DVLA

A Bit of History

After almost a year of DVLA-driven (ha ha!) nonsense, it's now safe to discuss in the open.

Last year my employer adjusted it's approach to national travel, and essentially allowed me to use rentals to cover the lengthy journeys to / from client site. At that point we were working with a client in Norwich, which isn't very easy to get to on public transport - it was far easier to commute once a week by road.

Everyone's a winner - I get a nice new-ish car every week I'm supposed to be on site, and hand it back when I get back to the Midlands. I don't have to pay for wear and tear on my own car, and it's very slightly cheaper for the company.

So I had my own car sitting on the drive almost entirely unused for a couple of months in the lead up to xmas - what's the point of paying tax and insurance on a vehicle I literally don't use? None. So the obvious route is to SORN the vehicle and let my insurance policy lapse at the end of the year. Of course because the DVLA are involved nothing is that simple - when we moved house a few years ago they failed to send me the new V5C, and only occasionally send me V11s... 2018 was a no-V11 year as it turns out.

What does that mean? Well I can't use the limited digital facilities provided by the DVLA to register the SORN, and - using their own instructions - get a V890 hard copy ready to send. Simply paying for tax requires all sorts of documents, which prevents Samaritans simply paying random vehicle tax (which would happen all the time of course), but SORN is equally baffling. Why not use the license ID of the registered driver? The DVLA have this information too.

From the DVLA website

Of course being a paperless business we've no printers so I have to get to [Insert High Street Stationary Brand] and get the forms printed. Already cost me a quid because the DVLA can't deliver documents properly!

We were off on a holiday to see family in Australia for most of December and some of Jan, so I wrote a letter to accompany the V890 and we dropped the envelope in the postbox on the way to the airport. Of course not being familiar with the process I was expecting no further paperwork

And So It Begins

We had a great time catching up with family in Oz, and returned refreshed (but shivering) back to the UK in early Jan. Back to work, off to client site and so on. Until about the 15th of Jan, when by some miracle a DVLA letter arrived. I was vexed and perplexed, however, that they were claiming my insurance had lapsed and they hadn't gotten their cut.

I just assumed that my original V890 & letter were probably being used to mop up a coffee spill on someones desk in the Enforcement department, and sent a duplicate V890 and letter back to them, carefully stating that I'd already sent one on the 14th of December.

It all went quiet.

Too quiet. Watched too many films to not know that was perfect time for an ambush. January flies past, as does February.

Then at the beginning of March I get another envelope from the DVLA, which contained a nice little SORN acknowledgement slip; I didn't think much of it at the time but the SORN effective date was 14th December 2018, but the printed date on the slip was 8th March 2019. I simply assumed that some paperwork took them a while.

Of course by the time the unexpected SORN acknowledgement had arrived, I was considering selling the car due to it's lack of use. No further carrier pigeons arrived from Swansea and I eventually sold the vehicle a few months later in August. The new keeper got their V5C - I wasn't bitter about not getting mine over the last few years - and the transaction was complete.

The Back Swing

It was never going to be that simple, was it? I'd returned from a trip to London on Friday 13th September at around lunchtime, to find David Wills stood leaning against his white van on our driveway.

"Are you the owner?" he asks.

"Who are you?" I ask.

He keeps asking if I'm the owner and I keep asking who he is - all of a sudden I'm thinking of the time I worked at a debt management business for some reason. I smile and suggest he introduce himself, which he then does. We shake hands and start talking.

It turns out he represents Marstons and is here to collect on a debt. We have a professional and calm conversation - he allows me to take photos of the information he has on his tablet and but has no paperwork to show me. Turns out I'd been convicted of a motoring offence in March or May and a fine had been levied.
 
A little advice for you if you find yourself in this situation - if you're 100% certain there's a mistake, you've not received any of the paperwork yet and you'll be getting a refund back, pay the bailiff and explain you'll be having the conviction set aside. They will have to refund the entire amount and it's dealt with there and then.

If you're not 100% confident and you haven't received any of the notices in the post, ask to see the warrant. If the bailiff can't produce the warrant, ask for the phone number for head office and speak to someone there. Don't open the door or get your keys out. If at all possible walk away and don't return to your door for another few hours.

If they don't have a warrant to seize goods on them (which they usually don't until after the first visit is unsuccessful), or won't prove it you shouldn't let them in. However if you've ignored any notices it's already too late.

I was furious at potentially having a serious issue getting my security checks failed and (if this matter had gone to a county court for recovery) potentially failing a credit check too. My SIA license might get cancelled or blocked from renewal. This would be disastrous for employment as no client would allow me on site. It wasn't David's fault, he's just the guy in the van today.

I also knew with absolute confidence that there had been a breach of proceedings and that I would be able to get the conviction set aside somehow. More on that later. I got home about £660 lighter then started prepping and researching.

