APCOA Evesham Train Station

The_Deep

Now that they have wasted your time, waste some of theirs, read this

[FONT=Times New Roman, serif]This is an entirely unregulated industry which is scamming the public with inflated claims for minor breaches of contracts for alleged parking offences. [/FONT]

[FONT=Times New Roman, serif]Parking Eye, Smart and a smaller company have already been named and shamed, as has Gladstones Solicitors, and BW Lega;, (who take hundreds of these cases to court, and nearly always lose), who have also been reported to the regulatory authority. [/FONT]

[FONT=Times New Roman, serif]The problem has become so rampant that MPs have agreed to enact a Bill to regulate these scammers. Watch the video of the Second Reading in the HofC recently.[/FONT]

[FONT=Times New Roman, serif]http://parliamentlive.tv/event/index/2f0384f2-eba5-4fff-ab07-cf24b6a22918?in=12:49:41[/FONT]

[FONT=Times New Roman, serif]and complain in the most robust terms to your MP. With a fair wind most of these companies may well be put out of business by Christmas.[/FONT]

Umkomaas

however, your WINNING (!!) letter states the contravention occurred on 6th December 2017

I'm trying to find that date in the thread, but can't spot it. Which post # please?

KeithP

Umkomaas wrote: »

I'm trying to find that date in the thread, but can't spot it. Which post # please?

It's in the first few lines of the PoPLA appeal text in post #15:

dr_genestealer wrote: »

As the registered keeper, this is my appeal about a Parking Charge Notice issued by APCOA for an alleged breach of the company's terms and condition in the Evesham railway station car parking on the 6th Dec 2017.

Umkomaas

KeithP wrote: »

It's in the first few lines of the PoPLA appeal text in post #15:

Cheers Keith. I'll get Mrs U to fix me a Specsavers!

dr_genestealer

So interesting, today I received a new letter from APCOA appearing to be an initial 1st-contact style letter, demanding £100, or else!
However, the catch is, it's for the same PCN from 6th Dec 2017, which they withdrew from POPLA Jan 2018!

So, according to my GPDR expert, I should get in touch with their data protection officer asking them to explain the letter. As they have no legal reason to hold my data following the successful POPLA appeal and they must delete my data and stop harassing me.

Any thoughts of taking this further, small claims court? I calculated this has taken a fair amount of my time and caused distress, stress and anguish. Would not be unreasonable to ask for £500.

nosferatu1001

It's certainly a violation, and so compensation is due
First as you say, get their DP officer to explain their error

Coupon-mad

I agree. But no need to write to their data controller. Go straight in with a LBC.

Send a Letter before Claim that lays it on thick about the distress caused already, in receiving demands 6 months ago and having to undergo the embarrassment of explaining debt demands to family members and going through the rigmarole of a POPLA appeal to see off a baseless charge for which a registered keeper cannot be held liable, due to the location.

And that now, after GDPR, suddenly they have not only resurrected it but have written proving that they have unreasonably stored your data all this time, and this breaches the DPA and you will now claim compensation for this data misuse and the distress caused due to their continued breach of the Protection from Harassment Act 1997.

If they wish to settle out of court you give them 14 days to respond and make payment and you will accept £250 and no further action will be taken. If they fail to pay compensation - whether they reply or not - you will be making a formal complaint to the ICO about their unlawful data storage and pursuing a registered keeper for months when the land is not 'relevant land' and as such, the POFA Schedule 4 does not apply and a registered keeper cannot be lawfully held liable.

You could also throw in that they failed to comply with the ICO Surveillance Camera Code rules which are a mandatory requirement of the BPA Code of Practice, in terms of misusing a registered keeper's data for a purpose not authorised by the DVLA, failing to advise you about your rights to subject access, and failing to ensure that data processed by ANPR at this location is justified, proportionate and does not intrude upon the data subject's privacy.

A registered keeper is not the liable party on non-relevant railway land and can ONLY be 'invited to name the driver' (under KADOE rules, that is ALL) and not pursued for money as if they are the liable party for months after the parking firm lost at POPLA and should have removed the keeper's data in January.

Finish by saying, once the ICO has found in your favour you will then pursue a claim not less than £500 plus costs. So you urge them to learn from this GDPR failure and settle their liability for £250 now.

beeepaaah

If you’re going down the gdpr route then better to not think of what you can get out of it for yourself, despite your efforts. Better to report to ICO and let’s hope they get fined to the max - €20m or 4% global turnover. Yes please!
If you pursue yourself then you will have to go through proving legal justification. Let the ICO do it and forgive your relatively small reward. Wouldn’t it be better for everyone if they got a crippling fine?

dr_genestealer

Sorry I did not see your replies before acting, I emailed their DPO. To ask them, to tell me all the ways they are misusing my data, before I drop the bombshell.

