DVLA INSPECTION VISIT TO BSG CAR PARK MANAGEMENT LIMITED FRIDAY 6 JUNE 2014

Transcription

1 XXXXXXXXXXX BSG Car Park Management Limited 4 Fitzwygram Crescent Havant PO9 2BZ Driver and Vehicle Licensing Agency Internal Audit Services Priestley House Priestley Road Basingstoke RG24 9NW Telephone XXXXXXXXXX Fax XXXXXXXXXX Mobile XXXXXXXXXX Web Site Your reference: Our reference: XXXXXXXX@dvla.gsi.gov.uk XXXXXXXXXX Date: 9 June 2014 Dear XXXXXX DVLA INSPECTION VISIT TO BSG CAR PARK MANAGEMENT LIMITED FRIDAY 6 JUNE 2014 I refer to my visit for the purpose of reviewing the validity of your requests for access to personal data held by DVLA. Business Details: Your business is to enforce car parking activity on private land. Your access to DVLA s records is requested under Regulation 27 of the Road Vehicles (Registration and Licensing) Regulations Requests have been made using V888/3 applications. Inspection Details: I examined a sample of twenty-five data requests that you have made. In all cases you were able to provide evidence that an unauthorised parking event occurred to support the reason for the data request and I am satisfied that they met the criteria for the release of information, subject to the following points. Page 1 of 6

2 VRM Exception noted: Concern: Protection of We discussed the requirements for notices issued Misleading Freedoms Act 2012 (POFA) under POFA to be served on the registered keeper within the timeframe prescribed by the Act. information I explained that where a Parking Charge Notice (PCN) has been issued at the time of the parking event and the twenty-eight days for payment has expired; the Notice to Keeper (NTK) must be served on the registered keeper by the fifty-sixth day. Under the Act two days must be given for a notice to be deemed to have been served through the postal system. Therefore the NTK must be in the postal system by day fifty-four. Whilst XXXXXX was able to evidence that two NTKs exist, one referring to Schedule 4 of POFA and one which does not, it was noted that in nineteen of the cases we reviewed the incorrect version of the NTK had been issued. I explained that where the prescribed timeframes cannot be met cases can still be pursued under contract law. However, where this is done it is important that any correspondence issued by the company does not cite the intention to recover an unpaid parking charge from the vehicle s keeper as there would be no legal basis to do so and this would be misleading. XXXXXXX Two points arose from this case: 1) Whilst I was able to view case details on the ZatPark system to satisfy me that registered keeper details had been requested for legitimate reasons, it was noted that an appeal had been received on 3 December Data Protection The appellant acknowledged in her that she had parked the vehicle whilst assisting her sister move home. She also confirmed her name and provided a serviceable address. I explained that where the name of the driver is known, as in this case, along with a serviceable address the company should not then be requesting the details of the registered keeper from DVLA. The registered keeper may not have been the driver at the time of the parking event and if this Page 2 of 6

3 is the case, not only will obtaining their details infringe their right to privacy the enquiry may breach the Act (DPA). 2) The number plates could not be seen on the associated photographic evidence. We discussed the requirement for the company to be in possession of hard evidence of the unauthorised parking event prior to requesting keeper details from DVLA and I recommended that going forwards requests are not made unless they can be supported by unequivocal photographic evidence. In the event that the reason for the request is subsequently challenged holding this evidence will enable the company to demonstrate it met the legislative reasonable cause criteria for having made the request and will serve to protect both it and the requestor from any allegation that they made it for unauthorised reasons. XXXXXXX You submitted a V888/3 request to DVLA on 20 January 2014 in connection with a parking event on 16 December Data Protection An examination of the database showed that payment had been received fifteen days earlier on 5 January and therefore the request had been unnecessary. XXXXXX was however able to demonstrate that the details of the keeper had not been retained on the system. In respect of the requests for personal data we discussed your processes and procedures; your physical and IT security for the personal data held; and your data protection registration. Issue noted: Land Owner Agreements Concern: Three points of concerns were discussed: 1) It was noted that page one of your agreement advises that registered keeper details will be obtained from DVLA if the driver fails to pay the PCN within the initial fourteen day discount period. Misleading information The word obtained suggests that a request to DVLA will Page 3 of 6

