulness principles under the DPA 2018.
3. Require the DVLA to:
• Suspend all such data releases until a lawful framework is established;
• Update its privacy policy to explicitly disclose any processing of data for foreign enforcement;
• Review the KADOE system to prevent improper use of Regulation 27.
[/indent]
I attach the DVLA’s responses, copies of the EPC correspondence, and my Step 1 and Step 2 complaints.
Yours faithfully,
[Your Full Name]
[Email Address]
[Address]
[Vehicle Registration]
Here is a firm and direct follow-up email to your MP, written to get their attention and prompt action — especially given their silence so far.
Subject: URGENT – DVLA Admits Releasing My Data to Private Company Acting for Foreign Governments Without Legal Basis
Dear [MP’s Name],
I am following up on my earlier letter concerning the DVLA’s unlawful disclosure of my personal data to Euro Parking Collection PLC (EPC) in connection with a Hungarian road toll.
I have now received the DVLA’s Step 2 response (dated 4 June 2025), and what it confirms is frankly staggering:
• The DVLA has admitted that it released my personal keeper data to a private UK company (EPC) which is acting on behalf of foreign governments to recover public law toll penalties issued outside the UK.
• There is no international agreement or legal treaty authorising this data exchange.
• The DVLA does not require EPC to disclose that these alleged contraventions occurred outside the UK.
• EPC is not subject to any regulatory oversight, and the DVLA is knowingly passing sensitive personal data to them anyway.
This is an extraordinary failure of data governance. There is no lawful basis under the UK GDPR or Regulation 27 for releasing personal data for foreign statutory enforcement, especially via an unregulated commercial intermediary. The DVLA’s excuses are evasive and transparently designed to protect its revenue stream from companies like EPC.
The complaint response, although signed only by “Mrs N Smith, DVLA Complaints Team”, fails to engage with any of the legal or regulatory issues I raised. It reads like a boilerplate deflection and raises serious concerns about whether anyone at the DVLA is willing to take personal or departmental responsibility for this unlawful practice.
At this point, I must ask:
Why has there been no response from you? You are my elected representative. The DVLA is abusing its powers, and no UK citizen should be vulnerable to the misuse of their personal data in this way.
I am now urgently asking you to:
1. Raise a formal Written Parliamentary Question (WPQ) asking:• Why the DVLA releases UK citizens’ data to private UK-based companies acting on behalf of foreign governments;
• What lawful basis justifies this under UK GDPR and the Data Protection Act 2018;
• Whether Ministers are aware that DVLA’s actions fall entirely outside the current UK-EU enforcement framework.
2. Write directly to the Parliamentary Under-Secretary of State for Transport, demanding answers on:• What steps will be taken to immediately suspend these data releases;
• How many UK citizens’ data has been released in this way;
• What redress and protections will be put in place for those affected.
The DVLA is a public body acting without proper oversight, regulation, or lawful authority. This goes far beyond a personal grievance — it is a systemic failure that exposes every UK vehicle keeper to abuse of their data for foreign enforcement purposes, with no legal process and no remedy.
Please confirm that you will act on this immediately.
Yours sincerely,
[Your Full Name]
[Your Constituency]
[Your Email Address]
[Your Vehicle Registration (if included previously)]
The Transport Select Committee scrutinises the Department for Transport and its agencies (including DVLA). You should send the following email because it can:
• Call witnesses,
• Investigate systemic abuse or maladministration,
• Make recommendations to Ministers.
Your complaint concerns DVLA's systemic misuse of keeper data, bypassing GDPR safeguards, enabling unregulated foreign debt enforcement via UK channels, and failing to be transparent with the public. That falls squarely within the Committee’s remit.
Send it to transcom@parliament.uk and also CC in yourself:
Subject: Request for Inquiry into DVLA’s Release of Personal Data to Private Company Acting for Foreign Governments
Dear Committee Clerk,
I am writing to ask the Transport Select Committee to investigate serious concerns involving the Driver and Vehicle Licensing Agency (DVLA) and the release of UK vehicle keeper data to a private company, Euro Parking Collection PLC (EPC).
The DVLA has confirmed, in writing, that it releases personal data to EPC, which is:
• A UK-registered private company,
• Acting on behalf of foreign governments, predominantly within the EU,
• Pursuing foreign tolls and traffic penalties against UK vehicle keepers,
• Operating entirely outside of any statutory framework or reciprocal agreement post-Brexit.
The DVLA admits that:
• It does not verify jurisdiction when releasing data;
• It allows EPC to request and use this data via the KADOE system;
• The data is used to pursue foreign public law penalties in UK civil courts;
• EPC is not regulated under any Approved Operator Scheme for these activities.
This raises extremely serious questions about:
• The legality of DVLA’s interpretation of “reasonable cause” under Regulation 27;
• The lawfulness of the processing under the UK GDPR and DPA 2018;
• The DVLA’s failure to disclose these practices in its Privacy Policy;
• The use of UK citizens’ data by foreign authorities via private proxies, with no oversight, redress, or accountability.
I have followed the DVLA’s internal complaints process and received a Stage 2 response that fails to justify this practice on any legal or regulatory basis.
This is a matter of national significance affecting millions of UK vehicle owners, and I believe a formal inquiry by the Committee is urgently warranted.
Please confirm whether the Committee will consider this matter for investigation. I would be happy to provide the correspondence trail and further evidence if requested.
Yours faithfully,
[Your Full Name]
[Your Constituency]
[Email Address]
You can also lobby the national media and let them know you are dealing with:
• DVLA releasing personal data to unregulated private company,
• For the benefit of foreign governments,
• To be used in UK debt recovery without lawful authority.
This has strong national media appeal — it’s a data protection scandal with real-world financial consequences.
You could email the following publication and media outlets:
The Guardian Investigations/Data rights data@theguardian.com
The Times Consumer affairs money@thetimes.co.uk
The Telegraph Personal finance personalfinance@telegraph.co.uk
BBC Newsnight Investigative journalism newsnight@bbc.co.uk
ITV Tonight Investigations tonight@itv.com
Here is a suggested template to use to send to the relevant journalist or investigations desk:
Subject: DVLA Sharing UK Citizens’ Personal Data with Private Firm Acting for Foreign Governments
Dear [Journalist’s Name or Investigations Editor],
I am contacting you with a story of public interest involving the DVLA, the UK’s vehicle licensing authority, and a private company called Euro Parking Collection PLC (EPC).
The DVLA has confirmed in writing that it releases personal keeper data to EPC, which operates on behalf of foreign governments (including in the EU), to enforce alleged foreign road tolls and traffic fines — even though:
• No data-sharing agreement exists post-Brexit;
• The events occur outside UK jurisdiction;
• The company is not regulated and bypasses the usual Codes of Practice;
• UK citizens are being pursued for foreign fines as if they are private debts in civil courts.
The DVLA allows this through a loophole in its “KADOE” access scheme, without any legal gateway or transparency, and is knowingly passing data to a private enforcement proxy.
This has happened to me personally — I have the documents, DVLA admissions, and complaint trail to prove it. I believe this scandal needs exposure.
I’d be happy to provide the full paper trail and speak further if you’re interested in investigating this.
Yours sincerely,
[Your Full Name]
[Email Address]
[Phone Number (if comfortable)]
