POPLA Appeal ParkingEye St. Martin's Precinct

Umkomaas

This is the new ANPR information/ICO CoP referred to (above) by CM.

Please note - the paragraph numbers 16 & 17 are those from a previous case - make sure your paragraph numbering flows from the rest of your appeal.

16. This Claimant uses ANPR camera systems to process data but fails to comply with the Information Commissioner's 'Data Protection Code of Practice for Surveillance Cameras and Personal Information'. This Code confirms that it applies to ANPR systems, and that the private sector is required to follow this code to meet its legal obligations as a data processor. Members of the British Parking Association AOS are required to comply fully with the DPA, as a pre-requisite of being able to use the DVLA KADOE system and in order to enforce parking charges on private land. The Claimant's failures to comply include, but are not limited to:

i) Lack of an initial privacy impact assessment, and

ii) Lack of an evaluation of proportionality and necessity, considering concepts that would impact upon fairness under the first data protection principle, and

iii) Failure to regularly evaluate whether it was necessary and proportionate to continue using ANPR at all times/days across the site, as opposed to a less privacy-intrusive method of parking enforcement (such as 'light touch' enforcement only at busy times, or manning the car park with a warden in order to consider the needs of genuine shoppers and taking into account the prevailing conditions at the site on any given day), and

iv) Failure to prominently inform a driver in large lettering on clear signage, of the purpose of the ANPR system and how the data would be used, and

v) Lack of the 'Privacy Notice' required to deliver mandatory information about an individual's right of subject access, under the Data Protection Act (DPA). At no point has the Defendant been advised how to apply for a Subject Access Request, what that is, nor informed of the legal right to obtain all relevant data held, and

16.1. This Claimant has therefore failed to meet its legal obligations under the DPA.

16.2. In a similar instance of DPA failure when using ANPR cameras without full DPA compliance - confirmed on this Claimant's Trade Body website in a 2013 article urging its members to comply - Hertfordshire Constabulary was issued with an enforcement notice. The force were ordered to stop processing people's information via ANPR until they could comply. The Information Commissioner ruled that the collection of the information was unlawful; breaching principle one of the DPA.

17. The Court's attention will be drawn to the case of Andre Agassi v S Robinson(HM Inspector of Taxes). Whilst not wholly aligned to the issues in this case, it is on all fours with the above point, because of the principle it extols that no one should profit from their unlawful conduct. Paragraph 20 of the Transcript of that case states: ''It is common ground that, whatever costs may be recoverable by a litigant in respect of professional services such as those provided by Tenon to the appellant, they cannot include the cost of any activities which are unlawful''. Paragraph 28 continues - ''...cannot on any view recover the cost of activities performed by Tenon which it was not lawful for them to perform.''

17.1. Further, in RTA (Business Consultants) Limited v Bracewell [2015] EWHC 630 (QB) (12 March 2015), at paragraph 34 the Judge discusses the relevance of the public law principle going back well over 200 years, that no man should profit from his crime; it is submitted that this is particularly relevant in this action. The Judge cited Lord Mansfield CJ to explain that: ''The principle of public policy is this; ex dolo malo non oritur actio. No Court will lend its aid to a man who founds his cause of action upon an immoral or an illegal act. If [...] the cause of action appears to arise ex turpi causa, or the transgression of a positive law of this country, there the Court says he has no right to be assisted. It is upon that ground the Court goes; not for the sake of the defendant, but because they will not lend their aid to such a plaintiff.''

17.2. Even if there was a purported contract between the unidentified driver and the Claimant, it was illegal at its formation because it was incapable of being created without an illegal act (the failure to comply with points #16 i - v above, as part of the legal obligations that must be communicated up front and/or undertaken by a consumer-facing service provider, some of which were required even before commencing any use of ANPR at all).

17.3. Where a contract is illegal when formed, neither party will acquire rights under that contract, regardless of whether or not there was an intention to break the law; the contract will be void and treated as if it had never been entered into. As such, the asserted contract cannot be enforced.

17.4. In this case it was not lawful for the Claimant to process any data using ANPR camera systems upon which it relied for the entire ticketing regime, due to its failure to meet its specific legal obligations as a data processor of ANPR information. The collection of the information was unlawful; breaching principle one of the DPA.

17.5. To add weight, the Defendant also cites from ParkingEye Ltd v Somerfield Stores Ltd [2012] EWCA Civ 1338, which concerns an alleged illegal contract involving a similar BPA member parking firm. Whilst the facts of that case are not relevant, the Judge's comments at paragraph 29 of the Transcript of theSomerfield case are of importance: ''At common law, historically, a distinction has been drawn between cases where the guilty party intended from the time of entering the contract unlawfully and cases where the intention to perform unlawfully was only made subsequently''. As has already been stated, in this case the problem arose at (and before) the formation of the alleged contract and was not in relation to any subsequent act. Laws LJ, in Somerfield, concluded that ParkingEye did not have an intention, when creating that contract, to deliberately break the law so the contract was upheld. Differently in this case, it is asserted that the Claimant did deliberately or negligently break the DPA and as it was a BPA member with access to a wealth of DPA compliance information, articles and legal advice, and being a signatory to the KADOE contract with the DVLA, the Claimant cannot be excused from, nor justify, their conduct in failing to meet their legal obligations.

17.6. At paragraphs 65-74 of the Somerfield transcript, Laws LJ set out three factors which need to be considered in a defence of illegality. The Defendant submits that the key issues in this action are that:

(i) the commission of an illegal wrong being present at the time of entering the contract means that the Claimant will not be able to enforce the contract.

(ii) the illegality is central to the contract and is not merely a minor aspect, thus it should not be held to be too remote so as to render the contract enforceable.

