Information Commissioner’s Opinion:

The lawful basis for the

processing of vehicle

keeper data by the Driver

and Vehicle Licensing

Agency (DVLA)

13 June 2022

government, other institutions or bodies as well as the public, on any

issue related to the protection of personal data.

The Commissioner can issue Opinions on his own initiative or on request.

This Opinion sets out the reasoning behind the Commissioner’s decision

that ‘public task’ is the correct lawful basis on which the DVLA should

process vehicle keeper data, when sharing it with car park management

companies to recover unpaid parking charges.

Who is the Opinion for?

This Opinion is primarily for the DVLA and the Department for Transport.

They are the data controllers for this processing. It may also be of

have questions about the practical impact of his decision on the continued

integrity of the scheme.

The Opinion complements the outcome of the complaints investigated

under S165 of the DPA 2018. It also draws on evidence that the DVLA

provided.

What is the background to this issue?

Following the DPA 2018 coming into force, the DVLA sought advice from

the Information Commissioner’s Office (ICO). They wanted to know the

correct lawful basis under Article 6(1) of the UK GDPR for sharing the

personal data of vehicle keepers with car park management companies to

recover fines. At the time, the DVLA were relying on legal obligation as

believed this satisfied the requirement under Article 6(1)(c) of the UK

GDPR that the processing is necessary for compliance with a ‘legal

obligation’.

The Commissioner received a number of complaints from people, about

both the application of Regulation 27(1)(e) and the DVLA’s sharing of

vehicle keeper data more generally. It is important to be clear that the

Commissioner’s remit is focused on the protection of personal data. It is

not his role to oversee DVLA’s wider role in the parking enforcement

system. His role is to determine the correct lawful basis for the DVLA to

share this information. Where appropriate and proportionate, his role is

keeper information to car park management companies in these

circumstances. In order to rely on legal obligation, the DVLA would need

to demonstrate that the processing was necessary for compliance with a

‘legal obligation’. This would require the DVLA to have a legal duty to rely

on, which in our view Regulation 27(1)(e) does not provide.

It is important to note that in coming to this conclusion, the

Commissioner does not doubt that car park management companies have

reasonable cause to request keeper information from the DVLA in these

circumstances, and that the DVLA is generally required to provide it.

However, Regulation 27(1)(e) creates a power rather than a duty as there

the reasonable cause requirement). Disclosing vehicle keeper data is

necessary for this task.

Commissioner not taking enforcement action?

The Commissioner regards this as a technical infringement of the law. The

situation apparently arose because of an unintended change to the

interaction between the Parking Regulations and data protection law,

following the 2018 data protection law reforms. The Commissioner does

not doubt the DVLA’s policy of reasonable cause. He also does not dispute

that the DVLA has a power to disclose this information to car park

based on:

• whether it is in the public interest to do so;

• the degree of harm to UK people caused by the processing of

• the economic impact of any regulatory interventions.

Taking these factors into account, the Commissioner concluded that using

the ICO’s resources to pursue enforcement action in this case would not

be in the public interest. This is because the risk of harm to vehicle

obligation lawful basis rather than public task is very low.

The Commissioner considers that the most appropriate way forward is for

the government to review the relevant legislation. They should look to

address the interaction between different pieces of legislation to provide

legal certainty on the correct approach. If the Department for Transport

and the DVLA believe that Regulation 27(1) gives the DVLA a legal duty

rather than a power to share keeper information, the government might

Can people who are, or are potentially, subject to unpaid

parking charges exercise their right to object under the

Paragraph 11 of Schedule 4 of POFA contains an enforceable legal right of

the car park management company to claim the charges from the vehicle

keeper. It is not for the DVLA to determine the validity of claims against

the vehicle keeper. Car park management companies can use the

exception. It would be for a court or parking tribunal to determine the

validity of any claim. It is the Commissioner’s view is that the DVLA could

refuse an Article 21(1) objection by the vehicle keeper in these

circumstances.

not whether the DVLA had a lawful basis to disclose vehicle keeper

information; they did. Rather, the Commissioner’s decision was about

whether ‘legal obligation’ was the correct lawful basis for doing this.

No. The Commissioner determined that the DVLA was not using the

correct lawful basis to disclose vehicle keeper information. This does not

mean that no lawful basis existed. Regulation 27(1)(e) provides the DVLA

with the power to do this, using the public task lawful basis. In addition,

that requires the DVLA to inform vehicle keepers of this. However,

Schedule 4 of POFA tells vehicle keepers that their information may be

requested to recover unpaid charges.