Copy of email:
Dear Sir/Madam

I am writing to you in your capacity as data protection officer for your company. I am a customer of yours, and in light of recent events, I am making this request for access to personal data pursuant to Article 15 of the General Data Protection Regulation. I am concerned that your company!!!8217;s information practices may be putting my personal information at undue risk of exposure or in fact has breached its obligation to safeguard my personal information pursuant to recent events.

I would like you to be aware at the outset, that I expect a reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the Information Commissioner!!!8217;s Office.

Please advise as to the following:

1. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases.

a. In particular, please tell me what you know about me in your information systems, whether or not contained in databases, and including e-mail, documents on your networks, or voice or other media that you may store.

b. Additionally, please advise me in which countries my personal data is stored, or accessible from. In case you make use of cloud services to store or process my data, please include the countries in which the servers are located where my data are or were (in the past 12 months) stored.

c. Please provide me with a copy of, or access to, my personal data that you have or are processing.

2. Please provide me with a detailed account of the specific uses that you have made, are making, or will be making of my personal data.

3. Please provide a list of all third parties with whom you have (or may have) shared my personal data.

a. If you cannot identify with certainty the specific third parties to whom you have disclosed my personal data, please provide a list of third parties to whom you may have disclosed my personal data.

b. Please also identify which jurisdictions that you have identified in 1(b) above that these third parties with whom you have or may have shared my personal data, from which these third parties have stored or can access my personal data. Please also provide insight in the legal grounds for transferring my personal data to these jurisdictions. Where you have done so, or are doing so, on the basis of appropriate safeguards, please provide a copy.

c. Additionally, I would like to know what safeguards have been put in place in relation to these third parties that you have identified in relation to the transfer of my personal data.

4. Please advise how long you store my personal data, and if retention is based upon the category of personal data, please identify how long each category is retained.

5. If you are additionally collecting personal data about me from any source other than me, please provide me with all information about their source, as referred to in Article 14 of the GDPR.

6. If you are making automated decisions about me, including profiling, whether or not on the basis of Article 22 of the GDPR, please provide me with information concerning the basis for the logic in making such automated decisions, and the significance and consequences of such processing.

7. I would like to know whether or not my personal data has been disclosed inadvertently by your company in the past, or as a result of a security or privacy breach.

a. If so, please advise as to the following details of each and any such breach:

i. a general description of what occurred;

ii. the date and time of the breach (or the best possible estimate);

iii. the date and time the breach was discovered;

iv. the source of the breach (either your own organisation, or a third party to whom you have transferred my personal data);

v. details of my personal data that was disclosed;

vi. your company!!!8217;s assessment of the risk of harm to myself, as a result of the breach;

vii. a description of the measures taken or that will be taken to prevent further unauthorised access to my personal data;

viii. contact information so that I can obtain more information and assistance in relation to such a breach, and

ix. information and advice on what I can do to protect myself against any harms, including identity theft and fraud.

b. If you are not able to state with any certainty whether such an exposure has taken place, through the use of appropriate technologies, please advise what mitigating steps you have taken, such as

i. Encryption of my personal data;

ii. Data minimisation strategies; or,

iii. Anonymisation or pseudonymisation;

iv. Any other means

8. I would like to know your information policies and standards that you follow in relation to the safeguarding of my personal data, such as whether you adhere to ISO27001 for information security, and more particularly, your practices in relation to the following:

a. Please inform me whether you have backed up my personal data to tape, disk or other media, and where it is stored and how it is secured, including what steps you have taken to protect my personal data from loss or theft, and whether this includes encryption.

b. Please also advise whether you have in place any technology which allows you with reasonable certainty to know whether or not my personal data has been disclosed, including but not limited to the following:

i. Intrusion detection systems;

ii. Firewall technologies;

iii. Access and identity management technologies;

iv. Database audit and/or security tools; or,

v. Behavioural analysis tools, log analysis tools, or audit tools;

9. In regards to employees and contractors, please advise as to the following:

a. What technologies or business procedures do you have to ensure that individuals within your organisation will be monitored to ensure that they do not deliberately or inadvertently disclose personal data outside your company, through e-mail, web-mail or instant messaging, or otherwise.

b. Have you had had any circumstances in which employees or contractors have been dismissed, and/or been charged under criminal laws for accessing my personal data inappropriately, or if you are unable to determine this, of any customers, in the past twelve months.

c. Please advise as to what training and awareness measures you have taken in order to ensure that employees and contractors are accessing and processing my personal data in conformity with the General Data Protection Regulation.

Coupon-mad

I am a customer of yours,

You aren't.

Wait and see what they come back with, THEN send the LBC I suggested and plan the ICO complaint suggested too.