Article 13 GDPR (Data Protection Act 2018)

bergkamp

Do Gladstones actually send out the letter that follows the DR+ chain? The one that purports to come from Gladstones,but states to contact DR+ and not Gladstones... ?
A sar to Gladstones after receiving one could be interesting...

abedegno

Gladstones/DRP etc are data processors and not data controllers. It is the data controller (i.e the PPC) responsibility for complying with the subject access request.

However, if you sent a SAR to a data processor (e.g. Gladstones or DRP) it would still need to be dealt with properly.

Castle

abedegno wrote: »

Gladstones/DRP etc are data processors and not data controllers. It is the data controller (i.e the PPC) responsibility for complying with the subject access request.

However, if you sent a SAR to a data processor (e.g. Gladstones or DRP) it would still need to be dealt with properly.

Actually the DRP website state that they are "joint data controller" with their client:-
http://www.debtrecoveryplus.co.uk/privacynotice/

beamerguy

bergkamp wrote: »

Do Gladstones actually send out the letter that follows the DR+ chain? The one that purports to come from Gladstones,but states to contact DR+ and not Gladstones... ?
A sar to Gladstones after receiving one could be interesting...

That is a good idea but given that Gladstones has
a history of deceit and fabrication etc etc, who could
ever trust them to give an honest answer despite what
the law requires

Comparing SAR requests from Gladstones would be good.

bergkamp

beamerguy wrote: »

That is a good idea but given that Gladstones has
a history of deceit and fabrication etc etc, who could
ever trust them to give an honest answer despite what
the law requires

Comparing SAR requests from Gladstones would be good.

The honest answer could be that they have no data on you or the VRM the SAR is about... and if so they may/will tell you.
This would leave them and DR+ in a sticky situation would it not?

Umkomaas

Recommendations to submit a SAR for every new parking ticket are starting to be advised. Hopefully OPs are not confused by the acronym.

http://www.nationalcrimeagency.gov.uk/publications/517-submitting-a-suspicious-activity-report-sar-within-the-regulated-sector/file

Although in essence there may not be too much difference between them!

beamerguy

Umkomaas wrote: »

Recommendations to submit a SAR for every new parking ticket are starting to be advised. Hopefully OPs are not confused by the acronym.

http://www.nationalcrimeagency.gov.uk/publications/517-submitting-a-suspicious-activity-report-sar-within-the-regulated-sector/file

Although in essence there may not be too much difference between them!

Has the https://www.nationalcrimeagency.gov.uk received any
SAR's regarding the great Gladstones/IPC/IAS scam ???

abedegno

Just sent the following to privacy@parkingeye.co.uk

Dear Sir/Madam:

I am writing to you in your capacity as data protection officer for your company - DATA PROCESSOR NAME. I have reason to believe you hold personal data on myself as a vehicle I own and am the registered keeper for visits car parking sites managed by your company. It should be noted that contrary to article 13 of GDPR legislation no privacy information was provided to myself, the data subject, at the time of collection. I am therefore compelled into making this request for access to personal data pursuant to Article 15 of the General Data Protection Regulation.

The vehicle in question is a VEHICLE MAKE/MODEL with VRM:VEHICLE REGISTRATION.
I have attached the V5 document to prove I am the registered keeper. Should you require further documentation necessary to verify my identity please contact me.

I would like you to be aware at the outset, that I anticipate a reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the Information Commissioners Office (ICO).

Please advise as to the following:

1.) Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases.

a) In particular, please tell me what you know about me in your information systems, whether or not contained in databases, and including e-mail, documents on your networks, or voice or other media that you may store.

b) Additionally, please advise me in which countries my personal data is stored, or accessible from. In case you make use of cloud services to store or process my data, please include the countries in which the servers are located where my data are or were (in the past 12 months) stored.

c) Please provide me with a copy of, or access to, my personal data that you have or are processing.

2.) Please provide me with a detailed accounting of the specific uses and lawful basis that you have made, are making or will be making of my personal data.
3.) Please provide a list of all third parties with whom you have (or may have) shared my personal data.

a) If you cannot identify with certainty the specific third parties to whom you have disclosed my personal data, please provide a list of third parties to whom you may have disclosed my personal data.

b) Please also identify which jurisdictions that you have identified in 1(b) above that these third parties with whom you have or may have shared my personal data, from which these third parties have stored or can access my personal data. Please also provide insight in the legal grounds for transferring my personal data to these jurisdictions. Where you have done so, or are doing so, on the basis of appropriate safeguards, please provide a copy.

c) Additionally, I would like to know what safeguards have been put in place in relation to these third parties that you have identified in relation to the transfer of my personal data.

4.) Please advise how long you store my personal data, and if retention is based upon the category of personal data, please identify how long each category is retained.
5.) If you are additionally collecting personal data about me from any source other than me, please provide me with all information about their source, as referred to in Article 14 of the GDPR.
6.) If you are making automated decisions about me, including profiling, whether or not on the basis of Article 22 of the GDPR, please provide me with information concerning the basis for the logic in making such automated decisions, and the significance and consequences of such processing.


Yours Sincerely,

DATA SUBJECT'S NAME

Umkomaas

Thanks for sight of the above.

I think, for future reference, it might be better to number each of the separate request points, so that their response should have the same numbered replies and you can tick them off (or spot any they've ignored/skipped over). Otherwise you might get a reply with lots of the points rolled together forming wish-washy answers, lacking specificity.

abedegno

Hmm, I did number them but they didn't copy across properly. Let me try again.