Simple questions. Can the DVLA still give out your details without your express permission? - New Data Protection laws

[Surfer01]

Simple questions. Can the DVLA still give out your details without your express permission? Will it have any impact on PPC's and the way they handled data?

Edited May 25, 2018 by DragonFly1967
Edited PPI to PPC

[sgtbush]

It could impact on parking company's but no differently than the DPA did.

They can give out information pertaining to legal cases.

 

Are they valid in the cases?

It would take a judicial enquiry to establish that.

 

Will they stop (dvla)

I cant see it as its a big revenue earner for them.

[ericsbrother]

wont affect the DVLAdirectly but any parking co that doesnt follow the protocols of the POFA and applies for your details too late or under the wrong circumstances will be in bigger bother, especially if they then pass on your data to one of the pond life dca's

That may actually create a liability for the DVLA where at the moment they can claim that they have a quality control system theat keeps them out of trouble. I have read what that consists of and it is a spot check on a parking co with prior warning and no requirment to show any evidence that the parking co is telling the truth, just their word that they are.

[Surfer01]

Actually passing on your data to any DCA under any circumstances without your permission could be an issue for many organisations where you have not signed any T&Cs i.e Shop card or account. The question now is if a PPC can pass on your details to a DCA for a civil matter?

[ericsbrother]

under the DPA it is allowable. With the new regs there is an increased burden of proof regarding the debt but still allowable in principle. What you have is a right to tell them not to bother you

[Surfer01]

f the debt is disputed you have always had the right to tell the DCA to get knotted! It would be nice if the new regs on Data Protection really messed up the PPCs. Surely when you register a vehicle you don't automatically give the right to the DVLA to sell on your data to anyone that asks for the data like a PPC and where it does not involve a criminal matter?

[sgtbush]

As above.

That's why I said for a legal claim.

Now that's why I said a judicial review to see if a civil claim would stand up to this burden of proof.

 

 

Going off at a tangent I've just had a company In meltdown as they rang me and were trying to confirm details for security. ( I was expecting the call and recognized the number and even the person dealing with me)

At the end of it she said "the call is being recorded for training and security purposes" I said I dont give consent under the new data laws.

They had to turn it off even tho I told them I'm recording the call

[DragonFly1967]

At 00:05 this morning. I sent GDPA SAR's to Highview, Desperate Recovery Pass, UKPC and SCS Law.

 

Surprisingly, Desperate Recovery Pass read that email at 01:35 (so I guess they really do find it hard to sleep at night )

 

I can't wait to report them when they fail to comply

[sgtbush]

Well I hope you asking for the info that they hold on you is legitimate and not just a fishing exercise to see IF they hold data on you.

If its fishing then they can charge you for it.

 

That stops people firing off sar's off willy nilly and clogging up the system

[DragonFly1967]

Personally, I think people worrying about what the PPC's do with your data after today is a bit of a red herring.

 

From today, they need your express (rather than implied) permission to process your data in the first place. Where do you agree to that on their existing signage?

 

 

So any tickets issued from today onwards (based on existing signage) probably already breach the GDPA. I can see that this is going to cost the PPC's a shed load of money. What a shame

[DragonFly1967]

Well I hope you asking for the info that they hold on you is legitimate and not just a fishing exercise to see IF they hold data on you.

If its fishing then they can charge you for it.

 

That stops people firing off sar's off willy nilly and clogging up the system

 

Of course.

 

It's unlikely that I'm going to write to Acme Widget Company just to see if they know who I am

[sgtbush]

Of course.

 

It's unlikely that I'm going to write to Acme Widget Company just to see if they know who I am

 

 

 

You would be surprised!!!

[DragonFly1967]

You would be surprised!!!

 

I don't have that much time

[sgtbush]

Some people do you know!!!

[steveod]

Personally, I think people worrying about what the PPC's do with your data after today is a bit of a red herring.

 

From today, they need your express (rather than implied) permission to process your data in the first place. Where do you agree to that on their existing signage?

 

 

So any tickets issued from today onwards (based on existing signage) probably already breach the GDPA. I can see that this is going to cost the PPC's a shed load of money. What a shame

 

Incorrect. They don’t need Consent, they will rely on legitimate grounds.

 

There are two issues however.

1. The dvla have relied on legitimate grounds and authority under legislation ie reasonable cause. Under GDPR they can no longer rely on legitimate grounds so can only rely on it being a part of their functions as a public body with authority given by reasonable cause. However this part of the GDPR requires an evaluation to be made on a case by case basis, and the opportunity for the dara subject to object. This will mean that requests by ppc to dvla will need to be manually checked on case by case basis to ensure it’s a lawful request.

 

2. The ppc’s using anpr are in a spot. The capture of the vrm is the personal data of the RK, not the driver. They will not have given notification to the data subject ie RK prior or at the time of processing. Also when they send the vrm to the dvla they are transferring data and so need to notify the data subject at that point, which they cannot do

[DragonFly1967]

Incorrect. They don’t need Consent, they will rely on legitimate grounds.

 

Hmm, perhaps. However, in my case, the PPC don't have "legitimate grounds" in the first place and they've been made well aware of this fact on numerous occasions. At least, that's true of the main one I have to deal with.

 

 

2. Is a very interesting point indeed

[ericsbrother]

Now, ANPR is an interesting one because the actual collection of the ANPR data doesnt fall within the scope of the DPA even though the ICO says it does but processing it does so let us say that the driver has read and agreed to the dodgy contract offered by the signage where does any contract categorically state that you cant aprk there unless you are also the keeper and consent to them bothering you at random because they want some money.

 

The reasonable cause for accessing the DVLA database must be open to challenge as the most recent law takes precedent. If they havent identified the person they have a contract with at the outset then althoug the POFA allows for keeper liability they cant ask for the keeper details unless they know them already!

 

Now try that on someone who has just bought a secondhand car.

 

Problem in the real world is the word may where shall or will would have been better words.

Edited May 25, 2018 by DragonFly1967
Added paragraphs

[brassnecked]

It is a can of worms that we could use against the PPCs tnough as their procedures and processing Keeper Details may well fall foul in some way.