UKPC - Aylesbury Shopping Centre

1505grandad

Thank you.


OK - although I understand why, as I can't seem to get any interest to deal with it off forum, I have, as planned, (after a very busy week) prepared emails to the BPA and DVLA attaching a .pdf doc. of the ICO assessment.


Do any of the experts/regulars think it will be o.k./helpful, or otherwise, if I post the gist of the emails I have prepared, on the open forum?


I realise, as above, that of course members are more concerned with getting existing PCNs cancelled etc. and the PCN in my case has long since been cancelled - thanks to this forum. Also they have their own busy lives and holidays.


Otherwise, after any fine tuning, I will send the emails in the next day or two which, if the "rules" are followed as intended, will make my day. (I had the pleasure of advising the forum last year that the DVLA had advised me during our email exchange that UKPC had been suspended (nothing to do with my complaint) - who knows what, if anything, I may be able to advise in due course?)


After all, I have made it very clear, many times, in one syllable explanations to the BPA, DVLA and also Aviva (the landowners) during my protracted email chains with those organisations that UKPC have breached the DPA.


None of them took any notice, and, especially the BPA and Aviva, told me I was wrong and to go away.


Well, the ICO have agreed with ME. Mind you, I had to keep emphasising why I thought the breach had occurred, (complaint submitted 6th January), when it was escalated at the ICO.


I find this particularly worrying because, until last year I had not even heard of the DPA and the Principles involved, and have no legal training at all. It was only because of comments/posts on this forum that made me look into the matter.


As soon as I read the ICO website re DPA breach complaints, it seemed obvious to me that UKPC had breached the Act in this case.


Yet these organisations, who presumably have legally trained experts, did not believe that any breach had occurred. Aviva's attitude/responses are particularly worrying because their last email to me was from someone who includes "Group General Counsel" in their job title.
The Aviva Group of course is responsible for £billions of millions of customers who rely on their expertise for pensions etc.


Anyway rant over. If anybody available has time and wishes to comment it will be appreciated, even if it is only to advise me to delete this post.


As it has been a particularly busy week, and the hot humid weather earlier did not help, I am a bit shattered. So, off for an early night with a mug of Horlicks and dunking Ginger Nuts, ready to continue tomorrow.


This comment was made because I intended to post last night - but fell asleep!!. Just trying to inject a bit of humour, sadly lacking in the senses of the organisations mentioned above.


Sorry for long post.

Coupon-mad

None of them took any notice, and, especially the BPA and Aviva, told me I was wrong and to go away.

Well, the ICO have agreed with ME. Mind you, I had to keep emphasising why I thought the breach had occurred, (complaint submitted 6th January), when it was escalated at the ICO.

I find this particularly worrying because, until last year I had not even heard of the DPA and the Principles involved, and have no legal training at all. It was only because of comments/posts on this forum that made me look into the matter.

I think you should be commended for persevering to the ICO, spotting the breach and getting them to see it too.

Certainly don't delete your post and if you want to show us the emails so far, please do (but in larger font please!).

1505grandad

Thank you C-M. Sorry, another long post.




EMAIL I SENT TO BPA:-




COMPLAINT - UK PARKING CONTROL LTD BREACH OF DATA PROTECTION ACT - LEVEL 5 SANCTION




[FONT=Calibri, Arial, Helvetica, sans-serif]Dear Sir,[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]I was in protracted email correspondence last year with Ms Gemma Dorans, on behalf of my daughter, Mrs xxxxxxxx, trying to explain to Ms Dorans that UK Parking Control Ltd (UKPC) had breached the Data Protection Act (DPA) - please see attached .pdf document. This was in connection with a Notice to Keeper (NtK) issued in March 2015 to my daughter as registered keeper, and the subsequent correspondence.[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]A response from Ms Dorans in the chain of emails was an email dated 13th October 2015 as follows:-[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]Dear xxxxxxxxxx,[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]BPA – 08092. [/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]I have contacted UKPC regarding the letter from the Landowner and they are unaware of any correspondence sent to the Landowner regarding a ticket issued in 2012.[/FONT]

[FONT=Calibri, Arial, Helvetica, sans-serif]In regards to the data protection issues, you will need to direct your complaint to the Information Commissioners Office. If they believe there has been a breach of the Data Protection Act, please contact us further.[/FONT]

[FONT=Calibri, Arial, Helvetica, sans-serif]Due to the above, we are unable to investigate the matter further and the case is closed.[/FONT]

