Parkingeye exceeded paid for time limit

Le_Kirk

As you have taken a total of 39 days to provide a response to my correspondence dated 25/02/18, despite acknowledging receipt of it on 01/03/18 and committing to a response within 30 days, yet you broke this commitment by not providing a response until 04/04/18 which is a flagrant disregard of the pre action conduct and protocols.

Just a small grammatical point. You don't need the "yet"

MotoristPaper

Thank you Le_Kirk I'll get that amended.

Coupon-mad

When they reply, email back and ask:

enforcement@parkingeye.co.uk


Why do none of your signs or documents comply with the ICO Code of Practice for ANPR and Surveillance Cameras, thus breaching the KADOE rules and the BPA Code of Practice?

Should you proceed with a Claim, I will put your company to strict proof of the existence of a Privacy Impact Assessment, made before ANPR surveillance and enforcement started. Further, I will put ParkingEye to strict proof of regular assessments made in consultation with your clients at this location, to establish that ANPR being used 24/7 is the least data-intrusive method of enforcement. You must justify your constant ANPR data stream, given that you are collecting irrelevant and distorting 'time of arrival' data on every vehicle, every day, basing your charges on the point of driving in, despite tariff payments being made at a time that is also within your data records.

In terms of timing data, ParkingEye have both the time of arrival and the time of payment at the machine in your data, the latter being the point when a contract is made (the authority for that fact is Thornton v Shoe Lane Parking [1971] 2 WLR 585 at the Court of Appeal, where it was held that in a pay & display car park, the contract is made when the coins enter the machine).

ParkingEye have each driver's individual 'contract formed' time in your hands already, as recorded by the PDT machine and can have no reasonable justification under the DPA to instead use ANPR 'entry times' for all drivers (regardless of whether they paid a tariff). Your company is merging two data systems and choosing to use the earlier time that the driver has no idea about, and which acts most disadvantageously against the interests of consumers, rather than the tangible point of contract at at the point of sale/the machine.

These two types of data processing (the ANPR and the PDT machine) should under your duty as a data controller, be considered as 'separate data streams' and it is your duty to ensure that irrelevant or excessive data is not obtained and held.

Unlike in a free car park - as was the case in the completely different an fact-specific Beavis case - ANPR use is not a proportionate response to collect data about genuine, paying motorists in a Pay & Display car park, since it provides for and collects and processes charges based on irrelevant and inaccurate timings, before a driver has even had a chance to read any terms & conditions, let alone find a space, park, and use your machine.

Arrival times will always differ significantly from the time prominently printed on the PDT ticket/on the PDT screen, which is the time any average circumspect driver will rely upon. Your use of 'arrival time' data is excessive, irrelevant and a serious breach of the DPA.

Whilst ANPR may have limited justification in a pay & display car park, to be used sparingly against the tiny minority of motorists who arrive and do not pay at all (assuming the signs are prominent and the machines and terms and tariffs are not hidden), there can be no justification for its use across the board.

ParkingEye are misusing your two data streams, acting against the interests of paying motorists by distorting the 'start time' of the contract, tipping the balance against the consumer.

This practice fails to meet the tests of 'fairness and transparency' in the Consumer Rights Act 2015 and also breaches the CPUTRs 2008 as an unfair commercial practice and a 'Misleading Action':

Prohibition of unfair commercial practices
3.- (1) Unfair commercial practices are prohibited.

(2) Paragraphs (3) and (4) set out the circumstances when a commercial practice is unfair.

(3) A commercial practice is unfair if -

(a) it contravenes the requirements of professional diligence; and
(b) it materially distorts or is likely to materially distort the economic behaviour of the average consumer with regard to the product.
(4) A commercial practice is unfair if -

(a)it is a misleading action under the provisions of regulation 5;
(b)it is a misleading omission under the provisions of regulation 6;
(c)it is aggressive under the provisions of regulation 7; or
(d)it is listed in Schedule 1.

Misleading actions
5.- (1) A commercial practice is a misleading action if it satisfies the conditions in either paragraph (2) or paragraph (3).

(2) A commercial practice satisfies the conditions of this paragraph!!!8212;

(a) if it contains false information and is therefore untruthful in relation to any of the matters in paragraph (4) or if it or its overall presentation in any way deceives or is likely to deceive the average consumer in relation to any of the matters in that paragraph, even if the information is factually correct; and
(b) it causes or is likely to cause the average consumer to take a transactional decision he would not have taken otherwise.''

