Yep. I've been a victim of this
I had a fine notice from an ANPR (Automatic Number Plate Recognition) controlled car park recently. The notice said I had parked without buying a ticket. The tone of the notice was extremely threatening. They had obtained my owner details by sending my registration to DVLA and buying my info. This is what constitutes "reasonable cause" to the DVLA. I was given no prior notification (IE, no ticket was put on my car), and wasn't given an option to "opt out" of this illegal selling of my data to a private third party.
There are strict DVLA guidelines which say prior notice SHOULD be given to the person whose data is to be requested, however these voluntary guidelines a routinely ignored, and the DVLA apparently are "powerless" to do anything about it.
Of course, I couldn't prove I'd bought a parking ticket, because by the time the fine notice was issued, three weeks after the alleged parking violation, I'd disposed of the ticket.
When I wrote an equally threatening letter back to the ticket issuers, it turned out that there was something wrong with their ANPR software (suprirse surprise!) - Yes, I HAD bought a parking ticket. they simply rolled over an rescinded the parking fine.
So I can testify that the system is being abused by those using it.
Let's try a couple of hypotheticals out.
1] I see a nice Bentley in a car park somewhere,think "here's somebody with a few quid" - For £5 I can get enough information from DVLA to steal the owner's identity.
2] I'm a violent abuser, who wants to locate my ex-girlfriend who has taken out a restraining order on me. Simple, Just give my ex-girlfriend' reg to DVLA, and they'll tell me where she's living.
ID cards Mr Brown? If you can't keep my address safe, there's no way you're getting my DNA.