[FONT=Calibri, Arial, Helvetica, sans-serif]Kind regards[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]Gemma Dorans[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]Customer Services Manager[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]British Parking Association [/FONT]



[FONT=Calibri, Arial, Helvetica, sans-serif]I replied that I had made a complaint to the ICO on behalf of my daughter,[/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]and the ICO have my daughter's authority for me to act on her behalf.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]I have now received the Lead Case Officer's assessment, which is attached as a pdf. document titled [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]ICO Decision Re UKPC Breach DPA.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]As you can see, the ICO have adjudicated that UKPC have breached the DPA [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]THREE TIMES, [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]i.e. Principles 3,4 and 5.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]The chain of emails mentioned above up to mine dated 11th October 2015 are below.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]In my email dated 11the October 2015 I stated:-[/FONT]



[FONT=Calibri, sans-serif]According to the BPA's [/FONT][FONT=Calibri, sans-serif]"AOS Code of Practice Contraventions & Sanctions" [/FONT][FONT=Calibri, sans-serif]document there is sanctions level as follows:-[/FONT]



[FONT=Calibri, Arial, Helvetica, sans-serif]LEVEL 5 [/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]5.1 Failure to comply with the requirements of the Data Protection Act(s)[/FONT]



As you are now in possession of the the ICO's official confirmation that UKPC have indeed failed to comply with the requirements of the DPA, I demand that you take the appropriate actions and sanctions against UKPC in accordance with the above document.



[FONT=Calibri, Arial, Helvetica, sans-serif]I look forward to your reply confirming that the appropriate actions/sanctions have been taken, and what they consisted of, regarding this "serious" level 5 contravention.[/FONT]









I have received the following so far from Gemma Dorans:-






[FONT=Calibri, sans-serif]Thank you for your e-mail, the contents in which are noted. [/FONT]



[FONT=Calibri, sans-serif]I will review the matter and revert shortly. However, please be aware any action we decide to take against our Members will not be shared with members of the public as this is a matter between ourselves and the Operator. [/FONT]
[FONT=Calibri, sans-serif]We will be in touch shortly. [/FONT]
[FONT=Calibri, sans-serif]Kind regards[/FONT]
[FONT=Calibri, sans-serif]Gemma Dorans[/FONT]
[FONT=Calibri, sans-serif]British Parking Association [/FONT]
[FONT=Calibri, sans-serif]Email: [EMAIL="aos@britishparking.co.uk"]aos@britishparking.co.uk[/EMAIL][/FONT]
[FONT=Calibri, sans-serif]Web: [/FONT][FONT=Calibri, sans-serif]www.britishparking.co.uk[/FONT]






EMAIL I SENT TO DVLA (as yet no reply of any sort):-






COMPLAINT - UK PARKING CONTROL LTD BREACH DATA PROTECTION ACT - REQUEST TO STOP KEEPER DETAILS










[FONT=Calibri, Arial, Helvetica, sans-serif]Dear Sir,[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]I refer to the email 14th September 2015, which is in the chain below, from my daughter, Mrs xxxx.[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]In that email it is stated:-[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]I also attach letters dated 18th May and 1st July 2015 from JLL, (via attachments to emails), who are the managing agents of Aylesbury Shopping Park).[/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]

The letter dated 18th May (which I have never received by post) states that a notice issued in 2012 remains unpaid. I had no knowledge of this and eventually after chasing for details, received the letter dated 1st July advising that the charge, which I knew nothing about, had in fact been paid in December 2012.

I therefore again ask that the DVLA stop providing UKPC keeper details for this site as they [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]are in breach of the KADOE contract [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]by not adhering to the BPA Code of Practice - [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]in that proper records have not been kept by UKPC.[/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]I believe it is also a breach of the DPA.[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]On behalf of my daughter I have made a complaint to the Information Commissioner's Office (ICO) concerning the breach of the DPA.[/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]The ICO have my daughters authority for me to act on her behalf.[/FONT]


[FONT=Calibri, Arial, Helvetica, sans-serif]I have now received the Lead Case Officer's assessment, which is attached as a pdf. document titled [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]ICO Decision Re UKPC Breach DPA.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]As you can see, the ICO have adjudicated that UKPC have breached the DPA [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]THREE TIMES, [/FONT][FONT=Calibri, Arial, Helvetica, sans-serif]i.e. Principles 3,4 and 5.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]I shall be pleased therefore if you will take the appropriate action for the DVLA to stop providing UKPC with keeper details in view of the KADOE contract breach etc. mentioned above.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]I have also emailed the BPA demanding they take the appropriate actions/sanctions against UKPC for this serious level 5 contravention.[/FONT]
[FONT=Calibri, Arial, Helvetica, sans-serif]I look forward to your reply confirming what actions you have taken/will be taking.[/FONT]



[FONT=Calibri, Arial, Helvetica, sans-serif]Wonder what, if anything, will be done to "drive up standards"?.[/FONT]

(Formatting not quite as I put in the original document I used to copy/paste for this post)

1505grandad

Well, no surprise - BPA reply to my complaint in above post:-


BPA – 08092.

