ES Parking IAS

Fruitcake

Note that asking you for proof of ID does not stop the clock, and the original 30 day response period, or ICO's additional 14 days, still stands. They could have asked for proof of ID early on so they have been unreasonable by delaying that request. They should have asked for ID within one month and explained their reasons why.

In any case, the ICO have said it should not be necessary to ask for additional proof if the scammers already have a continuing relationship.
They have sent a PCN/NTK to the keeper. The keeper with the same name and address as the PCN has responded.
The scammers have furthered their relationship with the keeper by issuing a LBC.

I suggest you complain again to the ICO that the scammers are stalling and being unreasonable.



The ICO say the PPC's cannot extend the deadline if all they are asking is further proof of ID.

Can we extend the time for a response?
You can extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual. You must let the individual know within one month of receiving their request and explain why the extension is necessary.

However, it is the ICO's view that it is unlikely to be reasonable to extend the time limit if:

it is manifestly unfounded or excessive;
an exemption applies; or
you are requesting proof of identity before considering the request."

The ICO have also said that asking for photo ID is unreasonable as they have nothing to compare it with.

The ICO website says this: To avoid personal data about one individual being sent to another,
either accidentally or as a result of deception, you need to be
satisfied that you know the identity of the requester. You can ask
for enough information to judge whether the person making the
request is the individual to whom the personal data relates (or a
person authorised to make a SAR on their behalf).
The key point is that you must be reasonable about what you ask
for. You should not request a lot more information if the identity of
the person making the request is obvious to you. This is particularly
the case when you have an ongoing relationship with the individual.

Tabz123

1. RESPONSE FROM IVAN LEWIS (MP BURY SOUTH)
Ivan Lewis' office have responded detailing that they find the reason for the invoice from ES completely baseless (upon receiving my request for help). They will be writing to the company in due course to question their rationale and to pursue the matter. (I hope this is before the court date as I have already received the LBC from Gladstones)

2. RESPONSE FROM ESPEL regarding my GDPR request:
The letter detailed the following:
'We are in receipt of your letter and would like to bring a few matters to your attention to explain why your request to remove your data was not approved;

A. The vehicle registration xxxx was ticketed on 08.xx.xx and the ticket was attached to the screen. We received an appeal letter dated 09.xx.xx from you. Since you appealed the letter that the driver was responsible for, then it is assumed that you were the driver.

B. You have provided evidence that you are the registered keeper of the car. Therefore unless you affirm the identity of the vehicle we consider that the registered keeper was the driver.


Under GDPR we are processing your data under the following 3 components:

1. Legitimate business interest
2. Data processing is necessary as shown by us
3. Balancing our roghts againts the individuals rights and freedoms

We have shared your data in line with the terms and conditions detailed on our website and the PCN.

ESPEL

Tabz123

My response to ES:

Dear Sir/Madam:

Re PCN number: xxxxxx

I am writing to respond to your letter dated xx.xx.xx in which you attempt to explain your apparent reasons for processing my data ignoring my request for erasure.
You detail that on the xx.xx.xx a ticket was attached to the vehicle registered xx xx xx. However the presentation of a letter to you by the registered keeper within a day does not in any case prove the identity of the driver of the vehicle of the time, as the letter sent to you dated xx.x.xx does not detail any such reference there within. It is legitimate to consider that any vehicle owned by a registered keeper is returned to them within any given period of time and on receipt of that vehicle, a ticket/invoice responded to.

Furthermore, ES Parking Enforcement Ltd (ESPEL) have failed to provide any evidence that any assumed/purchased ticket was not present in the vehicle even though a valid ticket had been presented to you.

This case is now being taken on by Ivan Lewis’ office, whom is the MP for Bury South. You will be hearing from his office in due course. If this matter is not concluded in due course, then please note that I will be requesting Ivan to contact MPs across Greater Manchester to review all contracts held by ESPEL and review all practices and respective complaints in their entirety.

In light of GDPR, given that you have been unable to clearly identify the driver of the vehicle, the weight of your deemed’ legitimate business interests are outweighed by my personal rights and freedoms which I feel are being ignored. I once again consider this letter my right to objection under article 21 of the GDPR and request that you stop processing my data and unless ESPEL can provide a legitimate business interest given you have been unable to identify the driver of the vehicle for processing my information, I will be lodging a secondary complaint to the ICO.

You are required to respond within 21 days.

