In a six-page opinion published this month, the privacy watchdog said it would not be pursuing enforcement action for what it called a “technical infringement of the law”, but experts have said the finding could lead to individual claims for compensation.

The DVLA had been relying on “legal obligation” as its lawful basis to process the data based on the incorrect belief that Regulation 27(1)(e) of the Road Vehicle (Registration and Licensing) Regulations 2002 imposes a legal duty on it to share details with car park management companies.

The agency therefore believed that this satisfied the requirement under Article 6(1)(c) of the UK GDPR that the processing is necessary for compliance with a “legal obligation”.

However, the ICO said Regulation 27(1)(e) “provides the DVLA with a power, rather than a legal duty, to disclose vehicle keeper information”, meaning the DVLA cannot rely on the legal obligation basis.

The correct legal basis would be “public task”, as Regulation 27(1)(e) creates a task to be carried out in the public interest which requires the disclosure of vehicle keeper data, the opinion continues.

The ICO said the situation “apparently arose because of an unintended change to the interaction between the Parking Regulations and data protection law, following the 2018 data protection law reforms”.

The opinion goes on to call for the UK government to “review the relevant legislation” in order to “provide legal certainty on the correct approach”.

It adds: “If the Department for Transport and the DVLA believe that Regulation 27(1) gives the DVLA a legal duty rather than a power to share keeper information, the government might choose to consider a legislative remedy that puts this issue beyond doubt. This would provide certainty to both the DVLA and to vehicle keepers.”

A spokesperson for the DVLA said: “There is no doubt, as confirmed by the ICO in its published opinion, that the release of data to private parking firms is lawful.

“ICO’s opinion reflects a legal technicality around processing conditions, and also acknowledges it will make no difference to the outcome of data sharing. This has no bearing on the release of data nor does it affect customers in any way.”