More worrying to me was that I couldn't tender any new bids for work for my company out of fear that the BPSS / CBR / CC checks would fail. That would fail the bid instantly, and likely ruin any potential future relationship with parties involved, which could be disastrous for my business.

Fighting Back

After stewing and ranting over the weekend I got my extra strong coffee from the top shelf Monday morning, and set to work.

First up was a call to Marstons head office - partly to put them on notice not to spend that cash, and partly to see what information they could provide. They talked me through the details they had - an original balance (fines) of £350, their fees of £310; a sentencing on 13th May 2019 and on 29th of August Marstons allegedly sent me a notice of enforcement.

What's chilling here is that I can live without the car tax rebate check arriving and I expect physical post to be largely unreliable; but I don't expect to lose so much critical post. I honestly don't believe it's the postie as there's huge organisation behind him with many faults. On the flip-side of that I also realise that with the details Marstons had been provided by DVLA, they could have found more reliable contact details within sixty seconds on a web search. My name is unusual and unique so there's an extremely high probability a PM on Twitter is reaching the right person. e.g "Are you [my full name]? If you are could you call us please so we can verify who you are and talk about a serious situation."

It's also interesting that I suspect the collection agents were originally going to probably look to seize the vehicle as payment, but when I sold it at the beginning of August unaware of all the events that had happened, that loophole was closed. I wonder if that precipitated the doorstep visit?

Regardless I got the details of Hereford magistrates court and tried a call to them and "HMCTS". Hereford clerks first tried to pass me to the county courts, which just isn't appropriate in a criminal case. Then I asked them about HMCTS and they didn't know what I meant. Some google-fu later and I'm speaking to HMCTS. In Birmingham.

A real legal tour of the region.

The clerks there were pretty patient, probably happy to speak to someone who wasn't in tears or swearing I suspect, and helped me file for a statuatory declaration (SD). The SD is the medium by which a conviction and and following actions are unwound. If you've simply ignored the situation I'm afraid this isn't going to do you any good - it's designed for those scenarios where communication has broken down and service has not been delivered.

The last thing I had time for on the Monday was to venture into more familiar territory; raise a SAR and a FOIR. The SAR was simply to get the DVLA to send - in electronic format to avoid delivery "issues" - all events, documents and details associated with myself and the VRN (whilst I was the registered keeper of course) from November 1st 2018 onwards. Key bit of information we'll come back to that data point.

The original FOIR gave me an opportunity to ask the DVLA how many items are produced and "sent" to registered keepers over a given time frame (since Jan 2018); how many are tracked and how many go missing. Around 0.03% of all items appear to be tracked and they simply don't keep records of how many of the tracked items are returned as "undeliverable". The request isn't yet complete and I've asked for clarification after the authority dodged some questions e.g. what QA is done to ensure the produced documents are all collected by the mail service provider (MSP), and where in the overall process are the most documents lost.

DVLA have committed to some form of response by the 25th of November, and you can see the request in full here.

Back to my week of investigation w/c 16th September; and over the next couple of days I'd spoken to HMCTS in Brum, and had managed to get an SD hearing in for the 27th of September. I was still livid at the DVLA.

I also thought about the follow-on activities of the SD, which I intended to plead "not guilty" and have to mount a defence. I couldn't find much through the usual research channels other than to some cases reported in the press, where the DVLA had lost during the application of common sense by the courts. Not sure they're precedents at that level and the DVLA didn't appeal so they're anecdotal at best. However to me it highlighted that similar situations were happening in 2010 as are today. One of the cases involves someone else using FOIR to forcibly extract the facts from the DVLA too.

Most interesting to me out of all of these is a FOIR made by James Collins in 2009, for almost exactly the same set of circumstances as I've seen. In fact the DVLA appear to have even lost items sent by recorded delivery - after they've been signed for by DVLA. I was impressed that Mr Collins had held DVLA to account but also amazed that the net result showed the DVLA were unable to ensure produced documents get delivered - and that received documents are processed outside of relevant QA processes. For me this was key to the whole problem.

In his case, Mr Collins was found not guilty with the court agreeing that he had fulfilled his obligations; that the DVLA has no statutory powers to compel drivers to chase paperwork sent in. It is firmly the DVLAs responsibility to apply common sense rather than prosecute. Even in 2009 there were calls for the DVLA to become transparent and provide an independent appeal system.

Clearly nothing has changed a decade later. At this point I'm beginning to see the scale of the problem and create a second FOIR focusing on how much the DVLA spends on all its postage and stationary. I wanted to understand how much of the DVLA budget is spent on sending and receiving (processing inbound) documents in order to balance the initial assessment on their document processing errors.

I asked the DVLA to provide their budget for the previous and current financial periods; as well as a breakdown of items such as envelopes and document printing relating to registered keepers. On the 25th of October, the DVLA belatedly respond attempting to claim the information was too difficult to acquire. I call cow poo.

