The DVLA and the Data Protection act

[THE DVLA Man]

I'm about to send this to the Minister of Transport and would like some opinions. I have the letters I refer to but as they are in JPeg I can't post them.

***********************************

Letter to the Minister of Transport.

 

Some time ago I sent an email to Geoffrey William Hoon MP. the then Secretary of State for Transport regarding the DVLA at Swansea appearing to be breaking the Data Protection Act by giving out personnel details for an “Administration Fee”.

He handed the problem on to the DVLA at Swansea to answer me.

I had a letter from Clair Morgan Policy Casework and Advice at the DVLA that was at best disgraceful.

 

I suggest you read her letters to me (attached) as I’m sure you will not be satisfied with her explanations.

To give you some pointers, the first letter says “The DVLA takes very seriously its duty under the data protection act (DPA) to protect the privacy of motorists whose details it holds for the purposes of registering and licensing vehicles, and to comply with the acts guiding principles. It goes on to say the act exempts from its non-disclosure provisions the release of personal data where the law allows it and the DVLA is not in a position to refuse those who have a legitimate right to receive information, the optimum word in the paragraph is “Legitimate”.

 

The problem is, the letter states:-

Reasonable cause is not defined in law but the DVLA considers that pursuing civil claims in relation to car parking a “Reasonable Cause”.

The optimum words in this statement are “The DVLA considers”.

The DVLA give out personal data to companies without checking if the company concerned in pursuing the civil claim have followed simple rules regarding clear and well positioned signs etc.

All a company have to do is fill in a form and belong to an appropriate body.

The DVLA is not a government body to consider items of law it is there to carry out the law.

I feel the DVLA are giving out personal information to which they have no control, to explain. In my case I proved the fine levied on me was illegal on the grounds of insufficient signage.

The DVLA’s answer to this question:-

They carry out “Ad Hoc” inspections and according to the attached letter in April 2008 to March 2009 - 64 (Sixty Four) audit visits were carried out on private companies with 128 audit inspections on other government departments/local authorities. This I believe is not the way a public body should be acting they can’t be checking on the companies they are giving the information to, I wouldn’t have been illegally fined if they had.

If a BBC Television programme I watched is correct and I have no reason to disbelieve it, the DVLA charge £5,000000 (Five Million Pounds) for administration as they put it to give out personal data, this would evaluate to 2.000000 (Two Million) personal details being given out at a cost of £2.50 each but the DVLA did only 64 (Sixty Four) audits.

I hesitate to think what the audit consists of but would assume it doesn’t take into consideration if the company they are giving the information to comply with the most simple traffic rules the main one being clear and well placed signing.

I believe companies should have to prove/give evidence of why they require personal data.

The letter from Clair Morgan Policy Casework and Advice (Attached) also states, the DVLA are now sending out personal details by an “Electronic Link” in other words they have lost control of personal data and without proper controls in place I would guess they are in breach of the Data Protection Act.

 

The letter states “Individuals have a responsibility to comply with “Road Traffic” and other regulations when using a vehicle”.

Isn’t it about time the DVLA made sure the companies they are giving personal date to also comply with “Road Traffic” regulations?

I was fined by a major company “Vinci”; I appealed but was turned down on the grounds of “Adequate Signage”, it was only on the intervention of Tesco the company that employed Vinci that they dropped the charge as there wasn’t adequate signage but they had already received (If what I’m led to believe by the DVLA) my personal details and now I have no idea what Vinci have done with them as apart from the refusal to my appeal I have had no correspondence from Vinci.

 

Vinci and many more companies threaten they will put the public’s details they acquire from the DVLA in the hands of a “Debt Collection Agency” with all the creditability problems that would entail.

Clair Morgan believes this to be “Bailiffs” but I believe it could be anyone.

My fine was an un-just fine and to make the matter worse although the signs at Tesco have been changed they are still referring to “Debt Collection Agency’s and un-readable “Terms and Conditions”. If a major company like Tesco employ a major company like Vinci and neither of these companies can get it right, then there is something fundamentally wrong with the DVLA and the way they safeguard the public’s personal details.