Tabz123

I have now sent the following email to the DPO when he sent me a long winded form to complete for the SAR:

Dear Mr Johnson,

I do not find your additional request for information at all appropriate or reasonable within the GDPR rules stipulated by the ICO. You will note that the ICO website details the following:

'To avoid personal data about one individual being sent to another, either accidentally or as a result of deception, you need to be satisfied that you know the identity of the requester. You can ask for enough information to judge whether the person making the request is the individual to whom the personal data relates (or a person authorised to make a SAR on their behalf). The key point is that you must be reasonable about what you ask for. You should not request a lot more information if the identity of the person making the request is obvious to you. This is particularly the case when you have an ongoing relationship with the individual'.

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.
You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request.

The fact that I have both written to you and communicated to you via email using the same details, as well as provided external evidence(in the form of the V5 copy), you have sufficient evidence to identify me as an individual. In addition my original request was made on xx.June and you have responded via email on xx.September.

I also refuse to complete the difficult request form. You will note that the ICO details the following in request to Subject Access Requests:
However, even if you have a form, you should note that a subject access request is valid if it is submitted by any means, so you will still need to comply with any requests you receive in a letter, a standard email or verbally.
Therefore, although you may invite individuals to use a form, you must make it clear that it is not compulsory and do not try to use this as a way of extending the one month time limit for responding.
I have already sent you a SAR in my letter dated June. You are therefore already in breach of the timelines stipulated by the ICO. In the event that you do have this original request to hand, please find the letter attached above.
Given the above infractions, I suggest that you formally advise Gladstones to stop processing my data, until you have resolved with me as the data subject my SAR.
I hope to receive your response as soon as possible.

LETS SEE THEIR RESOPONSE. I also copied in the ICO email address which deals with cases.

Umkomaas

Nice proactive approaches from you @Tabz123 - more power to your elbow.

Castle

Tabz123 wrote: »

We have shared your data in line with the terms and conditions detailed on our website and the PCN.

Yes.. but were those terms and conditions on the privacy notice at the car park when the data subject's personal data, (i.e VRD), was initially collected. This is requirement of Article 13 of the GDPR.

Tabz123

The disclosures of data collection were not appropriately shared as on review of the PCN, the information is limited. They refer to the DPA1988. They do not mention anything about sharing the data with third parties.

Tabz123

MY RESPONSE TO THE LBC FROM GLADSTONES:

Dear Sir/Madam:

Re PCN number: XXXXXX

Thank you for your letter of LCB dated xx.xx.xx

I wish to take this opportunity to point out to you that your letter contains insufficient detail of the claim for costs in question.

I politely request that you send me the following information/documents such I maybe able to better :

1. An explanation of the cause of action
2. Whether your clients is pursuing me as driver or keeper
3. Whether you client is relying on the provisions of Schedule 4 of POFA 2012
4. What the details of the claim are (where it is claimed the car was parked, for how long, how the monies being claimed arose and have been calculated, what contractual breach (if any) is being claimed)
5. A copy of the contract with the landowner under which they assert authority to bring the claim
6. A copy of any alleged contract with the driver
7. A plan showing where any signs were displayed
8. Any photo evidence applicable to the claim which clearly represents the claim as well as allowing the vehicle to be identifiable (in all representative photos)
9. Copies of any invoices and/or costs of claims your client has allegedly issued

All of the above information has been sent to your client in the form of a SAR. The request has been made on two separate occasions and there have been nil responses to date.

Unfortunately I am unable to respond properly to the alleged claim and to consider my position in relation to it until you are able to provide me with the above information. I greatly appreciate your assistance in this matter. Furthermore please accept this correspondence as a holding reply as your client ESPEL is in breach of the GDPR (see ICO response in the appendix to this letter). Until ESPEL have addressed this breach, the case must be put on hold until that time. I therefore request data restriction for 30 days or I will have to report you also, to the ICO.

Castle

Tabz123 wrote: »

The disclosures of data collection were not appropriately shared as on review of the PCN, the information is limited. They refer to the DPA1988. They do not mention anything about sharing the data with third parties.

GDPR started on 25th May 2018 so if the PCN predates this then DPA1998 is correct; of course, any data processed after 25th May is now subject to GDPR.

You may want to remind ES Parking that failure to respond to a SAR is now an offence under section 173(3) of the 2018DPA.
http://www.legislation.gov.uk/ukpga/2018/12/section/173/enacted

Le_Kirk

I politely request that you send me the following information/documents such I maybe able to better :

Do you want to finish that sentence so it makes sense? At the moment nobody knows (especially the recipients of the letter) what you want to better!