Not a fine: private car parks bought 17 million names and addresses from the DVLA last year. Who checks?

The envelope is white, the heading is capitalised, and the amount has a deadline: pay within 14 days and it is £60, after that £100, and if you ignore it a second firm will write to say it is now £170 and mention the county court. About 46,000 of these letters begin every day in Britain. Each one starts with a request to a government agency in Swansea for your name and home address, granted automatically for £2.50. This piece is about that request: who makes it, what entitles them to it, who checks, what the letter that follows can and cannot do to you, and why the code of practice that Parliament ordered seven years ago is still, in the government's own word, "intended".

Not a fine

Start with what the letter is. A council parking ticket is a penalty under statute, with a tribunal behind it. A private parking charge is a claim for breach of contract: by driving past the sign you accepted its terms, and by overstaying or not paying you broke them. The Supreme Court settled that in 2015 in the case of a man called Barry Beavis, who stayed 56 minutes too long in a free two-hour car park in Chelmsford and was sent an £85 charge. ParkingEye, the operator, "obtained Mr Beavis's name and address from the Driver and Vehicle Licensing Agency", the judgment records, and conceded that the £85 "is not a pre-estimate of damages" and that "its revenues are wholly derived from the charges for breach of the terms". The court held, six to one, that "while the penalty rule is plainly engaged, the £85 charge is not a penalty", because the operator had "a legitimate interest" in deterring overstaying, and that a motorist "could hardly avoid reading the notice": "All that he needed was a watch." Lord Toulson dissented: "By most people's standards £85 is a substantial sum of money", he wrote, against a basic state pension then of £115 a week, and the clause "makes no allowance for circumstances, allows no period of grace and provides no room for adjustment".¹¹

Two things in that judgment matter for everything that follows. The court said the operator "could not charge a sum which would be out of all proportion to its interest", and took comfort that £85 was below the level at which the trade body's code required justification. And it explained why that code, which is not law, binds operators anyway: its "existence and observance is a condition of his ability to obtain details of the registered keeper from the DVLA". The whole private parking system rests on that one door. If the DVLA will give you the keeper's address, you can trade; if not, you cannot. The other pillar is a 2012 Act that lets an operator in England and Wales pursue the registered keeper, not just the driver, provided the notice arrives within 14 days of an ANPR camera catching the car and the sum claimed is the one on that notice. Scotland passed the same power in 2019 and has never switched it on; Northern Ireland has no such law.¹¹¹²³⁶

How they get your address

The legal basis is a single sub-paragraph of a 2002 regulation: the DVLA may release a keeper's particulars to any person "who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars", on payment of a fee. For parking companies the agency does not assess reasonable cause request by request. Its published rule is that it "will not disclose data to parking or trespass companies who are not members of an ATA", an accredited trade association, of which there are two, the British Parking Association and the International Parking Community, and that "we expect the ATAs to monitor adherence to the code of practice". A member company signs a contract for an electronic link, called KADOE, undertakes to gather evidence "before making each request", and is charged £2.50 a time, including for requests that find no keeper.³⁴³⁹

The DVLA publishes the volumes, company by company, every quarter, and the RAC Foundation has kept the older releases. In 2012/13 parking companies made 1.9 million requests. In 2025/26 they made 16.9 million, from about 200 companies, an average of 46,000 a day or 32 a minute, and the number has risen every year since the pandemic, by 17% in the last one. Cumulatively since 2012 the agency has answered about 105 million such requests. The DVLA's own footnote says the figures count enquiries rather than releases and "will include details of the same vehicle being released more than once", so they are a proxy for tickets, not a count of drivers; it is the proxy the government itself uses.¹²⁸³³

The money is not trivial for the agency. At £2.50 a request, parking companies paid the DVLA roughly £42m in 2025/26, and about £262m since 2012; the agency has told Parliament it cannot separate parking revenue from other keeper requests, but its published totals for all such requests were £30.2m in 2022/23, of which parking was about 92%. Its latest annual report records a £6.9m rise in income from keeper requests in a single year. The fee has been "under review" since the spring, according to three written answers; the outcome "will be published in due course". The ten biggest requesters make 70% of all requests, with ParkingEye, owned by an infrastructure fund since 2018, at the top every year. The whole table, every company and every year, is attached.¹⁵

Who checks

So who checks that the 16.9 million requests had reasonable cause? The answer from the department, in a written answer in March, is nobody, at the level of the request: "No analysis is undertaken in respect of the volume of requests made." The same answer says the Information Commissioner "provided an opinion in 2022 confirming the release of DVLA data for private parking management is lawful". The checking that does happen is an audit programme. Since July 2024 the DVLA has carried out 157 "statement of control" audits of parking companies, of which "156 presented a low risk" and one a medium risk, and the Government Internal Audit Agency has done 203 "evidence based transactional audits" on its behalf, of which "65 identified areas of non-compliance with DVLA requirements", a third. The department's gloss is that these are "a point-in-time assessment", that "in many cases, evidence that was not available at the time of the audit will subsequently be provided", and that companies must show "corrective and remedial actions" before a matter is closed. No written answer, annual report or DVLA publication we could find records a single company suspended or cut off from the data in that period. The agency's leaflet says it "could refuse all future requests for information permanently"; whether it ever has is not published.⁵⁶⁷³⁹

