“I have recently received a Penalty Charge Notice from a parking company regarding one of my courtesy vehicles. Can I pass the driver’s details on to the company or will this breach the GDPR?”

As you are considering disclosing personal data, the GDPR and the Data Protection Act 2018 dictate your responsibilities and the principles to be applied. You are right to be consider the GDPR and we are finding in practice that their impact isn’t as disruptive as initially feared.

First things first

Before you consider what personal data to disclose, if any, you need to ensure that this is a valid request for information and that there are reasonable grounds for you to believe your vehicle was involved. Check the information provided and see whether the details are correct and whether it is in fact your vehicle that was involved. If necessary, request further details of any alleged issue.

Lawful Processing

Once you are satisfied that this is a valid request you need to consider whether the proposed disclosure is lawful for the purposes of data protection. The GDPR identifies 6 grounds for lawful processing

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Now it should be remembered that more than one reason may apply. In this case it is likely that the disclosure can be justified under grounds b, c, and f.

Furthermore, where you have a written courtesy car agreement that provides details of when this information will be disclosed, or whether you have contacted the customer during your investigations to see if the request is valid, then you also will be able to rely on grounds a and d.

What information to provide.

Where you do provide the driver’s details it is important to only provide the minimum information required. We would advise the name and contract address for the driver.

It is important to provide the driver’s details where you are satisfied that your vehicle was involved as failure to do so will result in the registered keeper becoming liable for any charges. Whilst you should be able to recover these from the driver directly this will be inconvenient and risks further costs.

As always, this advice is general in nature and will need to be tailored to any one particular situation. As an RMI member you have access to the RMI Legal advice line, as well as a number of industry experts for your assistance. Should you find yourself in the situation above, contact us at any stage for advice and assistance as appropriate.

Motor Industry Legal Services

Motor Industry Legal Services (MILS Solicitors) provides fully comprehensive legal advice and representation to UK motor retailers for one annual fee. It is the only law firm in the UK which specialises in motor law and motor trade law. MILS currently advises over 1,000 individual businesses within the sector as well as the Retail Motor Industry Federation (RMI) and its members.