APCOA Evesham Train Station

dr_genestealer

Coupon-mad wrote: »

You aren't.

Wait and see what they come back with, THEN send the LBC I suggested and plan the ICO complaint suggested too.

I think technically this is true, I paid them for parking via the app/phone.

I 100% agree, I think the ICO will need to deal with them, rather than small claims.

dr_genestealer

beeepaaah wrote: »

If you’re going down the gdpr route then better to not think of what you can get out of it for yourself, despite your efforts. Better to report to ICO and let’s hope they get fined to the max - €20m or 4% global turnover. Yes please!
If you pursue yourself then you will have to go through proving legal justification. Let the ICO do it and forgive your relatively small reward. Wouldn’t it be better for everyone if they got a crippling fine?

Agreed, I'm looking forward to seeing their response to the Subject Access Request. Will share what I can from their response. Also, I'm happy to forgo small claims if the ICO will have a better chance to nailing them!

Coupon-mad

Be aware that the ICO have NO CLUE about 'not relevant land' and unless you spell it out like I suggested above, will make the assumption that a PPC *can* hold a rk liable due to the POFA...and maybe they kept the data a bit long but hey...

So, when it comes to the ICO complaint, run it by us first! Needs to be on point and clear, and you can upload images and email to support an online ICO complaint, so tell us what will be attached, too.

beeepaaah

Data breach is a data breach. Relevant land has nothing to do with it. They have sent a pcn or whatever in relation to an old charge that was closed down. They should not then be using his personal data in relation to trying to mistakenly resurrect it. Misuse of data.

Coupon-mad

Indeed, but even better if the ICO understands that the PPC only had very limited scope for using the keeper's data in the first place.

I recall seeing the unsatisfactory result of an ICO complaint (maybe on pepipoo a year or more ago) where the ICO wrongly assumed keeper liability was a given.

beeepaaah

Good point! All ammunition good. I just hope it results in a hefty fine and some publicity.

dr_genestealer

So two parts to this update:
PART 1, Subject Access Request at to APCOA's Data Protection Officer
On 31 May 2018 name, postal address and email address was provided in the Subject Access Request to APCOA's Data Protection Officer. Just shy of the 1 month limit, 29 days later, received by email the following response:

Dear xxxx
Many thanks for your request for data access to our Data Protection Officer. We have checked our data bases, both archived data as well as our current data, and cannot find any within our systems to match the information you have provided. In this instance, full name and email address.
If you feel that there is a transaction, with perhaps a further identifier that we can search, then please feel free to let us know and we will perform a further search on your behalf.
Regards
DPO Team
DPO@apcoa.com
APCOA Parking (UK) Limited
Wellington House, 4-10 Cowley Road,
Uxbridge, Middlesex, UB8 2XW.

From the email, it's unclear if they searched by address. However, APCOA Parking (UK) Limited have at the very least name and address, along with other details on their systems on order to post the notice to keeper/owner letter (30th June 2018).

Recap, they should not have sent the letter, as APCOA withdrew from my January 2018 POPLA appeal. I'm unclear how to progress this, especially in light of Part 2 below.


PART 2, Debt Recover Plus Ltd (DRP)
Just over a month since the notice to keeper, a letter dated 5th July 2018 from Debt RecoveryPlus Ltd was received.
Now APCOA has further breached GDPR and passed my details onto a third party. It's worth noting APCOA's DPO claim not to have my details (Name, address, email).
This 3rd party is now demanding £150 by the 19th July 2018 or they claim APCOA will take court action against me.

dr_genestealer

MY ACTIONS:
1. Raised concern with ICO for the misuse of my information.
Details: Subject Access Request dated 31/05/2018 via email to APCOA's parking Limited Data Protection Officer, response dated 29/06/2018 APCOA claim to hold no personal information on myself. Around 05/07/2018 APCOA without my consent, passed my name and address to a 3rd party debt collection company Debt Recovery Ltd (DRP) for a parking ticket dated 06/12/2017. Said ticket was successfully appealed by POPLA (the parking Ombudsman) on 03/01/2018. APCOA should not have retained and removed my information following the appeal, but instead have further processed it and passed it to a 3rd party. This seems a failing in their data processing and control system.
The organisation:Will not remove my details following the successful appeal, Has sold/passed my details to a debt recovery company, denies holding my personal information.
I would like the ICO to:1. Remove my information. 2. Investigate if Subject Access Requests are being by APCOA worked correctly, my case as an example. 3. A written apology, redaction of the May 2018 letter and cancellation of debt recovery. 4. Investigate failing in their data processing and control system which led to new letters and debt recovery proceeding instigating months after tickets are successfully appealed.

2. Complained to BPA
Subject: Breach of code of professional conduct from APCOA Parking (UK) Ltd.
Dear BPA
I am writing to you to raise an issue about APCOA Parking (UK) Ltd's mishandling of my personal data and subsequent letters and actions from them and their nominated debt recovery company.
The issue that I have experienced was: PCN XXXXX, dated 06/12/2017 was appealed to POPLA with reference XXXXXX. On 03/01/2018 APCOA Parking told POPLA they do not wish to contest the Appeal. Thus my Appeal was successful and I did not need to pay the parking charge.
On 21/05/2018 APCOA sent a notice to keeper to myself for the same PCN number.
I put in a Subject Access Request to their Data Protection Officer to request my information as I believed it was being misused and was told they cannot find of my details within their systems.
Now I have received a letter dated 5th July 2018 from Debt Recovery Plus Ltd demanding £150 by the 19th July 2018 or they claim APCOA will take court action against me.
As the POPLA appeal was successful all subsequent letters and claims are null and void.
I wish for an written apology and redaction of the May 2018 letter and debt recovery cancelled.
I look forward to your prompt response on this matter. As recommended by Trading Standards, I would like to keep a complete record of my case, so please reply back via this email account.

