Parkingeye exceeded paid for time limit

Coupon-mad

Dear ParkingEye Enforcement Team,

I will pass your response to the ICO - please note there is already a live complaint.

Kindly note, I still await the substantive reply from your Data Protection Officer as regards the GDPR concerns I have raised, none of which were even touched upon in your reply which I note comes from the litigation team only, with no regard whatsoever paid to data processing concerns about choosing the data stream (out of the two) that acts against a consumer.

The author of your reply appears to be a litigation clerk, intent on extracting monies or suing all victims, not someone trained in the GDPR.

I warn you NOT to try to tell the ICO when you reply to their investigation, that there is only one ten minute grace period, as that is not true.

Kelvin Reynolds' article and the current wording of the BPA CoP prove you wrong and it is despicable that Parking Eye continue to sue people on the pretence that you can add arrival time and leaving time together and then charge a penalty if the total is over ten minutes. It is atrocious and a national scandal that you continue to trade this way, effectively giving people who take a genuine ten minutes or more to register for an app, or queue and pay with coins, NO grace period at all, at the end, as you arbitrarily and wholly unfairly decide they've ''used their grace period up'' at the start, unbeknown to the poor victim consumer. And in flagrant disregard for Kelvin Reynolds' official BPA article.

I am pleased to see you have confirmed you will not correspond with or bother me further, because whilst an ICO investigation is in progress and your DPO has not yet addressed my (or the ICO's) concerns about the abuse of data, you must of course, keep the case 'on hold' and for the avoidance of doubt you must restrict data processing under these circumstances.

A claim would not just be premature, it would be a breach of data processing law (ask your DPO).

yours

MotoristPaper

Hi Coupon,


Thank you very much I have sent this on to Parkingeye and will append the correspondance to the ICO complaint.


Cheer

MotoristPaper

Hi Coupon,


Happy new year. Could I please ask for your help again with this? The ICO have given their ruling below and are saying parkingeye have done no wrong in their eyes. Are there other points I can raise or push with the ICO?


Dear x


Thank you for your contacting us with your complaint about ParkingEye and for your patience whilst I have been looking into this matter further. I have now considered the evidence available in this complaint and am writing to you to explain our view in this case.

The ICO’s role

Part of our role is to consider complaints from individuals who believe there has been an infringement of their data protection rights.

The law says we must investigate data protection complaints to an appropriate extent. We will put most of our effort into dealing with matters we think give us the best opportunity to make a significant difference to an organisation’s information rights practices.

Depending on the circumstances, we will decide whether or not to take action against the organisation and what form our action will take. We do this by taking an overview of all concerns that are raised about that organisation with a view to improving their compliance with the data protection framework. Our decision will not affect your ability to enforce your rights through the courts.

Complaint raised with us

You have complained about the way ParkingEye has handled your request that it ceases to process your personal data.

You have also raised concerns that the signage in operation at the car park does not adequately inform motorists that ANPR is in use and the purpose for this.

Additionally, you feel that the use of ANPR may be excessive because it is in operation 24/7. You have also raised concerns over the use of two data streams: ANPR and the payment machine.

Our view

I have considered your concern about the way ParkingEye has handled your request that it ceases to process your data. I can see that ParkingEye has responded to advise that it has rejected your request because it is processing your data in relation to a parking charge notice. In response to this complaint I can advise that when a parking company issues you with a parking charge notice, it will usually rely on the lawful basis for processing of ‘legitimate interests’.

This lawful basis for processing means that the parking company can process your data in relation to the parking charge notice, even if you do not consent to the processing. In this case I consider that ParkingEye has provided an appropriate response to your request and has explained its reasons for continuing to process your personal data.

With regards to your complaint about the signage, I can see that you have raised your concerns with ParkingEye and you received a response to this on 16 August 2018. In this email ParkingEye confirms that the signage does state that ANPR is in use and its purpose. I have also reviewed ParkingEye’s privacy policy and can see that it confirms privacy information about the use of ANPR.

You have raised concerns that the data being collected by ParkingEye by the ANPR system is excessive. This is because the ANPR system is in operation 24/7 and is used alongside the payment machine system to collect data.

In my view, the use of ANPR is unlikely to be excessive in this case. This is because ANPR and the payment machines are used to check the time that an individual enters the car park and the time that they buy a ticket. This allows the parking company to check that the individual does not stay longer on the car park than the time they have paid for. Furthermore, I can see that ParkingEye has advised that ANPR is in operation 24/7 because the car park can be used 24/7.