I know that if I'm defining costs or doing programme budget projections for my clients and need some stats from their finance teams, I can get almost all details whilst I wait over the phone. I challenged the DVLA to reconsider their response with an internal review and you can see the latest on this one here.

The Defence

So a couple of months on in November and progress has been made. The Birmingham Magistrate agreed my SD, entered my "not guilty" plea and had the previous conviction and fines set aside. The moment I explained that I'd sent the V890 in twice and even had a back-dated acknowledgement the atmosphere in the courtroom changed. Immediately the intention was to set up a case management hearing, rather than go straight to the trial hearing. The magistrate was even kind enough to delay this CM until after the dates the DVLA claimed it would respond to my SAR and FOIRs.

The DVLA eventually responded to my SAR using a secure email system - quite why they don't use this for more use cases including replacing postal SORN's is mind-blowing. Of most interesting to me was that whilst they provided the copies of the documents specifically associated with the case (and nothing else), they provided the timeline as a reference.

This in itself is damning. They acknowledge receiving my duplicate SORN on 21st January 2019. The next date is the 1st of March... where they note that the V890 was ..."resent to Vehicle Input [sic] as they may not have been sent as previously stated.". Quoi???

Hang on so they received my second V890 and admit it took them nearly six weeks to pass it from the Enforcement department to their own VI department to update the record? Hmmm. More interesting is that, a week later when VI actually process the V890, this update is either not noted by the Enforcement department in charge of working with DVLA prosecutors, or automated decision making (ADM) is at play. 

Bear in mind that there are provisions of data protection law which require safeguards in ADM for example GDPR Article 22 section 4 generally, and DPA 2019 Part 2 section 14(2) relating to "significant decisions".

Therefore either the DVLA have failed to deliver an ADM solution with safeguards it is required to by law, or the staff of it's enforcement division are trained to focus on fines and revenue rather than the application of common sense. DPA-breaching systems or inadequate staff?

According to the timeline, the DVLA prosecutor then appears to continue with prosecution in my case, as I hadn't paid a fine I had no idea at the time was allegedly due. For an infringement the DVLA had already acknowledged did not exist by pre-dating my SORN to 14th December 2018.

My defence centred around the fact that I am not obliged to chase the DVLA, nor do they have any statutory power to compel me to possess a valid V5C (as long as the registered keepers details are up-to-date) - for which they charge £25 for replacements. Which they lost to start with. I even sent them a request for a new one with cheque a couple of years ago. Cheque wasn't cashed and I didn't receive a new V5C either. So the only route left open to me was the postal route I'd used. Their direction, not mine.

The evidence provided by the DVLA themselves paints a picture of a disorganised and unreliable document processing approach, which is far from fit for purpose.

I also focused on the fact that the prosecution could not say with any certainty that the warnings, notices & service documents had actually been sent - nor could they or their MSP's prove that they had.

To the contrary - the DVLA appeared to employ bullying tactics with the sole aim of increasing revenue, rather than applying a pragmatic approach which allows an independant review & challenge process - without utilising debt collectors and the courts. I collated a 23 page document of skeleton arguments and evidence, which contained numerous admissions by the DVLA that they simply had no idea how many documents were either received by their recipients; or processed correctly once received in Swansea.

Therefore the prosecution had failed to adequately notify or serve single justice forms, after losing my original SORN and attempted to criminalise me for their mistake.

After review from a legal professional, the situation looked extremely promising for my plea of not guilty to succeed. I expected to be in a position to ask the court to make a costs order in my favour if I won. I also expected that if I lost arguing my own case, I would request leave to appeal on the grounds that there was such a substantial amount of documentation to support the case that I would need a proper lawyer to organise and represent it properly (essentially the appeal would rely on evidence not seen previously thusly new evidence). Cases on appeal can unlock awards for legal fees amongst other things, which can be a useful weapon to wield.

Outcomes & Reflections

Ultimately I never got the chance to have my day in court.

I'm not sure if word had reached the prosecutors office of the FOIRs and SAR, or they could just plainly see that the Enforcement department had tied themselves in knots. They withdrew the charge - although the Birmingham Magistrate said I "must attend" the case management hearing in Redditch, and I wasn't about to start trusting the DVLA when they claimed I "did not need to attend".

So I turned up on 4th November 2019, and the usher let me know the case had been discontinued. I was able, however, to speak to the DVLA prosecutor John [Dursely / Dyson? - Apologies I didn't take note of your name]. He brought his laptop in and confirmed some of the details, explaining that a colleague had reviewed the case after the SD was cleared and decided that the "pragmatic approach" - seeing that I had submitted the SORN after all - was to withdraw the charge. When the prosecutor attempted to show me that they'd sent warnings in December 2018, it occurred to me that the SAR response had omitted a lot of events, documents and data. It took the prosecutor all of a few seconds to find this information whilst we were talking.

