Parkingeye exceeded paid for time limit

MotoristPaper

Hi Coupon,


I for one greatly appreciate your tenacity ;-) I received this back from the ICO. They have at least passed on the request to see PE's data, but are hiding behind the "individual case basis" answer about the ANPR. I noticed there is a complain about the ICO page and then complain to the Ombudsman through your MP detailed on the ICOs if you think there is any mileage in that? I am quite game for any longshots :-)


Dear x

Thank you for your email of 10 January 2019.

I have passed your information request to our information access team and they will respond to you in due course.

With regards to the comparison of your case with that of Hertfordshire Constabulary, I would firstly like to explain that each complaint is handled on a ‘case by case’ basis. It is also important to understand that my assessment is not a decision in any legalistic sense. It is my opinion based on the circumstances and information provided to us.

In this case, I have explained that I do not consider the use of ANPR in a car park which ParkingEye has stated is in operation 24/7 to be excessive. I have considered whether the processing of VRMs via the ANPR system constitutes a proportionate response to the issue that the car park operator is trying to address i.e. to ensure that people do not stay longer on the car park than the time they have paid for. As the car park is in use 24/7 I consider that the use of ANPR in this case is proportionate.

We are unable to comment on the validity of a PCN, but as previously advised if a parking company is processing personal data in relation to this we would consider the legal basis of legitimate interests to be applicable, provided the parking company complies with the principle of data protection law.

Yours sincerely

Case Officer

Coupon-mad

Nothing to lose if it costs you nothing, to complain about a decision that basically says:

''it's not excessive to collect data images in the dark, for alleged breach of terms that are not lit and can't be seen in the dark (and where the 2 data streams are not synchronised, but PE have sent the ICO some spiel that pretends they are)''

24/7 data capture cannot possibly be justified just because they can.

MotoristPaper

Hi Coupon,


You mentioned further up the thread that you would be interested to see the evidence provided to the ICO by Parkingeye, they have come back to me with a redacted PDF of which I have uploaded here https://ibb.co/xfJcStk


Now interestingly the blurb is similar to some blurb PE has sent me previously stating the timing is accurate on their ANPR due to using NTP (network time protocol). My day job is in IT and NTP is actually something I am very familiar with so I could quite easily throw a nice series of questions at them to confirm its properly configured as the assertions they make about are only true under certain circumstances, pennies to a pound they will hide behind IT security concerns but I would suspect they have not configured it to best practice and these would certainly not be questions one of their litigation goons could answer.


Here is the rest of the text from the ICO's email, I will be appealing before the 40 days time elapse for the ICO appeal, but I wondered if you think rousing ParkingEye with techie questions around NTP is a good idea in parallel (I realise its another kitchen sink approach but I at least have a kitchen sink)


Cheers


Dear x

I can confirm we are now in a position to provide you with a response to your information request of 10 January.

Request

In your email you asked for the following:

“…could you please supply me with that information, since it formed the basis of you decision?”

We understand this to be a request for the information that informed the decision on your complaint case under reference x, dealt with by my colleague x.

Where the information is your personal data we have dealt with your request for information as a right of access under data protection legislation. Where information is not your personal data we have also considered section 1 of the Freedom of Information Act 2000 (the FOIA) which entitles you to information held by a public authority.

Response

We have been informed by Ms x that her view was formed on the basis of the evidence you gave to us and information provided to the ICO by ParkingEye on another complaint case.

Please find attached the extract of this information from the other case. I have withheld some of this information for the reasons set out below. The information is being withheld under FOIA as it does not constitute your personal data.

Information withheld - Section 31 FOIA

Section 31(1)(g) of the FOIA states:

“Information… is exempt information if its disclosure under this Act would, or would be likely to, prejudice – (g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2)

The purposes referred to in sections 31(2)(a) and (c) are

1. the purpose of ascertaining whether any person has failed to comply with the law

1. the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise

The purposes at section 31(2)(a) and (c) apply when the Information Commissioner is determining whether or not there has been a breach of the legislation we regulate, and whether any further action is appropriate.

The exemption at section 31 is not absolute, and we need to consider the public interest test by weighing up the factors for and against disclosure of the information we hold at this time, as well as any prejudice or harm which may be caused by disclosure.

We believe the release of the information you have requested would be likely to prejudice ParkingEye’s ongoing co-operation with the ICO and discourage any future discussions. This in turn would be likely to damage our ability to conduct and conclude any investigation thoroughly, fairly and proportionately.

We have also considered the public interest test for and against disclosure. In this instance the public interest factors in favour of disclosure are:

• Openness and transparency in the way in which the ICO conducts its investigations into data protection complaints
• Openness and transparency in how ParkingEye responds to enquires by the ICO on their data protection compliance

The public interest factors in favour of maintaining the exemption are:

• There is a public interest in the ICO providing a cost effective and efficient regulatory function. This relies on the cooperation of data controllers and we feel this is best achieved by an informal, open, voluntary and uninhibited exchange of information with these organisations. We feel that the cooperation of organisations may be adversely affected if all the details that they provide to us were routinely made public.
• The ICO’s ability to deliver the levels of service required of it would likely be affected if organisations became more cautious about providing information in response to our enquires.

Having considered all of these factors we have taken the decision that the public interest in withholding the information outweighs the public interest in disclosing it, and the information you have asked for is exempt from disclosure under s31(1)(g) of the FOIA.

Next steps

I hope this provides you with the information you require.

However, if you are dissatisfied with your request for information under FOI and wish to request a review of our decision or make a complaint about how your request has been handled you should write to the Information Access Team at the address below or e-mail [EMAIL="accessicoinformation@ico.org.uk"]accessicoinformation@ico.org.uk[/EMAIL].

Your request for internal review should be submitted to us within 40 working days of receipt by you of this response. Any such request received after this time will only be considered at the discretion of the Commissioner.

If having exhausted the review process you are not content that your request or review has been dealt with correctly, you have a further right of appeal to this office in our capacity as the statutory complaint handler under the legislation. To make such an application, please write to our Customer Contact Team at the address given or visit our website if you wish to make a complaint under the Freedom of Information Act.

A copy of our review procedure can be accessed from our website
here

Your rights

Our Privacy notice explains what we do with the personal data you provide to us and what your rights are.

In order that you are clear about the purpose and legal basis for the ICO processing your personal data please click on the following links, as appropriate – 'a complainant', 'an enquirer', 'a job applicant', 'an ICO grants programme applicant''subject of an investigation by the ICO', 'a whistleblower' or 'an information requester'. Any other individual can click on the Privacy notice link above.

Our retention policy can be found here

Yours sincerely

x
Lead Information Access Officer

Coupon-mad

Odd, isn't it, that people have been able to prove ParkingEye's timings wrong by 2/3 minutes, by their own dashcam time or phone's Google Location.

How does the ICO's answer explain why the Assessor decided that this private firm could use ANPR in the dark when the signs are unlit and the contract is not accessible or visible? She can't say they can use ANPR 24/7 'because they can' when she knows from you that the signs are not lit and PE provided nothing to say otherwise.

Terrible of the ICO not to even consider the fact excessive data trawling is being used to charge people who are literally in the dark about any terms.