I can advise that ParkingEye has provided details to the ICO of how it checks the accuracy of the times collected by these two systems. ParkingEye has provided us with details of the processes which are in place to check the accuracy of these 2 systems and the times they record. We are satisfied that the measures in place are appropriate. Therefore we do not require ParkingEye to take further action in relation to this concern.

For the above reasons I am of the view that ParkingEye has complied with its data protection obligations in this case. I realise this may not be the response you are hoping for but I hope this information will be helpful in explaining our position. If you require further clarification, please respond directly to this email or call me on the number below.

Thank you for taking the time to bring this matter to our attention. We keep a record of all the complaints raised with us about the way organisations process personal information. The information we gather from complaints may form the basis for action in the future where appropriate.

Coupon-mad

I can advise that ParkingEye has provided details to the ICO of how it checks the accuracy of the times collected by these two systems. ParkingEye has provided us with details of the processes which are in place to check the accuracy of these 2 systems and the times they record.

Dear ICO,

Please supply me with that information, since it formed the basis of your decision.

And could you kindly explain why collecting data by ANPR 24/7 'because the car park can be used 24/7' is not excessive, when in a very similar instance of DPA failure by excessive and inappropriate use of ANPR cameras - confirmed on this Claimant's Trade Body (BPA) website in a 2013 article - Hertfordshire Constabulary was issued with an enforcement notice by the ICO?

It was not enough for them to say they could collect data 24/7 because people were using the town in question. Why is it enough for ParkingEye to say that an odd person once on a blue moon might drive into the site at 3am, so they will collect data 24/7? This is excessive data capture - especially given the PE signs are unlit (did they tell you that?) and certainly on all fours with the Hertfordshire Constabulary case. The force were ordered to stop processing people's information via ANPR until they could comply. The Information Commissioner ruled that the collection of the information was specifically illegal; breaching principle one of the DPA.

Why not in this case? There is no blanket excuse for parking firms that allows them to excessively process data any more than another similar, predatory firm - they have no special protection. Whilst it is accepted that they are in certain circumstances, astonishingly currently allowed to harvest data from the DVLA under the 'reasonable cause' excuse (DVLA KADOE contract), they are not then allowed to be heard to say that ''we won't cease data processing because there is a PCN''. The very existence of a private 'charge' does not mean they automatically have a legitimate interest or reason to excessively process data, without the ICO needing to ask further questions to establish why they will not cease the data processing.

Can you explain the difference in the Hertfordshire case, please, and show me the information that ParkingEye produced that satisfied you about the systems, which are not synchronised with each other (two separate systems that are often several minutes out, by public accounts about this well known scam). What can they possibly have shown you that convinced you the two unsynchronised data streams work fairly together alongside unlit/unseen high signs and hidden cameras that I believe do not match the time on the PDT machine?

Guys_Dad

Unfortunately, c-m, I think you are tilting at windmills now.

MotoristPaper

Hi Coupon,


Thank you very much for your suggestion, I have forward this on to the case officer and will await their reply.

Le_Kirk

Guys_Dad wrote: »

Unfortunately, c-m, I think you are tilting at windmills now.

If Don Quixote hadn't tilted at windmills where would we be today?:D

Coupon-mad

I can never let it lie...!

Pick an argument with me and people know it long after! I am one to have the last word.

Guys_Dad

Le_Kirk wrote: »

If Don Quixote hadn't tilted at windmills where would we be today?:D

Well, since he was fictional, maybe we would be exactly where we are? :rotfl::rotfl:

All I meant was that the reply from the ICO was pretty firmly on the side of PE and nothing in the suggested reply would be likely to change their decision.

Coupon-mad

I agree it might well be futile, but why not at least try. Let them chew over the point made about the Police ANPR 24/7 regime, which was held to be ''excessive'' in a small town, and they were banned by the ICO from using ANPR.

So, how is that different from PE using ANPR 24/7 in an even smaller site on the off chance someone rocks up as a rogue parker at 3am, and all the time PE are using unlit signs and unsynchronised timers as a conflicting data stream that could be several minutes adrift of each other?

Also, as the ICO said they were provided this, why not ask to see it, I would:

I can advise that ParkingEye has provided details to the ICO of how it checks the accuracy of the times collected by these two systems. ParkingEye has provided us with details of the processes which are in place to check the accuracy of these 2 systems and the times they record. We are satisfied that the measures in place are appropriate. Therefore we do not require ParkingEye to take further action in relation to this concern.