I only got a brief look at his screen but it appeared to be either an Oracle Forms or VB application judging by the button implementation and layout.

I didn't say much in the room at the time but I suspect they realised I wasn't going to drop it, and show that they were just as culpable as they had been ten years ago in a public courtroom. Perhaps Mr. Collins' case has stuck in their memory. Better to spend their time on a case where actual criminality may have occurred.

HMCTS sent me cheques for the refunded fines and fees; I sent Martsons an invoice for the rest which they transferred back to me in relative short order. However I spent just under five man-days working on the investigation, putting together my own defence; around an entire working day traveling to-and-from various hearings; around £60 on printing my legal documents for the hearings and so forth. I haven't received a rebate on prorata-ed car tax from December 2018 nor August 2019 from the DVLA.

In all likelihood I'll  raise a complaint and offer the DVLA the opportunity to compensate me for damages and distress caused; I'll have to think about the potential loss of earnings. I wonder how many of the tens (hundreds?) of contract notification emails I'd watched throughout September, unable to apply a bid and the resulting potential loss of revenue.

I'm also still waiting for the rest of the information I asked for in my SAR. Two chasers and no further response. So that's one refused FOIR (assuming DVLA refuse to revisit), one failed SAR and a questionable data practice to discuss with ICO in coming weeks too. I've won the case but I'm not going to drop the data protection issues.

The DVLA are always so forthright with us motorists yet seem unable to discharge their responsibilities under the law. I get the distinct impression that had I not fought it I would have been fined for no reason.

I'm not sure how much they spend on filing fees for cases they don't win, possibly something for a FOIR on another day, but this appears to be a massive overspend of taxpayers money. Why not have an independent arbitration panel that gives motorists a fixed period to challenge a fine? If prosecution is the result the date of the offence won't change. Mind you, it won't make a difference if you don't ensure the documents are delivered. Why aren't they storing the email we give them for notification of successful payment of tax, for use with warnings and similar?

The DVLA really do not have any legal power to compel you to chase them - once you've fulfilled your responsibilities properly everything that follows is their own doing. I'm not suggesting you take any chances but certainly don't let their bullying tactics over fines sway you, their inbound call centre is apparently only there for payments and collections. Not SORNs ironically.

Challenge them all where challenge is due. Although if you've genuinely just messed up then I'm afraid that's on you!

Working in digital and IT industries, I'm also amazed that the DVLA hasn't provided a more efficient and sustainable approach to document management. Some things you literally cannot do online or in the post office.

Perhaps this is a good time to note that the disastrous IR35 Intermediaries legislation decimated the pools of project-based consultants in public sector organisations; which may explain why their IT hasn't moved on much in years.

Shocking Stuff

For the last five months we've been trying to get shot of Scottish Power. We tried every crazy approach you could try - telling them we didn't want to transfer the account to the new address; telling them we no longer wanted to use their services; asking them to close the old account at the previous address (or the current address as it was at the time).

Sadly all of these things were too complicated and meant that SP would ignore our instructions.

We asked them just to close the account at the end of our fixed rate tariff before we moved out of our old house, and enquired about the estimates for our new house.... which made us run away very fast. We also made the mistake of letting SP know our new address. I remember a phone call with one of their representatives that ended with me saying, "So there's no more paperwork needed; I don't need to cancel and house move requests or anything, that's it - you'll close the account and we'll hear nothing more from you?".

"Yes", was the confident reply.

Enter a new supplier (not one of the big six) who had supplied the previous owner; it was easy to sign up and sort out the tariffs, payment details etc and send them meter readings by replying to the emails their system sent us - no need to log in to your account...or rather forget what the password and user name was, request a reset, then reset it all, then login, then try and remember what the hell you were doing to start with and; finally update the meter readings.

However not all was as simple as it could have been ... we started getting letters and emails from SP at the new address saying how nice it will be to move our account for us and could we send our meter readings for the ... er fellas? What are you doing? We said "jog on" a couple of months ago, yet now you seem to have ignored that conversation and followed us home like some sort of deranged acquaintance we talked to that one time in the bar to be polite but were very clear that were not inviting home and...

I called our new supplier and they told us that this is a Tom Jones with the big six (it's not unusual...); often they have to let the other company take the account then claim it back some weeks later. I told them that they absolutely had our consent to do this and that SP had been told to close the account.

"No problem. You don't even have to speak to them again. We'll sort it out for you - but it might take up to 6 weeks or so". And they were true to their word (along with comedic unofficial comments about their competitor).

So now five months after the first calls to SP we're away but still they send us letters asking us to come back - despite being far more expensive that our supplier.

