[Help] GDPR question (hypothetical, of course)

[essbee1]

A friend of mine got a parking ticket at the Miller and Carter (formerly the Black Lion pub) in
Patcham from "Euro car parks" (utter w*nkers). They are a private car park company and have no jurisdiction in
UK Law (other than breach of their contract with said establishment and the car owner). Basically, they're chancers.

So, my question. They were able to get my friend's name/home address/car details etc to send my friend the fine
in Kent. So, is this not a breach of GDPR? How are they able to get hold of my friend's personal details
etc? I'd understand if it was a Govt. department; that's fine. I wouldn't mess with a Govt Dept. But how can a private company do this without
breaching GDPR? My friend didn't agree to share any of those details.

Asking for that friend, of course.

 

[Bodian]

Anyone with 'reasonable cause' can get owner's details from DVLA so long as they have the registration number. Reasonable cause includes to issue parking tickets.

https://assets.publishing.service.gov.uk/media/624dabc7e90e0729f6bf8167/inf-266-release-of-information-from-dvlas-registers.pdf

Request information about a vehicle or its registered keeper from DVLA

Request details about a vehicle's registered keeper: bulk data, anonymised data, mileage data requests, other information requests

www.gov.uk

 

[Bad Ash]

Looks like the DVLA will pass on this info to certain registered companies (for a fee).

https://assets.publishing.service.gov.uk/media/624dabc7e90e0729f6bf8167/inf-266-release-of-information-from-dvlas-registers.pdf

 

[essbee1]

Fair enough. Thanks Bodian.

 

[essbee1]

Looks like the DVLA will pass on this info to certain registered companies (for a fee).

https://assets.publishing.service.gov.uk/media/624dabc7e90e0729f6bf8167/inf-266-release-of-information-from-dvlas-registers.pdf

Ta.

 

[essbee1]

I shall be challenging this from a GDPR perspective on behalf of my friend. We'll see how a call to DVLA works in the morning.

 

[studio150]

I shall be challenging this from a GDPR perspective on behalf of my friend. We'll see how a call to DVLA works in the morning.

A complete waste of time.

If you read the helpful links that have been posted above, you will see that as Euro Car Parks are members of the BPA, they are permitted to obtain details from the DVLA.

 

[essbee1]

Well, I'll have to bring both of the f***ers down then.

 

[Bodian]

I shall be challenging this from a GDPR perspective on behalf of my friend. We'll see how a call to DVLA works in the morning.

Good luck with that! Let us know how it goes.

The main problem you'd have to overcome is that release of such data is within the legislation - so you would have to try and show that it is the actual legislation that is breaking another piece of legislation. But I think it's harder than that, as the relevant regulation is basically an exemption to the GDPR.

The Road Vehicles (Registration and Licensing) Regulations 2002

These Regulations revoke and consolidate, with amendments, the Road Vehicles (Registration and Licensing) Regulations 1971 and the Road Vehicles (Registration and Licensing) Regulations (Northern Ireland) 1973 and their amending instruments so as to provide a single set of Regulations for the...

www.legislation.gov.uk

I have a feeling that there might be some small print on the V5 form that says that the signatory is willing to have their data shared as well. I know one of my mates was keen to challenge this some time ago - and found that he couldn't.

 

[essbee1]

Thanks Bodian and others. Appreciate the advice and help.

 

[essbee1]

Another question: tomorrow I'm going to register a company in Companies House, called ACMEBS ltd,
with a remit to do some analysis of parking data across the UK. As entitled to do so, according to
UK law, I plan to request the home addresses and keeper details from DVLA of every car I see on day one of ACMEBS
being registered. Any problem with that?

 

[Shropshire Seagull]

GDPR is so misunderstood.

It's fundamentally about making sure data held on living individuals is accurate and correct and is used lawfully - it's not about keeping your identity a secret.

Have a look here

 

[Cotton Socks]

First thing to do is make sure your friend doesn't say they were the the driver of the vehicle at the alleged time of the offence (I think). There is a poster here that also posts on the Martin Lewis site who really knows their stuff. I think it's @LadySeagull

 

[essbee1]

GDPR is so misunderstood.

It's fundamentally about making sure data held on living individuals is accurate and correct and is used lawfully - it's not about keeping your identity a secret.

Have a look here

Thanks Shropshire, but with all respect is that really correct? It's about not revealing/identifying personal data to people who are not entitled
to know that info. I've been on the f****g endless courses.

 

[essbee1]

First thing to do is make sure your friend doesn't say they were the the driver of the vehicle at the alleged time of the offence (I think). There is a poster here that also posts on the Martin Lewis site who really knows their stuff. I think it's @LadySeagull

cheers mate,

 

[schmunk]

Thanks Shropshire, but with all respect is that really correct? It's about not revealing/identifying personal data to people who are not entitled
to know that info. I've been on the f****g endless courses.

Yes, that's part of the rules, except the DVLA is entitled to share the information with people (or companies / government agencies/etc.) with reasonable cause.

Parking enforcement is one such cause, as is identifying the owner of a vehicle involved in a collision.

 

[Baldseagull]

A friend of mine got a parking ticket at the Miller and Carter (formerly the Black Lion pub) in
Patcham from "Euro car parks" (utter w*nkers). They are a private car park company and have no jurisdiction in
UK Law (other than breach of their contract with said establishment and the car owner). Basically, they're chancers.

So, my question. They were able to get my friend's name/home address/car details etc to send my friend the fine
in Kent. So, is this not a breach of GDPR? How are they able to get hold of my friend's personal details
etc? I'd understand if it was a Govt. department; that's fine. I wouldn't mess with a Govt Dept. But how can a private company do this without
breaching GDPR? My friend didn't agree to share any of those details.

Asking for that friend, of course.

Get clued up before making any contact with the thieving bastards, usually the easiest way to make these go away is to ask the manager of the premises to get them to back off, do that sooner rather than later, but again, get clued up first. here http://forums.pepipoo.com/index.php?showforum=60
Or Money saving expert has some info and helpful community on this too.

 

[Stat Brother]

First thing to do is make sure your friend doesn't say they were the the driver of the vehicle at the alleged time of the offence (I think). There is a poster here that also posts on the Martin Lewis site who really knows their stuff. I think it's @LadySeagull

Shirley the first thing to do is park the car in adherence to the terms and conditions of parking in said spot.

 

[Uh_huh_him]

Would i be right in thinking your friend decided to not pay for parking in a private car park?

The company who own the private car park, has subsequently obtained your friend's details, to pursue them for payment of a fine?

And you consider this company to be "chancers"?

 

[Shropshire Seagull]

Thanks Shropshire, but with all respect is that really correct? It's about not revealing/identifying personal data to people who are not entitled
to know that info. I've been on the f****g endless courses.

Indeed, and that is why I used the word lawfully.

DVLA would be in breach of GDPR if they passed personal details to e.g. a double glazing salesman but if a vehicle is suspected of doing something unlawful it is perfectly fine to provide the registered keeper details.

From the details you've shared I'd be confident your case would be unsuccessful and in fact my understanding is that individuals can't prosecute a GDPR case, only report it to the Information Commissioners Office who will only take action if THEY think it appropriate.