4 result in the information being provided. Data will only be released if DVLA is satisfied that the company has reasonable cause to the information and therefore obtained needs to be replaced by requested. 2) I also explained that DVLA data should not be sought in advance of the expiration of the twenty-eight day period given on the PCN, as should personal information be provided and the payment is then received within the allotted time, the enquiry would have been unnecessary and may breach the DPA. 3) The example landowner agreements examined did not appear to comply with the requirements of clause 7.2 (f) of the BPA s Approved Operator Scheme (AOS) Code of Conduct, which requires confirmation that the landowner authorises BSG Car Park Management Limited to take legal action to recover a parking charge. Possible Non Compliance with BPA Code I would be grateful for confirmation that these issues have been addressed. Appeals received within discount period We discussed the requirement, where an appeal is received and then rejected within the discount period, for the company to offer the driver a reasonable period to pay at the reduced amount. Compliance with BPA Code Neither XXXXXX nor XXXXXX were able to definitively advise how long is given in such circumstances and I would now be grateful for confirmation of the period of time afforded. Non POFA NTK Whilst the NTK template produced in respect of cases that cannot be pursued under POFA does not cite the company s intention to recover the parking charge from the vehicle s registered keeper, it did still include the wording please note POFA Misleading information Where the timeframes have not been met the legislation does not apply and should not be referred to. I suggested that this wording was removed from the document to avoid giving the impression that it does. Transfer of data to Roxburghe We discussed the transfer of cases to Roxburghe for debt recovery action and as you are responsible for doing this XXXXXX and XXXXXX were unable to confirm the method that is used to transfer the cases. Page 4 of 6

5 It is recommended that files are transferred by means of a Secure File Transfer Protocol (SFTP) in order to protect any personal data they contain, but I would be grateful for confirmation that there is an appropriate level of protection afforded to any files being sent to your debt recovery agent. Retention of personal data requested in error One of the principles of the Act (DPA) is that personal data should only be held if it is relevant and clearly that is not so if the wrong vehicle details have been requested/supplied. We discussed the need for any personal information (including any scanned details) received from such an enquiry to be removed from any manual and electronic records. A record of the enquiry should still be retained for 2 years in the event the enquiry is challenged within that period. Data Retention Policy We also discussed the company s policy for the retention of vehicle keeper information obtained from DVLA as I was concerned that if this information was retained indefinitely it could potentially breach principle five of the DPA, which prescribes that personal data should not be held for longer than necessary. Although it was suggested that this information is deleted from the ZatPark system neither XXXXXX nor XXXXXX were able to confirm how long the data is kept and I should be grateful confirmation in respect of the period this data is held. SUMMARY OF ACTIONS 1. Please confirm that BSG Car Park Management Limited will not make reference to pursuing parking charges under POFA on its Notice to Keeper unless the timeframes prescribed under the Act have been complied with. {Further Information} 2. A request for vehicle keeper details should not be made when the company already has a serviceable address for the driver at the time of the parking event. {} 3. It is recommended that a data request is not made unless it can be supported by photographic evidence and that in advance of making a request to DVLA a check is carried out to verify that the details recorded on the PCN (including the registration number and incident date) are corroborated by the photographic evidence to ensure the company can justify the request. {Improvement to Procedures} Page 5 of 6

6 4. Care should be taken to avoid unnecessary data requests being made as in the case of XXXXXXX where payment had already been received. {Data Protection} 5. Please confirm that the requested changes to your landowner agreement have been made in line with the recommendations above so that it complies fully with the AOS Code of Conduct and DVLA requirements. {Further Information} 6. Please confirm where an appeal is received within the discount period and then subsequently rejected the period of time offered for payment to be made at the reduced amount. {Further Information} 7. Please confirm that all references to POFA have been removed from the NTK sent out by the company where this legislation cannot be relied upon to pursue a parking charge. {Further Information} 8. Please confirm that there is an appropriate level of protection afforded to any files being sent electronically to your debt recovery agent. It is recommended that these files are transferred by means of a Secure File Transfer Protocol. {} 9. Please confirm the company s policy is respect of retaining vehicle keeper details on the ZatPark system. {} I should be grateful if by Monday 7 July 2014 you would confirmation to XXXXXXXXX, DVLA Internal Audit Services, Swansea, that the actions noted above have been addressed. XXXXXXX address is XXXXXX@dvla.gsi.gov.uk. In view of the points raised above DVLA Internal Audit will make a further visit in the near future, and once sufficient enquiries have been made, to obtain assurance that these have been suitably addressed. Failure to deal with issues of concern could result in all future requests for information being refused. As a matter of course, notwithstanding the above, where there has been a revisit identified, issues are referred to the Agency s Data Release Manager who may decide to suspend the company s access to information for a specified period and until certain assurances are received. Finally, I would like to take this opportunity to thank XXXXXX and XXXXXX for their time, help and hospitality during my visit. Yours sincerely XXXXXXXXXX Corporate Assurance Services Priestley House, Basingstoke Page 6 of 6