I have contacted UK Parking Control and reviewed the response you received from the ICO and can advise as follows.

The ICO decided not to take any action against UK Parking Control but made a number of recommendations. I have contacted the Operator regarding the recommendations suggested and they have confirmed as follows.

The ICO suggested that policies and procedures were reviewed and amended and further training provided for members of staff. We have been provided with details on how this has been done and how it will be done on an ongoing basis. In view of this, we are satisfied this recommendation has been fulfilled.

The second recommendation was to ensure Mrs xxxxxx data is not retained for longer than is necessary. Mrs xxxxxx details have already been removed from their records.

The third recommendation was relating to a timeframe to remove the details – as this was already done, no further action is required.

Section 6 of the Code covers non compliance of our Code and the corrective action that we expect. As UK Parking Control have made the appropriate rectification regarding this complaint, no further action will be taken.

Thank you for bringing this matter to our attention. I have closed the investigation.

Kind regards
Gemma Dorans
British Parking Association
Email: aos@britishparking.co.uk
Web: www.britishparking.co.uk

Coupon-mad

The BPA allow their beloved members so much wriggle room that parts of the CoP are advisory only and in some ways, worthless. What's the point of requiring compliance with a CoP then allowing the worse firms to flout it until reported, then let them off?

What's the point of sanctions if breaches of the CoP are so easily brushed under the carpet?

1505grandad

Reply to email complaint to DVLA (stage 1) mentioned above #34 as follows:-


Thank you for your recent email dated 4th August 2016regarding the release of information from the Driver and Vehicle Licensing Agency’s (DVLA) to UPKC.
　
DVLA takes very seriously its duty under the Data Protection Act to protect the privacy of the motorists whose details it holds on its record.
　
In this instance as the ICO (Information Commissioner’s Office) have carried out an independent investigation into the matter with UKPC regarding your daughter’s xxxxxx) case, the DVLA are not in a position to overrule their decision to not take any further action against UKPC at this point. I have thoroughly looked at all the evidence supplied by both UKPC and xxxx and even though as the ICO has noted there have been elements of the DPA that have not been met by UKPC, in this instance they have clearly put actions in place to ensure that this does not occur again in the future. In addition, the DVLA will also make a note of this complaint for future reference.
DVLA cannot regulate practices of private car park companies. The Agency however, accredits trade associations to ensure that those who request information are legitimate companies that operate within an enforceable Code of Practice. ATA’s have responsibility for ensuring compliance with their code of practice.
　
If xxxxxxx would like to place a suppression marker on her driver/vehicle record in order to prevent any further companies or organisations obtaining her details in the future, then she will be required to submit her reasons in writing to our DVRE (Driver Vehicle Record Enquiries) team. She will be required to provide evidence surrounding why she feels that her personal data should not be provided in any instance. DVRE team will then look at the evidence/reasoning supplied in order to make a decision as to whether or not they are able to suppress the record. Please advise xxxxxx that the address to submit her signed letter and evidence too is; DVRE Team, Floor D9, DVLA, Longview road, Swansea, SA6 7JL.
　
I trust my response helps clarify the DVLA’s position further in this matter.
Yours sincerely
Haley Walters
Data Assurance Front Line Manager


(Nice to know you can suppress DVLA data - wonder what would happen if everybody demanded suppression marker)


My reply escalating complaint to CEO DVLA, and their reply, will be posted in due course.

Coupon-mad

1505grandad wrote: »

(Nice to know you can suppress DVLA data - wonder what would happen if everybody demanded suppression marker)

My thoughts exactly...

beamerguy

1505grandad wrote: »

[(Nice to know you can suppress DVLA data - wonder what would happen if everybody demanded suppression marker)[/I]

My reply escalating complaint to CEO DVLA, and their reply, will be posted in due course.

[/SIZE][/FONT][/B]

A suppression marker ??? hmmm, applies to everyone.