The most candid description of the system is a tribunal's. In 2020 the Upper Tribunal heard the DVLA's appeal against an order to disclose its parking contract. Its judgment records that the agency "became aware in 2015 that some parking companies were providing vehicle keeper information onwards to MIL Collections Ltd, a debt collection company", and sets out how the gate works: "Once a customer is using the KADOE contract, there is no further check of whether it has reasonable cause to request details each time a new request is made." And: "Once the information has passed through the gate, the DVLA's statutory function is exhausted. It is a case of closing the stable door after the horse has bolted." The tribunal added that "the DVLA has no regulatory responsibility for ensuring compliance with KADOE, the DPA 2018 or the trade associations' Codes of Practice". That was the position in 2020. The department's answers this year describe the same architecture with more audits attached.¹⁰

Whether that amounts to addresses being obtained unlawfully is a question the record does not answer in the affirmative. Every request goes through a member of a trade body under a contract that requires evidence first; the regulator has called the release lawful; the audits find paperwork gaps rather than fraud, and the one documented abuse, onward disclosure to a debt collector, is a decade old. What the record does show is a system that hands out 46,000 home addresses a day on trust, checks a sample afterwards, finds a third of the sampled transactions wanting, and has not, on anything published, closed the door on anyone.

The letters

What the address is for is the letter, and the letter is governed by a code the industry wrote for itself. Since October 2024 the two trade bodies have run a single code. It caps the charge at £100, requires a 40% discount for payment within 14 days, and says an operator "must not serve a notice" that "deliberately resembles a public authority civil enforcement penalty charge notice" or "implies or would cause the recipient to infer statutory authority where none exists". Its annex lists words operators "must not inappropriately use": offence, illegal parking, crime, violation, fine or penalty, bailiff, Penalty Charge Notice. Debt agents must not "imply that they are writing from a legal or litigation department" or "threaten an in-person visit". And then, in clause 9: "Where a Parking Charge becomes overdue a sum of up to £70 may be added." The government's code of 2022 had said the opposite, in one sentence: "The parking operator must not levy additional costs over and above the level of a parking charge or parking tariff as originally issued." That sentence is one of the two reasons it no longer exists.¹⁴¹⁹

The Competition and Markets Authority has now put the £70 on notice. On 16 July 2026 it published an open letter to every operator and a letter to the ministry, and opened an investigation into one company, Euro Car Parks. Its findings, expressed as concerns rather than breaches, are precise. The code's clause "does not itself provide a legal basis to render consumers liable to pay any fee". The terms that are supposed to create that liability "are often vague and unclear", "hidden within small print", on signs "separate to the main parking sign", and some appear "to entitle third-party debt collectors, with whom the consumer does not have a contract, to charge fees". Under the Consumer Rights Act, the CMA said, such terms "may be contrary to the requirement of good faith". And on the discount that vanishes if you appeal: it "creates a financial incentive to pay the reduced PCN rather than appeal". The ministry's own options paper, published with the 2025 consultation, supplies the arithmetic: debt recovery agencies have "an average profit margin of approximately 63%", against 19% and 15% for the operators themselves; they "would 'break even' with a DRF of approximately £26"; and "only 14% of cases are paid during the debt recovery stage". The fee, in other words, is paid by the minority who are frightened enough, and priced for them.^21222324

What happens if you do not pay

The honest answer is: probably a series of letters, possibly an appeal you may well win, and occasionally a court claim that may be dropped the day before the hearing. Start with appeals. POPLA, the service for one trade body's members, received 104,349 appeals in the year to September 2025, its first six-figure year. Of the 107,202 it completed, 50.5% ended with the charge cancelled. But only 14,578 of those were won on the merits; in 39,522 cases the operator simply "decided not to contest" once the driver pushed back. Of the appeals actually decided, POPLA found for the motorist in 21.5%. The other service, the IAS, run under the second trade body, received 34,383 disputes, recorded 7,888 conceded by operators before a decision, and publishes no win rate; the ministry acknowledges a "perception amongst motorists that the system is set up in favour of parking operators" and proposes a single government-appointed service to replace both.²⁰²⁵²⁶

Then court. Nobody counts how many county court claims parking companies bring; the Ministry of Justice does not break claims down by claimant, and the ministry says it is "working together to develop a Justice Impact Test" with the courts and will give the new oversight board "MoJ data on County Court claims by parking operators and debt recovery agencies". The credit-reference industry's register of judgments notes "over 40,000 unsatisfied judgments" at exactly £277 and tens of thousands more at £284 and £285, sums that look like a £100 charge plus a £70 fee plus court costs, but says it "cannot quantify precisely how many judgments stem from parking fines". What is documented is what happens when a claim is defended. Rosey Hudson paid £3.30 a day to park on Copeland Street in Derby, walking to find a phone signal to do it; Excel Parking issued ten charges because she had not paid within five minutes, took her to court for £1,905.76, told the BBC she was "the author of her own misfortune", and discontinued the claim two weeks later without explanation. Garry Kay bought a £2 ticket twenty minutes after driving in because there was a queue; the claim for £255 was withdrawn the day before the hearing. Peter Barton took nineteen minutes to park and pay; a district judge dismissed Excel's claim because the contract "was not concluded until he read the terms and conditions next to the parking meter", so "it seems difficult to see how he could have been in breach" before that. Simon Edmonds mistyped his registration while paying and was ordered to pay £285.56; Excel was "delighted". And in March 2026 a circuit judge dismissed an operator's appeal against a driver who had stopped at a broken airport barrier, finding the stop "a matter of compulsion" and, of the operator's authorities, "I confess that I do not find that part of the analysis easy to follow".^{21272829303132}

