Free Traffic Legal Advice

Does the email you received with the appeal rejection show or indicate that there were any attachments to it? If it can be used as evidence of the lying behaviour of UKPS, then it should be sent as additional evidence to a Step 2 complaint to the DVLA. Don't send the Step 2 complaint if you can show that the email you received shows or failed to show that there were any attachments, as I would have to amend the wording slightly.

To send the Step 2 complaint, you go through the same steps as for there initial complaint except that the web address is:

https://contact.dvla.gov.uk/head-of-complaints

Quote

Subject: Step 2 Escalation – Misuse of Personal Data and Deliberate Misrepresentation by UK Parking Solutions Ltd (UKPS)

Dear DVLA Head of Complaints,

I am writing to escalate my complaint regarding the misuse of my personal data by UK Parking Solutions Ltd (UKPS) to Step 2 of your complaints process.

This matter concerns not just technical breaches, but deliberate misrepresentation by a DVLA-approved KADOE user, acting in direct violation of the BPA/IPC Private Parking Single Code of Practice (PPSCoP) and the terms of the KADOE contract.

Background

As clarified in your Step 1 response, my data was not released to UKPS by the DVLA directly, but was passed to them via a Transfer of Liability by the vehicle’s registered keeper, Volkswagen Financial Services UK Ltd.

However, UKPS is a KADOE account holder, and the conditions of use attached to KADOE data access apply regardless of how the data was obtained. The purpose of the KADOE contract is to ensure that AOS members process personal data lawfully, proportionately, and in full compliance with the PPSCoP — including when pursuing charges via hirer liability under Schedule 4 to the Protection of Freedoms Act 2012 (PoFA).

Substance of the Complaint – Deliberate False Representation

UKPS issued a Notice to Hirer (NtH) which falsely states that it encloses all four documents required under Paragraph 13(2) of PoFA. In reality, none of these documents were enclosed. This was not an accidental omission — the covering page explicitly asserts that the documents are included, which makes this a deliberate misrepresentation.

This was not an isolated incident. UKPS has now repeated the false claim in their written response to my appeal. They stated that the Transfer of Liability was “attached,” when in fact nothing was enclosed. This is consistent with the earlier Notice to Hirer, which similarly claimed that four PoFA-mandated documents were included — when they were not. The repeated nature of these omissions, accompanied by false assertions that the documents were provided, demonstrates deliberate misrepresentation and unlawful data processing, not administrative error. This is a clear abuse of DVLA-sourced personal data, and one that warrants regulatory action.

The effect of this is that UKPS is:

• Asserting that the statutory requirements of PoFA have been met (when they haven’t);
• Knowingly processing personal data on a false legal basis;
• Misleading the recipient about their liability in order to extract payment.

This goes far beyond mere sloppiness. It is a calculated and mendacious act designed to fabricate the appearance of PoFA compliance and shift liability unlawfully.

If the DVLA accepts such conduct at face value, then it is allowing the integrity of the vehicle register to be undermined by rogue operators. The PPSCoP and KADOE contract become meaningless if operators can simply lie about their compliance and continue to access and process personal data without oversight or consequence.

Recommendation

Perhaps it is time the DVLA stops assuming that operators are acting in good faith and starts investigating whether they are, in fact, lying. I strongly suggest that the DVLA conduct a sting operation — for example, by hiring a vehicle and deliberately breaching a term in a car park operated by UKPS. The resulting NtH is likely to contain the same false assertion that the required documents are enclosed, when in reality they will not be. This would serve as hard proof that the breach is systemic and deliberate, not accidental.

Request

I am therefore asking the DVLA to:

• Investigate whether UKPS’s actions amount to a breach of the KADOE contract and PPSCoP;
• Determine whether the deliberate false assertion of PoFA compliance invalidates the legal basis for processing my personal data;
• Consider enforcement action including suspension or termination of KADOE access if breaches are established;
• Acknowledge that “self-certification” by operators is wholly inadequate when clear evidence exists of falsified statutory compliance.

Please confirm receipt of this escalation and provide a Step 2 complaint reference. I am happy to provide copies of the NtH and supporting evidence again if required.