So they need a good reason for this.

REASON:
I DO NOT WANT MY DETAILS GIVEN TO SCAMMERS.
What then will be their reply ??

1505grandad

Not happy with DVLA fob-off so sent email escalating complaint to Oliver Morley, CEO of DVLA (stage 2), setting out, point by point, why I feel that KADOE contract breached by UKPC and actions should therefore be taken accordingly, as follows:-
　
Dear Mr Morley,


In the email chain below you will see a complaint I sent to the DVLA concerning UK Parking Control Ltd (UKPC) breaching the KADOE contract.


I attach the reply I received in response. I also attach the ICO assessment referred to in this email.


After a period of indisposition I am now able to respond, as I feel that the reply from the DVLA is a generic template/stock answer to any complaint and does not specifically address my complete complaint.


It may be that I have not explained my complaint clearly enough or that it has been misunderstood.
Either way I shall be pleased if my complaint is escalated and reviewed in accordance with the following, where I set out my reasoning point by point:-


FORMAL COMPLAINT - BREACH OF THE KADOE CONTRACT - UK PARKING CONTROL LTD


My reasoning point by point:-


1) daughter received Notice to Keeper from UKPC in March 2015, as her details as registered keeper were obtained from the DVLA, for this one event only under the KADOE contract. The event related to a parking incident in January 2015 where the occupants did not make sure that a ticket was visible on the vehicles windscreen.


2) the car park allowed 2 hours free parking and the vehicle and occupants left well within the free parking period allowed.


3) my daughter appealed to both UKPC and Aviva PLC (the ultimate landowner) providing receipts for the day proving the occupants were shopping at the retail park.


4) both Aviva and UKPC rejected my daughters appeal.


5) my daughter therefore had to jump through all the hoops and rigmarole of submitting an appeal to POPLA, the official ADR, who had no hesitation in upholding her appeal, despite various frustrations caused by UKPC.


6) during the protracted correspondence with AVIVA they produced a letter (not received by my daughter) stating that UKPC HAD ADVISED THAT A PARKING TICKET WAS OUTSTANDING FROM 2012 AGAINST MY DAUGHTER


7) with my daughters unreserved permission I took over the matter and vehemently denied that she had any knowledge of any outstanding debts of any kind.


8) on further investigation by UKPC/Aviva it was found that this particular parking ticket was in fact paid in December 2012 (a time when my daughter was going through a very traumatic experience).


9) the only details that UKPC had regarding that 2012 parking ticket was that it was against the car now registered to my daughter. UKPC HAD NO IDEA WHO THE REGISTERED KEEPER OF THE VEHICLE WAS IN 2012, AS FULLY EXPLAINED IN THE ICO ASSESSMENT ATTACHED.


10) UKPC obviously therefore used the data supplied by the DVLA in respect of the 2015 parking incident (I.E. FOR THAT ONE EVENT ONLY) to assume that it was relevant to the 2012 parking incident, even though millions of vehicles are bought and sold annually.


AS PART OF MY SUBMISSION TO THE ICO I ENCLOSED AN ANALYSIS OF THE CONSEQUENCES OF SUCH AN ERRONEOUS ACT - PLEASE SEE P.S. AT THE END OF THIS EMAIL.


As the ICO did not reject my analysis I presume that they accepted it.


It is also our belief that had UKPC not unlawfully retained details of the paid 2012 parking incident, and then unlawfully used the data supplied by the DVLA for the 2015 parking event to give the erroneous impression to Aviva that the 2012 ticket was outstanding, Aviva would have been more inclined to cancel the 2015 parking charge.

11) the 2015 data obtained by UKPC was presumably in accordance with the terms of the KADOE contract and for that event only. By using the data supplied by the DVLA in respect of an entirely different event IS IN BREACH OF THE KADOE CONTRACT AND ALSO IN BREACH OF THE DPA AND BPA CODE OF PRACTICE.


This was what I was complaining about in my correspondence in 2015 with the DVLA (referred to in my original complaint), and also to Aviva and the BPA.


All these organisations rejected my complaints. Obviously not willing to take my word at face value. (Please see P.P.S. - Further Thoughts)


12) my daughter and I therefore AGAIN had to jump through all the hoops and rigmarole of making a complaint to the ICO regarding UKPC breaching the DPA.


AS YOU NOW KNOW THE ICO UPHELD THE COMPLAINT FINDING THAT UKPC BREACHED PRINCIPLES 3, 4 AND 5 OF THE ACT.