Further, and in breach of the DPA, ParkingEye has provided no Privacy Notice specifically about an individual's right to subject access. At no point has the keeper been informed of their rights to subject access and how to obtain a SAR, and as such, this was an offence under the DPA at the point of the contract.

For the avoidance of doubt, this is not a new rule coming in under the GDPR, it is clearly stated in the existing ICO Code of Practice for ANPR and Surveillance Cameras:

https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf

''the private sector is required to follow this code to meet its legal obligations under the DPA.''

''If you are intending to match data together from different systems, you will need to be careful that the information you are collecting is accurate and not excessive. [...] It is possible for data collected by a range of surveillance systems to be integrated into broader 'big data' processing systems operated by organisations. This has implications in terms of profiling, what can be learnt about individuals and how decisions are made about them. The ICO published a report on the data protection implications of big data that covers this issue in further detail.''

''7.6 Privacy notices
It is clear that these and similar devices present more difficult challenges in relation to providing individuals with fair processing information, which is a requirement under the first principle of the DPA. For example, it will be difficult to ensure that an individual is fully informed of this information if the surveillance system is airborne, on a person or, in the case of ANPR, not visible at ground level or more prevalent then it may first appear.''

''One of the main rights that a privacy notice helps deliver is an individual's right of subject access.''

''Once you have followed the guidance in this code and set up the surveillance system, you need to ensure that it continues to comply with the DPA and the code's requirements in practice. You should:

- tell people how they can make a subject access request, who it
should be sent to and what information needs to be supplied with
their request;
- give them a copy of this code or details of the ICO website; and
- tell them how to complain about either the operation of the system
or failure to comply with the requirements of this code.''

The registered keeper's data was obviously not obtained in accordance with the KADOE or the BPA Code - due to breaching the above ICO Code at/before the contract was made at the machine - and thus, the charge is unrecoverable.

Should you pursue a claim I will pursue a formal ICO complaint on the above basis, using your own signs/notices as evidence of your omissions relating to my individual data.

Regardless of your response, and even if you now cancel this charge, there is a bigger picture and areas of serious concern here regarding your distortion of data streams by choosing to favour irrelevant VRN capture timing data (even if factually correct about the point that cars cross the threshold of a site) which affects millions of motorists, none of whom are being properly informed of their right to make a SAR, and all of whom are being misled and intimidated into making transactional decisions if they pay a 'parking charge' based upon your skewed timings.

Therefore, I also intend to provide my findings about your DPA failures and omissions to my local Trading Standards, as well as the Consumers Association, Sir Greg Knight, and to my own MP.

yours faithfully,






Read about that here:

http://forums.pepipoo.com/index.php?showtopic=119695&pid=1373112&st=0!!!entry1373112

MotoristPaper

Hi Coupon,


Thank you so much for the very detailed text. ParkingEye have been playing a game of "we refer you to our previous correspondance in which all your queries have been dealt with". I came back here for some more advice and apologies I had missed your last post. I have fired this off to them just now.


It looks like GDPR could be a nice thorn in their side :-)


Cheers

clairey262

Can i send this letter to BW Legal to a response of a letter threating LBC if I do not pay up in 16 days ?

clairey262

So the chances of me getting a LBC in 16 days are high or low? It’s quite scary this whirlwind I’m about to involved it..

KeithP

clairey262, these are the sort of questions you should be asking on you own thread.

That's if you can't find the answers elsewhere.

MotoristPaper

Hello All,


I have eventually received a response from ParkingEye to Coupon's salvo above, a whole 52 days after I responded to them!


They are saying that the ICO CCTV code of practice only came into play in January 2018, yet the code of practice Coupon linked to is dated June 2017.


They are also standing by their assertion that there is a privacy notice. I have checked my photos of the signs at the site again and I cannot read all the small text, there might be a privacy notice in the tiny script, or it could well be anything else. Going back to the insufficient signage point you would struggle to read from a car and would likely need to stand on something to read it on foot. So I could argue this point with a photograph.


Their response is below, any ideas how to respond please to their apparent brush off to the ICO points? They've also mucked up on the timings, duration of stay was 4h28 and not 4h30 for what its worth.


Cheers


Dear xyz,

We write regarding the above referenced Parking Charge, which concerned a breach of the parking terms and conditions on the 31st July 2017 at Bailey Lane, Sheffield, and your recent correspondence received in relation to the same.