(iii) the nature of the illegality: in this case it was a breach of legal obligations regarding data, and not merely a civil tort as in Somerfield. The gravity of the illegality is therefore far greater.

17.7. It should be noted that the issue of breach of the DPA also transgresses the tests of fairness and transparency of consumer contracts, as set out in the Consumer Rights Act 2015, which was enacted after the final hearing in Beavis. This charge and use of ANPR by this claimant is both unfair and not transparent and can be fully distinguished from Beavis, where none of the issues in the Defendant's points 16 and 17 above were argued.

Coupon-mad

The appeal rejection letter is dated 16th March so I assume the 28 days starts from that date so gotta be sent before Friday 13th April.

You actually have 32 days, so longer than you think, honestly.

The above version was written for a defence, but I'd like to write a POPLA version. You can test it!

Coupon-mad

Here I've just pointed a pepipoo poster towards what to write for a new POPLA point:


Failure to comply with the data protection 'ICO Code of Practice' applicable to ANPR (no information about SAR rights, no privacy statement, no evaluation to justify that 24/7 ANPR enforcement at this site is justified, fair and proportionate). A serious BPA CoP breach.

http://forums.pepipoo.com/index.php?showtopic=119695&st=0&p=1373112!!!entry1373112

SalomonAssassin

Thanks for all the suggestions so far.

I have added to point 1 so it looks a lot more like the original from the newbies thread with some added points inspired by Umkomaas' post (though haven't included specific timings yet as I haven't had a chance to go back to the site in the last couple of days)
I've also added a couple of bits to point 2 but no major changes there really other than the removal of the photos with the flash on.
I've also added a point 7 regarding ICO CCTV Code of Practice. Wasn't sure if I should have just replaced point 6 completely with it or add it as point 7 so I added it but let me know if you think otherwise.
The rest of the points are unchanged.

Link is here (appreciate if someone could "linkify" it again please)
https:[slash][slash]drive.google.com/file/d/1zNb032FgDm-HJbanbsJZssyj6UOzNSKQ/view?usp=sharing

I would specifically appreciate your thoughts on the new point 7 about ICO's CCTV Code of Practice.

KeithP

https://drive.google.com/file/d/1zNb032FgDm-HJbanbsJZssyj6UOzNSKQ/view

Not had time to read all of it yet, but the first thing that strikes me is that your sign shown in figure 1 is far to big.
It is the biggest picture in the document.
Suggest it should be no bigger than Figure 3 or 4, and perhaps not lit by flash.
I know you are not making the point about visibility here, but it looks to me to be a far too good a picture generally.

SalomonAssassin

Oh yeah that's because I was doing a standardised width on the pictures before but now that I've taken out the other pictures with flash I agree it does look a bit big. I'll resize it to the same as Figures 3/4.

In terms of the lighting, I guess I just wanted to show what the layout of the sign was and how there was a lot of small text at the bottom but maybe I can get a picture without the flash and try and still show that but also keep the low light appearance and just let ParkingEye provide a better picture if the POPLA adjudicator wants to see it clearly.

KeithP

SalomonAssassin wrote: »

...maybe I can get a picture without the flash and try and still show that but also keep the low light appearance and just let ParkingEye provide a better picture if the POPLA adjudicator wants to see it clearly.

Yes, that's the way to go. Let PE prove their signs are legible - no need for you to do that for them.

SalomonAssassin

SalomonAssassin wrote: »

Thanks for all the suggestions so far.

I have added to point 1 so it looks a lot more like the original from the newbies thread with some added points inspired by Umkomaas' post (though haven't included specific timings yet as I haven't had a chance to go back to the site in the last couple of days)
I've also added a couple of bits to point 2 but no major changes there really other than the removal of the photos with the flash on.
I've also added a point 7 regarding ICO CCTV Code of Practice. Wasn't sure if I should have just replaced point 6 completely with it or add it as point 7 so I added it but let me know if you think otherwise.
The rest of the points are unchanged.

Link is here (appreciate if someone could "linkify" it again please)
https:[slash][slash]drive.google.com/file/d/1zNb032FgDm-HJbanbsJZssyj6UOzNSKQ/view?usp=sharing

I would specifically appreciate your thoughts on the new point 7 about ICO's CCTV Code of Practice.

Apologies for repeating myself but I was hoping to get some feedback before I send this off in the next couple of days - mainly on the last section about the ICO CoP.

Any thoughts?

Coupon-mad

The ICO point looks good, well done for being the guinea pig to this new idea; I hope it has legs!

I would just add where you put near the end that there is nothing on the sign about your right to a Subject Access Request (SAR), that there is also nothing on any paperwork, PCN, rejection letter, no privacy statement about data, despite there being a Data Protection heading on the back of the PCN, this is the operator paying mere 'lip service' to the right to a complaint, which is not the same thing at all. Nothing tells you anything about your right to subject access and this is a mandatory point in the ICO CoP, which in turn is mandatory within the BPA CoP and a serious omission by any data processor using ANPR, such that it makes the use of this registered keeper's data unlawful.

I would remove #3 as there is no point in that argument of the PCN is a POFA one.

Remove #5 and #6 which detract from the rest of the appeal and have no legs at POPLA.

And I would not have that yellow sign AT ALL in your appeal, unless you crop it to only show the (bottom of the notice) small print, and nothing above it. You are shooting yourself in the foot showing a sign talking about 3 hours 'max stay'.

Umkomaas

The ICO point looks good, well done for being the guinea pig to this new idea; I hope it has legs!

I rather suspect that when PE see this, they will fold. And will keep on folding whenever it crops up, until such time they can put in place some damage limitation strategy - but amending/replacing signage to accommodate will be difficult.

That's my bet - but my record today with my few (wasted) Rands on the Grand National might not be a great example of my gambling prowess.