3. Emailed POPLA:
Dear POPLA,
5 Months on from my successful appeal, APCOA have sent a notice to keeper letter and passed keeper details to a debt recovery company, for the original PCN.
Surly this is not correct and to your procedures.


4. Emailed UKcustomercomplaints@apcoa.com
Dear APCOA
I am writing to you to raise an issue about: your mishandling of my personal data and subsequent letters and actions from yourself and your nominated debt recovery company.
The issue that I have experienced was: PCN xxxxx, dated 06/12/2017 was appealed to POPLA with reference xxxxxx. On 03/01/2018 APCOA Parking told POPLA they do not wish to contest the Appeal. Thus my Appeal was successful and I did not need to pay the parking charge.
On 21/05/2018 APCOA sent a notice to keeper to myself for the same PCN number.
I put in a Subject Access Request to their Data Protection Officer to request my information as I believed it was being misused and was told they cannot find of my details within their systems.
Now I have received a letter dated 5th July 2018 from Debt Recovery Plus Ltd demanding £150 by the 19th July 2018 or they claim APCOA will take court action against me.
As the POPLA appeal was successful all subsequent letters and claims are null and void.
I wish for an written apology and redaction of the May 2018 letter and debt recovery .
I look forward to your prompt response on this matter. As recommended by Trading Standards, I would like to keep a complete record of my case, so please reply back via this email account.

5. Used Resolver to contact Debt Recovery Plus Ltd.
I am writing to you to raise an issue about: Parking Charge Notification

The issue that I have experienced was: Your letter ref xxxx dated 05/07/2018, for APCOA Parking PCN xxxxx, dated 06/12/2017 was appealed to POPLA with reference xxxx. On 03/01/2018 APCOA Parking told POPLA they do not wish to contest the Appeal. Thus my Appeal was successful and I did not need to pay the parking charge.
On 21/05/2018 APCOA sent a notice to keeper to myself for the same PCN number.
I put in a Subject Access Request to their Data Protection Officer to request my information as I believed it was being misused and was told they cannot find of my details within their systems.
Now I have received a letter dated 5th July 2018 from Debt Recovery Plus Ltd demanding £150 by the 19th July 2018 or they claim APCOA will take court action against me.
As the POPLA appeal was successful all subsequent letters and claims are null and void.

6. Emailed APCOA's DOP team

Dear DPO team

Information rights concern
Name: Mr xxxx
Address:
xxxxx
Account number: xxxxx
Phone number +44 (0)xxxxx
Email: xxxxxx@xxxxx.com
PCN number: xxxxxx
Car registration no: xxxxxx


I am concerned that you have not handled my personal information properly and I am writing to you to raise an issue about your mishandling of my personal data and subsequent letters and actions from yourself and your nominated debt recovery company.

The issue that I have experienced was: PCN xxxxxxx, dated 06/12/2017 was appealed to POPLA with reference xxxxxxx. On 03/01/2018 APCOA Parking told POPLA they do not wish to contest the Appeal. Thus my Appeal was successful and I did not need to pay the parking charge.
On 21/05/2018 APCOA sent a notice to keeper to myself for the same PCN number.
I put in a Subject Access Request to your Data Protection Officer to request my information as I believed it was being misused in your email (attached) you say you cannot find of my details within your systems.
Now I have received a letter dated 5th July 2018 from Debt Recovery Plus Ltd demanding £150 by the 19th July 2018 or they claim APCOA will take court action against me.

As the POPLA appeal was successful all subsequent letters and claims are null and void.

I wish for an written apology and redaction of the May 2018 letter and cancellation of debt recovery.

I understand that before reporting my concern to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.

If, when I receive your response, I would still like to report my concern to the ICO, I will give them a copy of it to consider.

You can find guidance on your obligations under information rights legislation on the ICO’s website (https://www.ico.org.uk) as well as information on their regulatory powers and the action they can take.

Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond.

If there is anything you would like to discuss, please contact me on the following number

Umkomaas

You could issue a Letter Before Action/Claim requiring an apology and a payment of £x (see cost of doing so, based on amount claimed) for the misuse of your personal data. Follow it up with a MCOL if they don't apologise and stump up.

https://www.gov.uk/make-court-claim-for-money/court-fees

APCOA's admin systems are in a right mess. The DVLA have apologised for them a number of times recently.

See what others say before firing anything off.

Fruitcake

A few suggestions.

Said ticket was successfully appealed [STRIKE]by[/STRIKE] at POPLA (the [STRIKE]parking Ombudsman[/STRIKE] independent appeals service/alternative dispute resolution) on 03/01/2018.

APCOA should not have retained [STRIKE]and [/STRIKE] but instead removed my information following the successful appeal result,

Investigate if Subject Access Requests [STRIKE]are being by[/STRIKE] to APCOA are being [STRIKE]worked[/STRIKE] processed correctly,



You will need to spell out the acronyms such as PoPLA the first time you use them. You might need to include PCN and PoPLA numbers for reference.