Re: You are not a number plate
Remember DPA rules; whether information is "personal" or not can depend on what other information is in your possession.
For most people, these photos are not "personal" data as one has no other data with which it can be related to identify any individual.
For the DVLA and the parking lot, they posses the additional data to relate to an individual.
So while this parking lot have arguably failed to store personal data with adequate security, it's also arguable that someone republishing the very same photos is not dealing with personal data.