subject access requests

AJ16

I found this link useful in drafting my own SAR to Parking Eye
https://padi.zendesk.com/hc/en-us/articles/206890469-6-Subject-Access-Requests-Easy-

Umkomaas

Good link - the £10 charge can, however, no longer be levied - it's now free.

KeithP

It's not bad as a starting point, but is now out of date - since 25 May 2018 and the introduction of GDPR.

1) references, two of them, to the Data Protection Act 1998 need changing to the Data Protection Act 2018.

2) there is now generally no charge for a Subject Access Request. so the reference to a £10 cheque is no longer appropriate.

3) they now need to respond within one month.

AJ16

yep, I know about there not being a charge so I changed the wording as necessary, looking forward to chasing them after their bullyboy tactics a PCN.

AJ16

We got a response to our SAR request to Parking Eye however they are now asking us for more information so I just wanted to check if this is right. it's taken a month, they say-

"We note that you have made a request for any and all data we hold pertaining to your name, address, along with a specific VRM. To enable us to further process your request in respect of the VRM specified, we also require the following information:

-A copy of the V5.
-Copy insurance document."

They finish by saying -

" We would be grateful if you could also provide any additional info we may require to be able to deal with your request efficiently, such as any date parameters that we should apply to the data sought.

On receipt of the above we will review your request. If we require further information in relation to your request we will respond and let you know"

I find this a bit odd as they didn't ask for any of this before initially and incorrectly sending the PCN to us. I have no idea what a VRM is. What do you think?

Thanks in advance.

abedegno

VRM is vehicle registration mark - i.e license plate.

I got the same response from ParkingEye, and I don't believe they are complying fully with the regulations:

As per ICO guidance here:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information.

Taking a month to come back to ask for more information doesn't seem 'as soon as possible' to me and warrants a complaint to the ICO on that basis.

I provided the V5 but declined to provide the insurance documents, I advised that insurance documents are unnecessary as the VRM is an identifier which is related to the registered keeper as the data subject for which proof of identity has already been provided, it is possible for people to be the driver of a vehicle who are not named in an insurance policy.

Annoyingly as per the ICO:

The period for responding to the request begins when you receive the additional information.

So they have reset the 30 day response clock to reply to you.

System

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

abedegno is spot on. You could send them a copy of the V5 but not the insurance document. Ask them to detail their justification for asking that information as it may contain personal information of a third party they have no right to know.

If they still refuse, then it is a complaint to the ICO. It is now clear the DVLA are having their wings clipped and the ICO is now the route to go.

The_Deep

Also complain to your MP, PE were named and shamed in the HoC recently.

This is an entirely unregulated industry which is scamming the public with inflated claims for minor breaches of contracts for alleged parking offences, aided and abetted by a handful of low-rent solicitors.

Parking Eye, CPM, Smart, and another company have already been named and shamed, as has Gladstones Solicitors, and BW Legal, (these two law firms take hundreds of these cases to court each year). They lose most of them, and have been reported to the regulatory authority by an M.P. for unprofessional conduct

Hospital car parks and residential complex tickets have been especially mentioned.

The problem has become so rampant that MPs have agreed to enact a Bill to regulate these scammers. Watch the video of the Second Reading in the HofC recently.

http://parliamentlive.tv/event/index/2f0384f2-eba5-4fff-ab07-cf24b6a22918?in=12:49:41

and complain in the most robust terms to your MP. With a fair wind they will be out of business by Christmas.

fisherjim

IamEmanresu wrote: »

abedegno is spot on. You could send them a copy of the V5 but not the insurance document. Ask them to detail their justification for asking that information as it may contain personal information of a third party they have no right to know.

If they still refuse, then it is a complaint to the ICO. It is now clear the DVLA are having their wings clipped and the ICO is now the route to go.

I wonder if that is a template reply, and requesting insurance details is a sneaky way of getting more evidence of who the driver was in live cases?


I can't see how that furthers their need for evidence when the V5 copy does that.

beamerguy

The PPC gets access to info they are entitled to from
the DVLA

That's it ..... anything else, they are NOT entitled to

PPC's lost the motorists trust a long time ago
who knows what they could do with further info ???

abedegno

fisherjim wrote: »

I wonder if that is a template reply, and requesting insurance details is a sneaky way of getting more evidence of who the driver was in live cases?

Might be a good idea to mark any information you send to them to prove your identity as 'without prejudice"