Sorry Scottish Power: It's not us - it's you. We need some time* to ourselves.

Outta here

* Where "time" is measured in periods of no less than twenty five years.

Progress Part 3

...carrying on from Part 2:

After a fair amount of digging and acquisition of evidence via SAR, I now had enough to make an informed decision on whether or not to take legal action.

To me this was a serious and significant breach far in excess of a normal situation. It was above and beyond the usual spam scenario as I had been subscribed to services I had not consented, and been forced into subscription policies I had not reviewed (or even known about). Essentially as a self-employed worker my resume is my sales pitch - if my competition gets a hold of it they could refactor parts of my resume approach into their own and I would potentially lose my competitive edge (my unique selling points) and therefore lose revenue. Having some unknowns in Pakistan scraping these details from jobs boards for free, then selling them on to the highest bidder beggars belief.

What really pushed the decision for me was when another person with whom I'd had contact reported that another flurry of negative Twitter-verse activity had occurred that week - for exactly the same reason as in December and January. Even after all the correspondence and negative feedback they were still doing it. Someone had to do something.

If you find yourself in a similar situation and decide to press for damages in the courts take the following points into consideration:

• Have a list of items for damages, each with supporting evidence
• Make sure you can explain each item on this list to the courts - who may not necessarily share your understanding of data, it's management or ownership
• Be prepared for legal aggression from the outset. A standard trick across all specialisms of law seems to be an initial threat of return action
• If there is a clear and describable breach of the DPA and / or PECR with evidence the defendant is still breaking the law, so do not take the defendants legal representatives threats as fact
• A number of people I know in law - including relatives - have reminded me that there are guidelines for dealing with aggression. The Law Society has this LiP page, of particular interest is section 3.1
• Get a copy of the consent form you signed for the organisation in question to hold your data. They won't be able to provide this of course, because you never gave your consent

I had some very good opinions from a lawyer I found online who specialises in this particular area of law. Although he was clear that he could not provide guidance or advice he gave me some good, solid facts and great reference material.

So the chain of events was a breach of the DPA and PECR, confirmed with evidence in writing from the defendant. I also maintained a list of damages covering the initial damage claim (£500, plus £35 costs) which was in excess of £1000. The aim were was to provide the courts with a list of items and the courts would decided which of these was recoverable. After no response for four weeks to a Notice-Before-Action (NBA) notification I raised papers via MCOL - which took less than 10 minutes.

I claimed nominal damages from My Job Matcher and we settled for £400 (plus court costs). Most of the time the defendant will try and get you to sign a gag order - it'll have some covenants such as deleting tweets, blog posts or publications, and a form of no-contact directive.

I negotiated the settlement with MJMs legal team (Birketts) without the gag order - One thing I should make clear in the interests of fairness is that they settled without admitting liability to the claim. Whilst I was fully prepared for the day in court it was a relief to settle.

My Job Matchers Twitter profile no longer seems to be under heavy fire from complainants but still sees the occasional "WTF?" sent to it, after a few weeks the SEO team at MJM just stopped replying to them all anyway. I know I'm not the only person to litigate against MJM so perhaps our objective was achieved (update: apparently not).

It's just a shame people have to resort to this to stop the illegal re-use of their personal details; however taking a more aggressive approach is having a substantial effect on my inbox. I'm not going to suggest that direct legal action should be your first approach - in fact it should be your last resort. ICO is almost entirely ineffective from what I've seen so far but the ASA appears to be able to apply some more pressure. I've even involved trading standards in one case.

I got the following email from MJM shortly after the settlement cheque cleared (others got a "How did we do?" support service email), and after the no-contact agreement was exchanged. The irony again here wasn't the email recipient wasn't the account they'd stolen from 2007, nor was it the one from the support email chain.

Progress Part 2

After starting to get responses back from MJM support the picture had become clearer. Being nice with your SARs goes a long way - in fact if you were to be as rude and obstructive as most organisations receiving SARs are, a court would not look kindly on your summons.

So whilst they were being helpful I congratulated them on their approach and noted a couple of things to myself:

1. The resume attached was from 2007
2. When I went to their website and password-reset-logged-in I found contact and personal information also dating back to 2007
3. Whilst writing this section of the blog post I checked to see if I could download the attachment again three months later....and I can; despite MJMs insistence that it would be removed in due course

 These simple facts completely countermanded the response statement; which I assume is partly a canned reply / policy statement. In short, it demonstrated a complete disregard for anything approaching respect for privacy or data. Have a look at this ICO guidance document if you don't believe me.

My Job Matcher did confirm that Manz Online (part of the RecSmart Recruitment Ltd fold) was the source. Of course not only had I never heard of them but I'd certainly be able to prove the lack of consent or chain of privilege from me to their databases.