We can confirm we can confirm we complied with all the required legislation and the time of the parking event. We can confirm the new Code Of Practice only came into force in January 2018 and the new Code Of Practice is not relevant to Parking Charges issued prior to January 2018.

We note your submission of the case of Thornton v Shoe Lane Parking. This case maintained that a contract could not be altered after it was formed. In Thornton v Shoe Lane Parking, tickets purchased from a ticket machine contained further contractual clauses which only became apparent after payment was made and the contract was formed. This was deemed to be unfair. There was no contention about whether or not a contract could be formed through making the Defendant aware of the terms and conditions of the contract and allowing him to choose to enter or not enter into it. The case centred upon when the contract was entered into. Only the conditions imposed after the contract was entered into were deemed to be unenforceable. Therefore this case actually serves to uphold the idea that a contract can be formed by making a party aware of the terms and conditions by which they will be bound and allowing them to choose whether or not they enter into it.

ParkingEye operates a grace period on site to give all motorists time to consider the terms and conditions in operation and decide whether they wish to bound by the same, before acting accordingly. This means that all motorists parking on site have a chance to read through the signage and the relevant terms and conditions, before agreeing to the parking contract being offered. It can be confirmed that a paid parking tariff payment of £4.60 was purchased at 14:00pm on the date in question. This equated to 4 hours paid parking time, and we have attached a copy of the terms and conditions from the date in question for your perusal. As the vehicle remained exited the car park at 18:28pm, thus remaining on site for 4 hours and 30 minutes, the paid parking tariff made was insufficient.

We can confirm that the signage on site at Bailey Lane, Sheffield car park contains a privacy notice, which details the third parties with whom data may be shared should a motorist breach the parking terms and conditions in operation on site.

This privacy notice states that, !!!8220;By entering this private car park, you consent, for the purpose of car park management to: the capturing of photographs of the vehicle and registration by the ANPR cameras and/or by the attendant and to the processing of this data [!!!8230;] to check compliance with the Parking Contract. Furthermore, you consent to the processing of this data to request registered keeper details from the DVLA, where the Parking Contract is not adhered to [!!!8230;]!!!8221;.

The signage then goes on to state that, !!!8220;Personal data may also be shared with the BPA, mail service providers, credit reference agents, collection agents or solicitors for this purpose and any authorised sub-contractors!!!8221;.

We can confirm that we have now reviewed your recent correspondence but we maintain our position that the full amount of the Parking Charge remains outstanding and that we have been unable to reach an agreement in respect of the same via the Reply Form.

We now require full payment of the outstanding sum of £100.00 within the next 14 days or legal action will be taken. Should court proceedings be issued, further costs will be incurred. These will include, but are not limited to, the court claim issue fee and the solicitors costs referred to within the LBCCC.




If you wish to make payment, you can do so by telephoning our offices on 0330 555 4444, by visiting www.parkingeye.co.uk, or by posting a cheque/postal order to the below address. Please note that you must quote the above Parking Charge reference on the reverse of the cheque or postal order.

Yours sincerely,

ParkingEye Enforcement Team

Coupon-mad

You misunderstand, and they've (seemingly deliberately) said that to confuse you. They are saying the new BPA CoP came into practice in January, which it did:

https://www.britishparking.co.uk/Code-of-Practice-and-Compliance-Monitoring

But the ICO CCTV rules (the CoP you were talking about) existed already, last updated in 2014:

https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/cctv-code-of-practice-revised/

... and the BPA reminded to all PPCs ages back, even before that revision, that Enforcement Notices could be issued by the ICO, with fines as well for excessive use of ANPR, which is NOT allowed if not justified and proportionate:

https://www.britishparking.co.uk/News/excessive-use-of-anpr-cameras-for-enforcement

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/02/businesses-could-face-fines-for-ignoring-cctv-data-protection-law/

So I would reply and say how about answering the question about the ICO CCTV CoP rather than the BPA CoP which wasn't the question? And explain the excessive use of ANPR 24/7 at this site and show the impact assessment and justification, where alternative (less data intrusive) means were explored by PE and the landowner, before starting (or on regular annual review, before continuing) ANPR enforcement.

MotoristPaper

Hi Coupon,


Thank you for explaining that to me. Yet more smoke and mirrors from the slippery sods. I will go back to them and ask them to actually answer the question as you suggested .