Parking fines: DVLA breached law over sharing drivers’ details

Agency could face compensation claims after data watchdog rules it applied wrong part of the law

The Driver and Vehicle Licensing Agency (DVLA) breached data protection laws in the way it passed on motorists’ personal details to private parking firms, the UK’s data watchdog has ruled. It could now potentially face compensation claims from motorists as a result, according to one expert.

The Information Commissioner’s Office (ICO) has decided the DVLA “was not using the correct lawful basis to disclose vehicle keeper information”, Guardian Money can reveal.

However, the Swansea-based government agency – which holds more than 49m driver records – has escaped enforcement action after the watchdog concluded the breach was “a technical infringement of the law”. It said the DVLA was still allowed to disclose people’s information to firms pursuing drivers for unpaid parking fines but that it needed to rely on another part of the legislation for doing this.

The ICO’s opinion – published on its website but not publicised – potentially brings some clarity to a long-running row concerning the way the DVLA shares driver information with third parties.

Parking firms pursuing motorists will often approach the DVLA to get hold of their addresses. Under the law, the organisation is permitted to disclose this information where there is “reasonable cause” to do so – for example, where it is requested for the purposes of recovering unpaid parking charges.

However, the ICO has over the years received a number of complaints from motorists angry about having their details passed on.

They include Paul Walton, who submitted his complaint after receiving a parking ticket from a firm that had requested his details from the DVLA.

“I complained to the DVLA because I thought it was the landowner that could sue under trespass laws, and therefore only they could request my data,” he said.

Walton claimed the organisation had failed to properly deal with his grievance, so in 2018 he asked the data watchdog to intervene.

The Guardian only learned that the ICO’s opinion dated 13 June had been quietly added to its website after Walton contacted us to say he had had a letter from the ICO.

In its opinion, the watchdog said it had concluded the DVLA was not using the correct lawful basis to disclose people’s data but added: “This does not mean that no lawful basis existed.” There are six of these available for processing personal data, and one of the others provided the DVLA with the power to share people’s details, it added.

The ICO said its decision did not mean people’s parking fines were invalid, and it suggested the government should review the law in this area to put the issue beyond doubt.

However, in a separate document aimed at companies and organisations that deal with data, the ICO stated: “If you find at a later date that your chosen [lawful] basis was actually inappropriate, it will be difficult to simply swap to a different one.” It added: “Retrospectively switching lawful basis is likely to be inherently unfair to the individual and lead to breaches of accountability and transparency requirements.”

That suggests that changing your lawful basis could be seen to cause harm.

Walton said: “It would appear the DVLA have not complied with data protection laws and may have opened themselves up to possible compensation claims.”

The parking expert and author Scott Dixon said: “By using the wrong lawful basis, it cannot be disputed that the DVLA has breached the UK GDPR Data Protection Act 2018.

“Motorists have suffered a serious detriment by the DVLA’s unlawful actions … This is not a technical infringement. This ruling contradicts what the ICO says within their own guidelines for organisations to adhere to.

“I believe motorists are entitled to compensation from the DVLA, as they have suffered detriment as a result of the DVLA using the wrong lawful basis and wrongly using their powers within the scope of the UK GDPR Data Protection Act 2018.”

The ICO cannot award compensation. However, the law gives people the right to claim compensation from an organisation if they have suffered “damage” – which could include “distress” – as a result of it breaching data legislation.

An ICO spokesperson said it had concluded that the risk of harm to motorists from the DVLA disclosing data under the “legal obligation” rather than “public task” lawful basis was very low. Asked why the ICO had apparently not publicised the decision, they said: “We published the opinion on our website and wrote to the individuals who brought complaints to us advising them of the outcome.”

A DVLA spokesperson told us: “There is no doubt, as confirmed by the ICO … that the release of data to private parking firms is lawful. The ICO’s opinion reflects a legal technicality around processing conditions, and also acknowledges it will make no difference to the outcome of data sharing. This has no bearing on the release of data, nor does it affect customers in any way.”


Rupert Jones

The GuardianTramp

Related Content

Article image
‘The service is appalling’: drivers face holdups as DVLA fails to send licences
Readers say their lives have been put on hold because of delays at the government agency

Miles Brignall

26, Jun, 2021 @11:00 AM

Article image
DVLA delays: call for licence extensions as complaints flood in
Government urged to step in and resolve backlog in applications or ensure motorists’ ID is returned

Miles Brignall

03, Jul, 2021 @6:00 AM

Article image
Motorists in a jam as Covid-19 leaves them waiting months for DVLA documents
Car owners unsure if they can legally drive because of application backlog

Miles Brignall and Rebecca Smithers

01, Aug, 2020 @6:00 AM

Article image
Driver fights battle over parking fines at mother’s house
Case comes as government withdraws code aimed at giving better protection to motorists

Rupert Jones

23, Jul, 2022 @10:00 AM

Article image
Why did the DVLA go into communication lockdown?
I have tried to get my car logbook sorted with the driving agency but there’s no way to get through

Rebecca Smithers

27, Jul, 2020 @6:00 AM

Article image
I got more than £600 in parking fines from using Zipcar Flex
The car-sharing company insisted I was liable and the rules were clear on its app

Rebecca Smithers

20, Jan, 2020 @7:00 AM

Article image
DVLA failed to reply after my partner passed away
I needed to register the car in my name but I faced a series of delays

Rebecca Smithers

22, Sep, 2020 @6:00 AM

Article image
DVLA fined us £354 after we scrapped our Nissan
We thought we had filled in all the paperwork correctly but that has made no difference

Zoe Wood

07, Nov, 2022 @7:00 AM

Article image
How can we get my son’s provisional driving licence from the DVLA?
We applied two-and-a-half months ago, and we don’t understand why it is taking so long

Miles Brignall

16, Nov, 2021 @7:00 AM

Article image
Is this Britain’s most ridiculous parking fine?
Shoppers were charged £60 after parking outside Starbucks but going next door to McDonald’s in the same Stansted park

Miles Brignall

10, Nov, 2018 @7:00 AM