Quick bit of research showed that Manz is based in Lahore and does not fall under the remit of the Data Protection Act (UK) or Privacy and Electronic Communications Regulations (EU). This is of course just conjecture but it would almost seem like the use of offshore lead generation firms was intentional to inflate subscriber numbers; which would mean a greater appeal to investors or other job seekers in the market perhaps. That is a rather pessimistic opinion but one that was suggested by another MJM spam-ee.

@01herbert01 Me too, suddenly all these emails from "My Job Matcher", claiming they got my email from "360 Resourcing", whatever that is.

— Matthew Gordon (@mgrxnz) April 7, 2015

Of course 360 Resourcing are UK based and would therefore be under purview of DPA and PECR; had MJM acquired my details from someone like 360 I could then take action against both MJM and 360 after some investigation.

If you were in a similar situation with Manz Online feel free to get in touch with their director Zak Ahmed on Google+. It's a dead-end to the search for data sources.

On To Part 3 Or Back to Part 1

Progress Part 1

Background

Back in April I mentioned on another blog that I'd encountered a more extreme example of breach of DPA / PECR and would be taking the matter more seriously.

Now the dust has settled I can speak more about it and add details / guidance principals.

In most cases I'm more than happy to rifle through company details, back-check organisation structures and determine the actual origin of the spam. Often it reveals that someone somewhere is trying to make a fast buck from your personal information without consent - and without compensating you for the pleasure.

Usually a combination of ASA and ICO complaints ensure that you'll never hear from the spammers again but occasionally someone really takes the biscuit.

Hand In The Cookie Jar

Twitter is an enourmously useful tool as it can augment your own opinions on a brand, organsiation, person or fact with a vast variety of 140 character masterpieces. When I started getting unsolicited emails from MyJobMatcher in January 2015 I noticed that there was a large group of people in the same situation - having been emailed job adverts from a company we'd never heard of, never subscrubed to and never given any kind of consent for any of the above.

So...no accounts had been compromised but personal information had. Maybe a recruiter got hacked or a jobs board?

Others have also blogged about the specifics of the privacy breach so I'll leave you to read their posts

Twitter's thoughts on new careers site @MyJobMatcher - http://t.co/vXFTrnWRkE

— Steve Higgins (@Higgypop) March 24, 2015

There were many more simply questioning the approach....

@ICOnews please investigate http://t.co/9ExEnG9ydb and http://t.co/GD3P1e1YIZ who passed @MyJobMatcher subjects' details w/o permission

— Tim Glynn (@thestigs_cousin) March 30, 2015

@DBMediaUK @officialjacwild They've been at it for a while. Claiming they bought data from "verified" offshore source outside of the EU

— Rex Lampier (@thread_puller) March 23, 2015

But simply search Twitter for MyJobMatcher from early January to April for more of the same.

I got in touch with MJM with an initial Subject Access Request (SAR) to find out who they were and what personal information they had....And although I got an auto-response from their support system to say the message had been received (v. useful in DPA / PECR cases) I heard nothing for a week, yet continued to get spam about jobs that had very little relevance.

Before raising an ICO or ASA complaint it's better to check what details are involved and how they arrived at their destination. I can say with confidence that I don't subscribe to newsletters nor do I enter prize draws so know the usual flagrant response of "...you must have signed up for it somewhere..." won't fly.

First up someone on Twitter suggested getting in touch with Mandrill at help@mandrill.com - they were nice as pie and sorted out the spam straightaway. I coul dhit "unsubscribe" but it's better to hit the distributor so they know there are other issues with a particular client. In other cases I've been involved with companies have been banned from using marketing distributors entirely because of this.

I'm going to ramble on a fair bit so will break the posts down into chunks.

On to part 2

Council Tax: The Saga Continues

So despite being promised a response with 15 working days by Lisa Atkins ... I've received nothing. Perhaps they want to sweep the whole affair under the carpet? No-one likes seeing their ineptitude blogged about.

I may prod them next week after I've finished laughing about the "new" iPhone.

Information *Is* The Commodity

You're about to set out from the world of permanent employment and embark on contract work. Awesome! You know your tech-stuff and are chomping at the bit to ply your trade as a gun for hire...but are you savvy when it comes to negotiation and recruiters? Sure, you're confident in your technical skills, but do you know how to be a top-class salesperson too?

It struck me recently that there are perhaps less experienced people being taken for a ride by the seedier agents out there. If you've been doing this for some time or have also read the Toe-Rag Recruiter Playbook™ you probably won't be interested in what follows.

All I'd like to do with this post is provide a few tips and explain why some agents might ask some seemingly innocuous questions. After a number of years learning from my own mistakes I've built some very good relationships with particular agents I trust - They've even helped my out by explaining some of these areas, and over the years a few have even become mates.

