June 2018 - start of the new PPC and DVLA fightback (GDPR related)

abedegno

BTailor wrote: »

Euro Parking Services email address: dpo@europarkingservices.com

"Thank you for getting in contact with us. In order to process your request please fill in the relevant details on the Subject Access Request(SAR) Form.

Note that it does say:

You are under no obligation to fill this form out, but it would be useful for us to receive it so that we can more accurately establish your request.

But ICO guidance here:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

I would suggest that form is far from proportional and definitely warrants a complaint to the ICO.

Umkomaas

I would suggest that form is far from proportional and definitely warrants a complaint to the ICO.

I agree. Try to get the ICO to stop this nonsense in its tracks ...... but their track record is pretty abysmal when it comes to supporting Average Joe's/Jill's rights against organisations that have the money-power to kick back against the ICO - much more than Joe/Jill could ever muster.

Never ask, never get, but don't hold your breath!

Cake_maker

An observation. If you have been contacted by email, over and over again by the PPC and have replied using the same email address over and over again, this appears to be good enough proof to the PPC and debt collectors that they are contacting the RK whilst hounding you for money?
So why is that not sufficient proof that the RK is using the same email address for the SAR request?

beamerguy

Cake_maker wrote: »

An observation. If you have been contacted by email, over and over again by the PPC and have replied using the same email address over and over again, this appears to be good enough proof to the PPC and debt collectors that they are contacting the RK whilst hounding you for money?
So why is that not sufficient proof that the RK is using the same email address for the SAR request?

I agree, plus they expect a NTK to arrive at the
correct address. From the same address a SAR was sent
to be replied to the same address

Euro are being obstructive and hoping the OP will
not want to send private info and forget about the SAR

Regardless, Euro must by law reply to the SAR in the given
time period. Failure to do that can only result in a
second complaint to the ICO

abedegno

Looks like I've got the same boilerplate response from DVLA as allcomplainsgohere:

Thank you for your email regarding information held on our DVLA records on the above vehicle.

Firstly, I can assure you that the DVLA takes the protection and security of its data very seriously and has procedures in place to ensure data is disclosed only where it is lawful and fair to do so.

Regulation 27 of the Road Vehicle (Regulations and Licensing) Regulations 2002 provides a legal gateway for the release of information. Therefore, the right to restrict the processing of your data does not apply.

The law allows the DVLA to release information from the vehicle record to third parties who can demonstrate they have reasonable cause to receive it. Disclosure in these circumstances does not breach the Data Protection Act and the Information Commissioner!!!8217;s Office is fully aware that data held on the DVLA!!!8217;s records is released in this way.

This situation has not changed with the implementation of the General Data Protection Regulation which came into effect in May 2018.

You have the right to complain to the Information Commissioner!!!8217;s Office if you believe that the DVLA has not handled your request to exercise your right appropriately. Please write to The Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

I realise you will be disappointed with my reply, however I regret I am unable to assist you on this occasion.

Yours sincerely

Another complaint to the ICO coming up...

Coupon-mad

abedegno wrote: »

How about:

Restriction of automated decision making

Dear Sir/Madam,

I understand from reading the privacy notice provided by DVLA here:
https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter
That DVLA will release my personal details to private and public-sector organisations providing they can demonstrate reasonable cause to receive it. It is also my understanding that this information is released electronically and automatically without human intervention using the Keeper at Date of Event (KADOE) system.

This arrangement falls under the scope of Article 22 of the GDPR, which has rules to protect individuals where a solely automated decision-making has legal or similarly significant effects on them.

My concern is that this automated process does not:

• Check that reasonable cause exists.
• Check that the KADOE System user has met their contractual requirement with DVLA, which includes:
  • That information from the records are used for the reason that was given.
  • Evidence exists that an unauthorised parking incident occurred.
  • There is an Agreement with the landowner to authorise the private parking operator to operate the parking scheme on their land and to take legal action to recover a charge on their behalf.

As such I would like the DVLA records containing my personal details as registered keeper of vehicles:

• ABC
• DEF
• Etc

To be marked as frozen so that all future decision making involves human intervention so that as the data subject I can express my point of view, obtain an explanation of the decision and, if applicable, challenge it.

Yours Sincerely

The Data Subject

Just repeating the DVLA letter/email idea from abedegno, above for others to copy.

And a summary from earlier in this thread, as to what to ask for from the PPC in a SAR:

ANPR cases - you will always want all letters/PCN/NTK and all images, but consider also any other data streams (e.g. PDT machine or iPad VRN records).

PDT machine - you might want 'exact and near-miss VRN data' if there's a suggestion of a typo. PDT machine where you put in the wrong VRN - you'd be asking for all data stream info for both VRNs.

Permit (residents car park) cases - you'd want all photos, all letters/the PCN & NTK, and you should ask for all ''whitelist'' data about your car and/or complaints you might have made that were shared by the Managing Agent with the parking firm. And/or all copies of letters or emails ever sent to your home or email address about the 'permit scheme' and all data held from the initial 'due diligence' checks they and the Managing Agent made* to ensure no unconscionable PCNs would be issued to residents who already enjoyed the right to park and/or all responses made to the introduction of the scheme and the percentage of residents who agreed or objected and any formal variation of the leases that occurred to enable the onerous nuisance of a parking firm to override residents' existing primacy of contract.

:T

markrg1965

I also received the same template response from the DVLA and will complain to the ICO although to date I have received nothing from the ICO, other than an automated 'we are very busy' email in response to my first complaint about UK-CPM. Not sure if anyone has received anything from their individual SAR's but to to date I have nothing to report, requests for more information and complete silence seem to be the norm. I suspect though that this is inconvenient for them, assuming that 1000's like me have made similar requests!

kryten3000

When complaining to the ICO, please also point out any PPC use of the ICO logo on their website/letters.

I'd bet they don't have permission.

The rules for use of the ICO logo:

"The use of any of the Information Commissioner's logos on any document or in association with any information signifies that the document or information has been prepared or approved by the Information Commissioner. The logos are used only on materials generated by the Commissioner's office or where the Commissioner's office has worked in association with an organisation preparing advice on data protection or freedom of information.

Use of any of the Commissioner's logos without the Commissioner's consent infringes the copyright held in respect of the logos. No permission will be granted for the use of the logos nor will reproduction of the logos in any form be allowed unless the Commissioner determines that:

the material on which the logos is to be used and
the use of the logos on such material have been expressly approved by her office."

Coupon-mad

Good point, that ICO logo is all over websites and PPC paperwork.

markrg1965

I now have a casework reference for my complaint to the ICO about UK-CPM, be interesting to see what they say although they appear very busy right now.