The legitimacy of the government agency's practice of selling data has been challenged by the Mail on Sunday, the government's own Department for Constitutional Affairs, MPs and civil rights organisation Liberty.
The Driver and Vehicle Licensing Agency has come under scrutiny from the Mail on Sunday following the conviction for extortion in July of two directors of a wheel-clamping company to which the DVLA sold personal data.
The newspaper found that 157 firms have been approved to buy data from the DVLA, but the government agency does not check whether the directors of companies it sells data to have criminal records. The firms include debt collectors, property management companies, leisure centres and solicitors.
MBNA Europe is among the 157 firms on the list, but it denied it could access the list. However, the DVLA said it was allowed to do so because it had a private car park at its Chester offices.
In a report published at the weekend, the paper claimed that it confronted the DVLA with its evidence, forcing it to check for criminal records in future, although it refused to say that a criminal record would prevent it selling data.
The DVLA argues that it has a legal obligation to sell driver data to anyone who can show "reasonable cause" for possessing it.
An Information Commissioner's Office spokeswoman told Brand Republic that despite having worked closely with the DVLA, it was not aware the agency had sold personal data to companies where directors had criminal records.
She confirmed that the ICO would be investigating the DVLA, as assistant information commissioner Jonathan Bamford told the Mail on Sunday.
"We will be taking this up with the DVLA to find out why they think this is covered by the 'reasonable cause' provision. We police the Data Protection Act, but we don't have any power to issue 'stop now' orders. We will use the powers we have to find out what's going on urgently," Bamford said.
The Department for Constitutional Affairs, which has responsibility for ensuring rights relating to data protection laws, criticised the DVLA. A DCA spokesman said: "In our view, there is nothing in the Data Protection Act that allows people or organisations to give out these personal details."
The DVLA yesterday stated that it does not release information from its driver record, only from its vehicle record and only when reasonable cause, such as a motoring offence, can be demonstrated.
If you have an opinion on this or any other issue raised on Brand Republic, join the debate in the .