The advice from the two bodies that see most complaints is the same. Citizens Advice: "You can't be taken to court while you're informally appealing, so your credit rating won't be affected." MoneySavingExpert: a private charge is "NOT an official fine" but "a civil demand"; do not "just pay automatically"; and "judges often don't allow the industry's controversial 'debt recovery fee', so most claims that do include this sum are generally reduced by £70". The risk that is real is the one the MPs described in a debate last year: a constituent who "never received the letters", got a default judgment, and found "her credit score collapsed" and a mortgage blocked. The code obliges debt agents to trace a current address with "a soft credit check" before enforcing, which is also the mechanism by which the letters find you.^18193435

Seven years of a code

None of this is new to Parliament. The Parking (Code of Practice) Act 2019 says the Secretary of State "must prepare a code of practice", must lay it before both Houses, and that the only sanction is the one the DVLA already holds: an operator that breaches it may lose access to the data. A code was published on 7 February 2022. Its foreword, by the minister Neil O'Brien, said private firms "issue roughly 22,000 parking tickets every day, often adopting a labyrinthine system of misleading and confusing signage, opaque appeals services, aggressive debt collection and unreasonable fees designed to extort money from motorists", and that it would ban "pseudo-legal language that we've all seen on those yellow parking slips doctored to look like official Penalty Charge Notices". It capped charges at £50 outside London, halved them for prompt payment, and banned the debt fee. On 4 June 2022 the RAC Foundation reported that operators and debt firms had begun two judicial reviews; on 7 June the code was withdrawn. The minister in the Lords put it plainly in 2025: it "had to be withdrawn in June 2022 because of a legal challenge. Areas of challenge included concerns that the code incorporated lower caps than the industry caps on parking charges at the time and that it banned debt recovery fees."^1314151640

Since then the department has consulted again, in the summer of 2025, and is still "analysing your feedback" fifteen months later. The minister who launched that consultation told the Commons it was "an exercise that confuddled four previous Prime Ministers and five Secretaries of State, one of them twice", and gave "the clear commitment from this Dispatch Box that as a Government we will deliver". In March the Lords minister said the code would be laid "in autumn 2026"; a Conservative peer replied that "we will all suspect that she is simply parking it". On 18 September the written answer repeated "autumn 2026". The government's own timetable in 2022 had operators complying "by the end of 2023". Scotland is waiting on Westminster before it switches on its own keeper-liability law. The DVLA's fee review, the CMA's investigation and the code are all now due "in due course".^917182036

The operators' case

The industry's argument is the one the Supreme Court accepted: without a deterrent, free car parks fill with people who are not customers, and the small minority who ignore the rules are the reason the rest can park at all. The court was told that "more than 99.5%" of users comply. The British Parking Association says repeat offenders now account for "up to 44%" of charges and that its members are not targeting "the 99.6% of drivers who park responsibly"; the IPC says cutting the charge to £50 "would only reward those who ignore the rules". Operators do run genuine problems: blue badge bays, blocked ambulance access, station car parks, and hospitals, where Department of Health guidance says trusts "are responsible for the actions of private contractors" and contracts "should not be let on any basis that incentivises additional charges". A High Court judgment this year in a dispute over a Cardiff hospital contract records bids being scored on the share of income from parking charge notices they offered the health board, and a winning bidder expecting that income to be worth at least £10m. The deterrent and the business model are the same thing, which is what the dissenting judge said in 2015.¹¹³⁷³⁸

What this cannot tell you

It cannot tell you how many private parking charges are issued, only how many times a company asked for a keeper's address, which the government uses as the same number. It cannot tell you how many drivers are sued or how many judgments result, because nobody publishes it. It cannot tell you whether any company has ever lost its DVLA access for misuse, because no answer or report says so either way, and we treat that silence as silence. It cannot read the Information Commissioner's 2022 opinion, which we could not obtain, or the DVLA's current contract, which was withdrawn from publication in 2020, or the names of the firms that brought the 2022 judicial reviews, which no primary source records. Two quotations, from the High Court hospital judgment and from the consumer sites, came through an automated reader and are marked in the reporting box. What it can tell you is that the address on the envelope came from the state for £2.50, that the check on the request is a membership card and a sample audit, that the charge is a contract you can contest and the £70 is a fee whose legal basis the competition regulator now doubts, and that the law to fix it has been "intended" for seven years.