The DVLA in the guise of Clair Morgan Policy Casework and Advice, advised me to go to the BPA and “Take it up with them”, this I believe is ludicrous as the BPA are there to help companies their customers not the general public.

In fact I went on to the BPA web site and this is what it said:-

“Please note that the BPA is not set up to deal with complaints from members of the public regarding parking, ticketing and or/vehicle immobilization”.

Again Clair Morgan needs to look again at the information she is giving out.

 

With “Identity Fraud” in mind, we as a family take particular care of our personal details. Not one item identifying us leaves our home it is shredded.

If the DVLA took as much care as we do in protecting data then I believe they would be complying with the Data Protection Act but it appears they don’t.

Conclusion.

The DVLA Should charge say £10.00 for the data but before it is released they would have to check signs, etc.

This I believe would stop the cowboy operators.

Edited August 2, 2009 by THE DVLA Man
To add a foot note

[Jamberson]

I think you raise some excellent points, in particular the apparent lack of vetting as to which companies can receive personal data, and also what they subsequently do with it.

 

I am not convinced by the statement they gave you which says certain bodies are exempt from non-disclosure... but then mentions being unable to refuse those with a legitimate right. Where in law is there a "right" to this info? Surely it is supplied at DVLA's discretion - in which case they have an absolute right to withhold it if they want to.

 

By the way, I think the letter is a bit long - maybe you could condense it a little?

 

Best of luck.

[rickyd]

This is an old chestnut but well done for raising the issue. Andrew Neil discussed this on his late night TV show with Daine Abbott and Michael Portillo and all three agreed that the DVLA does not have the right to disclose date entrusted to them to third parties. The only way they are legitimately allowed to disclose RK and driver information is via the police.

 

They all thought that this scheme is nothing more than a cash cow for the DVLA, which it clearly is, but that the difficulty we faced is in proving who leaked the data in the first place.

 

The suggestion was that if we felt strongly about it, we should write to our MP to raise the issue in the house and that this all goes to show that the government cannot be trusted to contain personal data, especially where there's money to be made.

 

The problem is that the reason we would be writing was probably to complain that our data had been divulged to a parking compnay etc and that we were doing it to escape from any penalty we may face rather than because we felt it was morally wrong or even illegal.

[green_and_mean]

This is an old chestnut but well done for raising the issue. Andrew Neil discussed this on his late night TV show with Daine Abbott and Michael Portillo and all three agreed that the DVLA does not have the right to disclose date entrusted to them to third parties. The only way they are legitimately allowed to disclose RK and driver information is via the police.

 

Not true, the The Road Vehicles (Registration and Licensing) Regulations 2002 gives the DVLA authority to release details to:

 

(a) by a local authority for any purpose connected with the investigation of an offence or of a decriminalised parking contravention;

 

(b) by a chief officer of police;

 

© by a member of the Police Service of Northern Ireland;

 

(d) by an officer of Customs and Excise in Northern Ireland; or

 

(e) by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him.

[rickyd]

Wow - thanks for that. I've just checked it out on DVLA's own website and it seems there's no end to the list of people who have been able to show "reasonable cause" and pay the fee. Unbelievable!

 

And they wonder why some people don't complete V5's when they buy cars....

[Al27]

You might want to rethink the wording about Vinci. They are not fines, they are unenforceable charges for alleged breach of contract dressed up as legitimate fines. Such companies frequently breach the 2006 Fraud Act and Consumer Protection From Unfair Consumer Regulations 2008.

 

You're also lending too much credence to their 'appeals' process. There is no such thing.

 

Conclusion.

The DVLA Should charge say £10.00 for the data but before it is released they would have to check signs, etc.

This I believe would stop the cowboy operators.

 

Doesn't this just go against your point that they are breaching data protection? It's no different if the charge is £10. All the cowboys would do would be up their charges by £10.