It should also be pointed out that not all recruiters are used car salesmen, generally it's more likely to be one or two people at a handful of agencies here and there. We each have our own personal preferences about who we like to work with and who gets us the best rate, so I'm not going to insult your intelligence by telling you who to use and who to avoid.

This isn't about naming and shaming either - It turns out the Del Boy stereotypes out there are known to all anyway. A mate of mine (a recruiter) also pointed out that the recruitment industry is there to make peoples lives better - via career and monetary advancement. He's right and he also pointed out that, like anyone, there's bills to pay and sometimes people stoop low to keep the wolves at bay. There's plenty of good websites where people can share their views such as Contractor UK - some particularly good advice across a range of topics and forums.

Before we start though, don't start treating recruiters like cold war-era spies trying to steal the toast off a grannies breakfast plate. Treat recruiters with the same professionalism and respect you'd use for clients or potential new bosses (it doesn't matter whether it's returned, just stay positive and professional). Remember: recruiters are your friends, they're most likely to be the people that'll get you that next job.

Terms and Conditions

Make sure you fully understand the implications of payment terms before you sign a contract. When are time-sheets due? How often are invoices processed and paid? What happens if you miss a time-sheet & invoice deadline by an hour? Are the agency willing to be flexible once or twice?
Ideally look for an agency who accept weekly invoices, pay weekly and don't stipulate daft paperwork requirements like "your time-sheet and invoice have to be in on the Friday lunchtime for the same week".
Once you've signed that contract you can't change it until renewal time looms.
Sometimes you have to compromise to get that rate or a contract to get you commercial experience with something. It all swings in roundabouts.
Another discussion here which may give you some more ideas.

LinkedIn Contacts

Ah, such a good idea.
Ever noticed that pretty much only recruiters write updates on LinkedIn? Sure there's big companies selling stuff, job openings and some great groups but most of the time that recruiter who's just massaged your ego a bit will shortly send you a LinkedIn request.
What you may not realise is that following that they'll probably work their way through your contact list and find your current boss, your previous bosses, colleagues who may be hiring and other potential candidates (i.e. your competition).
It shouldn't have surprised me so much I guess, but when I hid my contacts the next few agencies who sent connection requests called or emailed less than thirty minutes later asking if any of my colleagues were also hiring. Pretty much because they discovered they could't access my contacts or associated profiles.
Hide your contacts list on LinkedIn from everyone and control the flow of information as you see fit. Hide the "Viewers of this profile also viewed..." box in the same way too. It's only used for the same purpose.
This one is up to you, you're potentially offering up information on your own competition.

Job Specifications

This one's a bit trickier as not all vacancies will have a formal job spec. For example, there might just be a company telling a recruiter to find them a Java developer with WebSphere experience. Just be aware that agencies advertising a role that doesn't have a job spec *may* not actually have that role on their books. It's not always the case but they may have used any number of methods to try and get their foot in the door, firing across some prospective candidates to a potential client.
Mind you, there's nothing to stop the agency amalgamating a few existing job specs into one fictitious one so there's plenty of ways around it.
They may also just be trying to fish for candidates to represent for roles that haven't fully materialised yet. Either way ask for a job spec and confirmation of rate / package - If they claim not to have one yet and you've not worked with that particular agent before, be a little cautious.

References

One particularly annoying ploy for a hiring manager is when you get cold calls / emails from an agent you've never worked with, asking what sort of candidate you're looking for with regards a vacancy either you've just filled or have never advertised. How did they find out?
You always get genuine agents you actually want to work with buried under all sorts of tat and unrelated connection requests.
One tactic is to advertise a fictitious role and asked for references from applicants. Maybe a day or so later that role "magically" gets either withdrawn, filled by another agency or the agent "can't get hold of the client" - usually it didn't exist in the first place. However, in that time, the applicant is sent a job spec for another role...But the agent's now got their foot in the door with a new potential client or contractor directed by your references. Granted, that is a worst-case scenario but it does happen.
They may ask your referee for the reference but will tag on a business enquiry offering their services on the end. They may tell you it's a requirement to validate candidates; honest conversations between agencies and hiring managers usually end up with an agreement that an agency can only screen technical candidates so far, the rest is up to the interviewer to assess (i.e. references often have little to do with it).
Bear in mind that this isn't always the case - Speculative applications are very different to applying for live roles. In this scenario if you already have recommendations or testamonials, supply these to the agency omitting the names and organisations of the referees. Often those agencies working on a more pro-active basis will like to create a sales pitch about you, backed up with real-world opinions. This is a great approach for speculative applications on your behalf and has worked well for me in the past.
There is no company in the UK (possibly Europe too) who requires references with an application from an agency. Even government or security-cleared roles with checking processes have a more direct approach to references which are far more formal.
Usually the person at the client organisation interviewing you will ask for references if they're needed at all - It varies, some hiring processes require it post initial interview, some don't at all.
Professional networking sites often have a recommendations feature which is a reasonable compromise (most people are happy to act as referees if they just don't want to make a public recommendation).

