Parking companies breaking data protection by selling to MIL Collections

A freedom of information request has established that parking companies cannot sell keeper data obtained from the DVLA to MIL Collections unless the DVLA has approved this.

For parking companies to get keeper data from the DVLA, they sign a contract known as the KADOE contract. A copy of the contract has been released by FoI here.

This contract says what you can and cannot do with the keeper data. In particular,  clause D5.1 of the KADOE contract prohibits the Customer from disclosing the information they have received from the DVLA to any other person except:-

a) to a sub-contractor who acts as the Customer's data processor;
b) to a sub- contractor who acts as the Customer's debt collector;
c) with the prior written agreement of the DVLA.

MIL Collections are clearly not acting as a sub-contractor, and therefore parking companies must have prior written agreement from the DVLA to sell KADOE data to MIL.

The freedom of information request establishes that no companies have this permission.

Companies who have sold their data to MIL are therefore in breach of the KADOE contract and in breach of the Data Protection Act 1998.

There are also other conditions regarding the passing on of data, and it is not clear that MIL would pass these either.

MIL Collection have my data

it is important to note that not every case where MIL Collections have your data will necessarily be a breach of the Data Protection Act. In some cases, the parking company will not have your data from the DVLA. They might have it because you wrote to appeal a windscreen ticket, for instance, or because your address was written on the side of your vehicle.

However, if you received a notice to keeper in the post then chances are that the parking company got your data from the DVLA. If they did, as a first step you should write and complain.

Data Sharing & Protection Group
Strategy, Policy and Communications Group
D16
DVLA
Swansea
SA6 7JL 

Dear DVLA,

I am writing in reference to Freedom of Information request FOIR5604.

I wish to complain that [parking company] have sold my personal data to MIL Collections Limited. I believe that this information was obtained from yourselves, and this is therefore a breach of the KADOE contract clause D5.1

The details of the parking event are:
Vehicle: [reg]
Date:     [date]

Please can you confirm:
1) The parking company received my personal data from yourself
2) The parking company did not have prior written permission from the DVLA to give data to MIL Collections 

If this is the case, please also inform me what steps you will be taking against the parking company, and how you intend to safeguard my personal data in the future.

Once the DVLA have confirmed your data has been misused, you can then take action against the parking company. The case of Vidal-Hall v Google Inc [2014] EWHC 13 (QB) provides authority that misuse of personal data is a tort and that damages may be non-pecuniary. The case of Halliday v Creation Consumer Finance Ltd [2013] All ER (D) 199 provides authority that a reasonable sum for compensation would be £750. A claim of up to £750 may therefore be possible. You may wish to take legal advice on the prospects of success. Filing a claim for £750 will cost £60. A claim for £299 will cost £25 online.

The first step would be a letter before claim.

Dear Parking Company,

Letter Before Claim

You have given my personal data to MIL Collections. You obtained this data from the DVLA, and your KADOE contract prevents you sending that data to third parties without prior written permission of the DVLA. The DVLA confirmed this is not the case. This is therefore misuse of my personal data.

The case of Vidal-Hall v Google Inc [2014] EWHC 13 (QB) provides authority that misuse of personal data is a tort and that damages may be non-pecuniary. The case of Halliday v Creation Consumer Finance Ltd [2013] All ER (D) 199 provides authority that a reasonable sum for compensation would be £750. 

In this case, I consider a reasonable sum for the distress caused would be £750. Please remit this amount within 14 days. If you have not remitted this sum, or made suitable arrangements to remit it, I reserve the right to take legal action without further notice.

I would be willing to use Alternative Dispute resolution to attempt to settle this matter and suggest the Consumer Ombudsman is a suitable body.

If they do not pay up, you could consider filing a claim. The particulars would be something like.


My name and address information (together with other information) is classified as personal data within the meaning of s1(1) of the Data Protections Act (DPA). [Parking Company] misused this data by obtaining it from the DVLA and then selling it to MIL Collections in breach of their KADOE contract with the DVLA. This caused harassment and personal distress to myself and s13 of the DPA provides for financial compensation for this.

The case of Vidal-Hall v Google Inc [2014] EWHC 13 (QB) provides authority that misuse of personal data is a tort and that damages may be non-pecuniary. The case of Halliday v Creation Consumer Finance Ltd [2013] All ER (D) 199 provides authority that a reasonable sum for compensation would be £750.

Time Limit

The Limitations Act may apply, which would mean you have 6 years to file your claim from the date the parking company sold your data to MIL. Whether or not MIL have taken you to court and won or lost would be immaterial (but may affect the level of claim), as your claim is against the parking company, not MIL.

Happy Parking

The Parking Prankster