The Driver and Vehicle Licensing Agency (DVLA) relied on the wrong legal basis to release motorists’ personal data to private parking companies seeking to recover unpaid parking charges, the Information Commissioner’s Office has ruled ( ICO).
In a six-page review released this month, the privacy watchdog said it would not pursue enforcement action for what it called a “technical breach of the law”, but experts said the discovery could lead to individual claims for compensation.
The DVLA had relied on “legal obligation” as a lawful basis for processing the data based on the mistaken belief that Regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002 imposes a legal obligation on him to share the details with the parking management companies.
The agency therefore considered that this satisfied the requirement of Article 6(1)(c) of the UK GDPR that the processing is necessary for compliance with a “legal obligation”.
However, the ICO said Regulation 27(1)(e) “gives the DVLA the power, rather than a legal obligation, to disclose information about the holder of the vehicle”, meaning that the DVLA does not cannot rely on the basis of legal obligation.
The correct legal basis would be a ‘public task’, as Article 27(1)(e) creates a task to be performed in the public interest which requires the disclosure of vehicle keeper data, the opinion continues.
The ICO said the situation “apparently arose due to an unintended change in the interaction between the Parking Regulations and the Data Protection Act, following the Data Protection Act reforms. 2018 data”.
The opinion goes on to call on the UK government to “review relevant legislation” to “provide legal certainty on the correct approach”.
He adds: “If the Department for Transport and the DVLA believe that Regulation 27(1) gives the DVLA a legal obligation rather than a power to share cardholder information, the government may choose to consider a legislative remedy which puts this question beyond doubt. This would provide certainty for both the DVLA and vehicle owners.