13) I therefore maintain that UKPC have breached several parts of the KADOE contract.


14) the fact that the ICO have decided not to take any further action other than stated in their assessment for breaching THREE Principles of the DPA is totally irrelevant in respect of any breach of the KADOE contract.


15) the KADOE contract does not specify that the DVLA can take actions for a breach of the contract ONLY IF A THIRD PARTY (ICO) HAVE ALSO TAKEN CERTAIN ACTIONS.


16) if you find my reasoning in any of the above points is flawed, please explain specifically what the actual flaw is so that I can understand fully.


17) if you cannot find any flaws I respectfully submit therefore that UKPC have seriously (major) breached the KADOE contract and should in all fairness be suspended from obtaining future registered keeper details from the DVLA.

I shall be pleased therefore if you will seriously and fairly consider the above and respond to my points 16) and 17) accordingly.


After all, according to numerous articles on the internet, t.v. and newspapers, UKPC are alleged to be a thoroughly unethical organisation, unfit to be able to access private data which they use to cause abject misery to thousands of motorists.


For the most part the event involved a very minor breach of some obscure term or condition in a car park where motorists are invited to park, sometimes for free, to spend their hard earned monies at the retail outlets, and then penalised up to £100 for the privilege.

Even worse are where hospitals, GP surgeries and own space parking spaces are involved.


Of course, they also have form for wrong doing where the DVLA were forced to suspend their data access in 2015, of which I am sure you are well aware.

I look forward to your response in due course.


Kind regards
1505grandad


P.S. as per point 10)


Consequences (Hypothetical?)

If, on completion of investigations the ICO find that UKPC have NOT breached the DPA, does this mean that Registered Data Controllers can legitimately hold on to, and provide to third parties, data that can be used to the detriment of future registered keepers of a vehicle?

For instance, if someone hires a car, pays a windscreen parking invoice, does it mean that Registered Data Controllers can retain the data to use against another hirer of the car several years later, giving this data to a third party?. How long - for the lifetime (say 20 years) of the car?

Same perhaps with property? - i.e. previous home owner has debt, now satisfied, can the Registered Data Controller refer to this to a third party regarding a matter involving subsequent owners of the property?. Again, how long - hundreds of years while the property still stands?.

I REPEAT, IT IS OBVIOUS THAT UKPC HAVE NO IDEA AS TO THE REGISTRERED KEEPER DETAILS OF THE CAR IN 2012. SO WHY PROVIDE THE DETAILS OF THE PAID 2012 INVOICE TO A THIRD PARTY (AVIVA), IN CONNECTION WITH A 2015 INVOICE WHEN MY DAUGHTER HAPPENS TO BE THE REGISTERED KEEPER!!!.

I am sure that my daughter is not the only motorist whose car details are still held by UKPC that in fact relate to activities relevant to previous registered keepers.


P.P.S.


Further Thoughts


a) in the ICO assessment attached it instructed UKPC to send a letter to my daughter. We are not in the least surprised that to date this has not happened. The only items we have received from UKPC in the post were the begging letters for money. We will be informing the ICO accordingly.


b) I have been assisting a friend with another speculative invoice from UKPC that has arisen in exactly the same circumstances as my daughters.


We have recently received the ADR verdict who of course told UKPC to cancel the charge.


However during the process of appealing UKPC sent to my friend, via email, xxxxxxx by UKPC regarding a complete strangers data xxxxxxxxxxxxxxxx.


As in my point 11) above I will take it as read that the DVLA will not take my word for the breach of the DPA so we will be contacting the ICO for guidance as to what we can do so as not fall foul of any rules and regulations.

We will then contact the stranger advising that we have a copy of their personal data xxxxxxxxxxxxxxxxx and that a complaint should be made by them to the ICO for breach of the DPA.


Then once again we will jump through all the hoops and rigmarole involved as we make another complaint about UKPC breaching the DPA.


I will post reply from DVLA tomorrow, together with my proposed response.

beamerguy

Good on you 1505grandad

As the days go by and the problems get more serious, it's now well over the heads of the DVLA and indeed Morley

If Mr Morley really wanted to, he could talk to government to make changes. But whilst the DVLA collects £££millions each year he runs with the scam. How much by depends on if a wise newspaper decides to dig deep to discover the real facts.

Maybe a whistleblower from the DVLA could come forward, the media will adore you and you will be anonymous and you might just explode the scam of the decade.
You never know they might pay you a nice sum of money, that must be worth thinking about and be anonymous as well