Yours faithfully,

[Your Full Name]
[Original DVLA Complaint Date / Reference Number]

Subject: ICA complaint – misuse of keeper data by UKPS – DVLA handling failure [0404017-Y3Z3B]

Dear Independent Complaints Assessor,

I am escalating my complaint because the DVLA’s Step 2 reply (dated 9th June 2025) did not address the core issue: UK Parking Solutions Ltd (UKPS) misused my keeper data after obtaining it from the DVLA under the KADOE scheme.

The following four points highlight the DVLA's failures:

1. DVLA position:

“Reasonable cause” is judged only at the point of request.

Why the response is inadequate:

The KADOE contract is explicit that keeper data may be used solely “for the purpose of enforcement in accordance with the prevailing Code of Practice”. Once UKPS breached PPSCoP 8.1.1(d), their use of the data ceased to be lawful—even if the original request was valid.

2. DVLA position:

PoFA compliance is “not required”.

Why the response is inadequate:

Nobody argued it was. The complaint is that UKPS invoked PoFA in wording but failed to meet para 9(2)(f). Misrepresentation is data misuse. This point has been avoided altogether.

3. DVLA position:

“We do not arbitrate civil disputes.”

Why the response is inadequate:

I was not asking the DVLA to settle a parking dispute—only to enforce its own contract and data-protection duties when misuse is shown to have occurred, as it has in this instance.

4. DVLA position:

Cites the ICO Opinion (Jun 2022) to justify disclosure.

Why the response is inadequate:

The 'Opinion' expressly states that operators must comply with the Code. It does not excuse post-disclosure misuse which was the cause for the complaint in the first place.

Because the DVLA failed to engage with these four points, it failed to apply its own policies or consider enforcement action against UKPS. I therefore ask the ICA to review the DVLA’s handling of my complaint and recommend that the case is re-opened and referred to DVLA Enforcement & Compliance.

I attach:

• my original Step 1 and Step 2 submissions;
• the DVLA Step 2 response;
• a copy of the UKPS Notice to Keeper showing the PoFA 9(2)(f) omission.

Thank you for your consideration.

Yours sincerely,

[Your name]
[Date]

Subject: Clarification Requested: “Finance Agreement” vs “Hire Agreement” under PoFA – Complaint Ref: FLE-747262

Dear Jane Yaull,

Thank you for your final response to my complaint, reference FLE-747262.

I would like to request urgent clarification on one specific point before I consider escalation. In your response, you state:

“Our company policy does not permit us to share a copy of your finance agreement with private parking companies.”

Please confirm whether your reference to “finance agreement” refers to the hire agreement as defined in Paragraph 13(2)(b) of Schedule 4 to the Protection of Freedoms Act 2012 (PoFA).

As you are aware, PoFA requires the registered keeper (in this case, VWFS) to supply a copy of the hire agreement to the operator in order to lawfully transfer liability for a Parking Charge Notice. If your company’s policy is to refuse to provide the required documentation, then that policy is actively preventing PoFA compliance, and in effect denying customers the legal protections afforded to them under statute.

This raises serious concerns, especially if VWFS:

• Discloses hirer data to private operators (which is only lawful if PoFA requirements are met); and
• Then refuses to provide the very document that would lawfully transfer liability and protect the customer from being wrongfully pursued.

As your organisation is listed as a BVRLA member, I will also be seeking clarity from the BVRLA on whether your stated policy complies with the BVRLA’s own standards and guidance in relation to private parking charges and PoFA compliance.

Please confirm:

1. Whether you accept that this agreement constitutes a “hire agreement” for the purposes of PoFA Schedule 4 Paragraph 13.
2. Whether you accept that refusing to provide the document prevents lawful transfer of liability.
3. Whether you accept that disclosing the hirer’s personal data in such circumstances may breach the requirements of fair and lawful processing under UK GDPR and the Data Protection Act 2018.

Your prompt response will determine whether I now refer this matter to the Financial Ombudsman Service, the ICO, and the BVRLA.

Yours sincerely,

[Your Full Name]

(2)The creditor may not exercise the right under paragraph 4 to recover from the keeper any unpaid parking charges specified in the notice to keeper if, within the period of 28 days beginning with the day after that on which that notice was given, the creditor is given—

(a)a statement signed by or on behalf of the vehicle-hire firm to the effect that at the material time the vehicle was hired to a named person under a hire agreement;

(b)a copy of the hire agreement; and

(c)a copy of a statement of liability signed by the hirer under that hire agreement.