You may get into a situation where the agent tells you that they can't submit you for a role without references as it's "a requirement from the client". This is cow poo. Challenge them: Ask them if they're happy for you to approach the client directly as you understand they cannot represent you in this instance due to their own processes.
You'll be surprised how often "all of a sudden" they find a loophole and your resume is on the clients desk for review. More importantly, if that doesn't happen don't reconsider and don't dwell on it. You're almost certain to have a conversation with that agent straight afterwards about another role which "may also suit". If you don't, there's a hell of a lot of agencies out there who will work with you.
Tell agencies who've asked you for this that you'd be very happy to supply a list of referees *directly* to their client when the time comes.

Who Was....

I hate these questions. It's like they're cringing with embarrassment at the other end of the phone for even asking it, just to see if they can get away with it.
You'll be asked who you worked for (sometimes tied in with requests for references), who you worked with, whether they're hiring at the moment or how the business is doing in general.
Don't mention names - or even job titles - This is just another ploy to generate leads / new business by contacting the people you mention in this scenario. It won't make any difference to your application for a role at all.
When you have an interview arranged via another agency be honest about the fact - Just don't disclose which company it's with or who you're going to be interviewed by. Always let them know how it went and where the land lies going forward though. See point #5 in the summary below.

You Don't Want To Work There...

Often when a recruiter knows you're going for an interview they'll ask who it's with, who you're meeting, what kind of role it is, what the interviewers favourite colour is, how many fingers they have....

However, often that follows with something along the lines of:
[Agent] "Well good luck with the interview, I'm sure they'll hire you after spending any length of time speaking to you. If you don't mind me asking, who's it with?"
[Candidate] "It's an interview with Daves Websites Plc in Exeter"
[Agent] "Oh ok, I've heard of them - who's interviewing you?"
[Candidate] "Erm, I think it's a guy called Horatio Hornblower."
[Agent] "Ah right. That's interesting."
-Oscar winning pause and change of tone-
[Agent] "Just so you're aware, I've heard some interesting things about DW Plc, lots of people have left there recently because of the environment"
[Candidate] "What do you mean? Is it really that bad?"

At that point even if you don't believe them it starts making you think. Score one for Johnny Recruiter. It's an age-old tactic and a lot of agents try this at one time or another. For me I see it as an unprofessional mechanism to steer candidates back to their own vacancies. It's a *real* annoyance when you're trying to hire people.
Even if it is the same thing as politicians running negative campaigns against one another,  they're in business to make money from you, the product, so gloss over it and keep the relationship positive. It's just one of those things that's to be expected and it's no big deal.
Try speaking to contacts and getting first-hand opinions if you're getting concerned. For permanent jobs, carefully phrase some difficult questions about working practises during interiews. Disguise questions about how many people have left / joined with topics on how fast the teams are growing, how often people stay late at work and why the role is open in the first place.

If you're a recruiter reading this who's actually tried the steering tactic: Bad dog. No biscuit for you.

Tips and Summary

So as an overview, eight points to consider - Remember it's not a rule book or a doctrine but just some suggestions:

1. Hide your contacts list from everyone on LinkedIn (or any other professional networking product). Do the same with the "Viewers of this profile also viewed" box too
2. Never give references to agencies, only ever directly to a potential client. It doesn't benefit you in any way to do otherwise no matter what the recruiter might tell you
3. Always get a job spec before you hand across too much information
4. Never disclose who your line manager was, who's job title was what, which directors deal with what, which other managers deal with which area of the business....It's just lead generation. You can always use this info as a bargaining chip if you like as an incentive to get the agent working for you, but that's your choice
5. Don't disclose the organisation or name of the contact for interviews you will be attending. It's none of their business (they get shirty when you disclose their clients to other agents so it shouldn't work the other way round either). Do let them know you have irons in the fire though, that can help move things along
6. Any time an agent tells you to avoid or be wary of a particular company, press them for the source of the references and take with pinch of salt. Also realise you should have followed point #5 and slap yourself in the face for not doing so
7. Never discuss your rate with anyone but the agent and your accountant. Not even your mates or your boss (even though your boss should already know). Bad for business and come negotiation time it'll only hurt you. You never know who your mates' mates are, or who *their* mates know either (the "it's a very small world principal")
8. Most importantly, be honest with recruiters about yourself, your skill set, what sort of roles you're currently capable of and whether you've been submitted before. You'll only make them look bad and less likely to talk to you again if you don't. That trust relationship works both ways.

If you're reading this and strongly disagree, I'd love to hear from you. The topic is an open book based on both my own experiences and [horror] story swapping with peers.

Conversely, if you're reading this and have your own experiences to add it'd be great to hear from you - Please keep it constructive and informative though :)