LETTER OF COMPLAINT TO ICO Dear Information Commissioner’s Office
I write to lodge a formal complaint against Transport for London (TfL) concerning its handling of payment card data within the taxi and private hire licensing application process. I have raised this matter directly with TfL under reference PDP-2526-0196. However, I consider TfL’s response to be inadequate and failing to properly address serious data protection risks.
Summary of the issue
TfL provides applicants with a paper licensing application form, which includes a payment section requiring applicants to submit, in a single document, the following information:
l Full payment card number lCard start and expiry dates lCVV/CVC security code lCardholder name l Billing/address details lAuthorised signature
Applicants are instructed to send this information via standard postal services.
Core concerns
In my view, this constitutes high-risk processing of personal data and payment credentials, raising significant concerns under the UK GDPR, particularly:
Article 5(1)(f) (Integrity and Confidentiality) – The aggregation of full card credentials with identity data in a paper format creates a clear and foreseeable risk of misuse, including card-not-present fraud.
Article 32 (Security of Processing) – The use of postal transmission and manual handling appears inconsistent with the requirement to implement appropriate technical and organisational measures.
Data minimisation and necessity principles – Collecting full card details including CVV/CVC in this manner appears excessive given the availability of more secure alternatives.
Additionally, this workflow appears inconsistent with widely accepted PCI DSS standards, particularly regarding the handling of CVV/CVC data.
Concerns regarding TfL’s response TfL has responded by stating that:
l Submission of card details on paper is “optional” l Applications are processed in a PCI DSS-compliant contact centre
l Alternative payment methods exist 28 However, this response does not address the fundamental issue:
The continued operation of a system that permits (and facilitates) the transmission of complete card credentials via post and their handling in paper form.
Crucially, TfL has not provided:
1. Clear confirmation of whether CVV/CVC data is retained, stored, or processed after receipt
2. Details of how risks inherent in postal transmission are mitigated
3. Evidence of a Data Protection Impact Assessment (DPIA) or risk assessment
4. Clarification of PCI DSS scope and compliance for this specific workflow
5. Any indication that the process has been suspended or modified pending review
The existence of alternative payment options does not, in my view, cure the lawfulness or security deficiencies of the process itself.
Ongoing risk
This is not a historic issue. The process remains operational, meaning that individuals are currently being exposed to unnecessary and avoidable data security risks.
Request to the ICO I respectfully request that the ICO:
l Investigate whether TfL’s processing complies with UK GDPR, particularly Articles 5 and 32
l Assess whether the collection and handling of full card details (including CVV/CVC) via paper forms is lawful and proportionate
l Examine TfL’s PCI DSS compliance in relation to this workflow
l Determine whether TfL has conducted an adequate DPIA or risk assessment
lConsider whether enforcement action or recom- mendations are appropriate
I have provided copies of correspondence, the application form, and TfL’s responses to assist your investigation.
Given the clear and ongoing nature of the risk, I would be grateful if this matter could be treated with appropriate urgency.
Yours faithfully Christopher Johnson Veteran London hackney driver
APRIL 2026 PHTM
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72 |
Page 73 |
Page 74 |
Page 75 |
Page 76
