NCP PCN to Keeper - POFA 2012 non compliant ( I think)

Nonum2018

6. Failure to comply with the data protection 'ICO Code of Practice' applicable to ANPR (no information about SAR rights, no privacy statement, no evaluation to justify that 24/7 ANPR enforcement at this site is justified, fair and proportionate). A serious BPA CoP breach

BPA!!!8217;s Code of Practice (21.4) states that:
!!!8220;It is also a condition of the Code that, if you receive and process vehicle or
registered keeper data, you must:
!!!9679; be registered with the Information Commissioner
!!!9679; keep to the Data Protection Act
!!!9679; follow the DVLA requirements concerning the data
!!!9679; follow the guidelines from the Information Commissioner!!!8217;s Office on the
use of CCTV and ANPR cameras, and on keeping and sharing personal
data such as vehicle registration marks
The guidelines from the Information Commissioner!!!8217;s Office that the BPA!!!8217;s Code of
Practice (21.4) refers to is the CCTV Code of Practice found at:

LINK REMOVED
The ICO!!!8217;s CCTV Code of Practice makes the following assertions:
!!!8220;This code also covers the use of camera related surveillance equipment
including:
!!!8226; Automatic Number Plate Recognition (ANPR);!!!8221;
!!!8220;the private sector is required to follow this code to meet its legal obligations
under the DPA. Any organization using cameras to process personal data should
follow the recommendations of this code.!!!8221;

!!!8220;If you are already using a surveillance system, you should regularly evaluate
whether it is necessary and proportionate to continue using it.!!!8221;
!!!8220;You should also take into account the nature of the problem you are seeking to
address; whether a surveillance system would be a justified and an effective
solution, whether better solutions exist, what effect its use may have on
individuals!!!8221;

!!!8220;You should consider these matters objectively as part of an assessment of the
scheme!!!8217;s impact on people!!!8217;s privacy. The best way to do this is to conduct a
privacy impact assessment. The ICO has produced a !!!8216;Conducting privacy impact
assessments code of practice!!!8217; that explains how to carry out a proper
assessment.!!!8221;

!!!8220;If you are using or intend to use an ANPR system, it is important that you
undertake a privacy impact assessment to justify its use and show that its
introduction is proportionate and necessary.!!!8221;

!!!8220;Example: A car park operator is looking at whether to use ANPR to enforce
parking restrictions. A privacy impact assessment is undertaken which identifies
how ANPR will address the problem, the privacy intrusions and the ways to
minimize these intrusions, such as information being automatically deleted when
a car that has not contravened the restrictions leaves a car park.!!!8221;

!!!8220;Note: ... in conducting a privacy impact assessment and an evaluation of proportionality and necessity, you will be looking at concepts that would also impact upon fairness under the first data protection principle. Private sector organisations should therefore also consider these issues.!!!8221;

!!!8220;A privacy impact assessment should look at the pressing need that the
surveillance system is intended to address and whether its proposed use has a
lawful basis and is justified, necessary and proportionate.!!!8221;

The quotations above taken directly from the ICO!!!8217;s CCTV Code of Practice state that
if National Car Parks Limited wish to use ANPR cameras then they must undertake a privacy
impact assessment to justify its use and show that its introduction is
proportionate and necessary. It also states that National Car Parks Limited must regularly
evaluate whether it is necessary and proportionate to continue using it.
It therefore follows that I require National Car Parks Limited to provide proof of regular privacy
impact assessments in order to comply with the ICO!!!8217;s CCTV Code of Practice and
BPA!!!8217;s Code of Practice. I also require the outcome of said privacy impact
assessments to show that its use has !!!8220;a lawful basis and is justified, necessary
and proportionate!!!8221;.
The ICO!!!8217;s CCTV Code of Practice goes on to state:
!!!8220;5.3 Staying in Control
Once you have followed the guidance in this code and set up the surveillance
system, you need to ensure that it continues to comply with the DPA and the
code!!!8217;s requirements in practice. You should:
!!!8226; tell people how they can make a subject access request, who it
should be sent to and what information needs to be supplied with their
request;!!!8221;
!!!8220;7.6 Privacy Notices
It is clear that these and similar devices present more difficult challenges in
relation to providing individuals with fair processing information, which is a
requirement under the first principle of the DPA. For example, it will be difficult to
ensure that an individual is fully informed of this information if the surveillance
system is airborne, on a person or, in the case of ANPR, not visible at ground
level or more prevalent then it may first appear.
One of the main rights that a privacy notice helps deliver is an individual!!!8217;s
right of subject access.!!!8221;

National Car Parks Limited has not stated on their signage a Privacy Notice explaining the
keepers right to a Subject Access Request (SAR). In fact, National Car Parks Limited has not stated a Privacy Notice or any wording even suggesting the keepers right to a SAR on
any paperwork, NtK, reminder letter or rejection letter despite there being a Data
Protection heading on the back of the NtK. This is a mandatory requirement of the
ICO!!!8217;s CCTV Code of Practice (5.3 and 7.6) which in turn is mandatory within the
BPA!!!8217;s Code of Practice and a serious omission by any data processor using ANPR,
such that it makes the use of this registered keeper!!!8217;s data unlawful.
As such, given the omissions and breaches of the ICO!!!8217;s CCTV Code of Practice, and
in turn the BPA!!!8217;s Code of Practice that requires full ICO compliance as a matter of law,
POPLA will not be able to find that the PCN was properly given.

7. No Evidence of Period Parked !!!8211; NtK does not meet PoFA 2012 requirements
Contrary to the mandatory provisions of the BPA Code of Practice, there is no record
to show that the vehicle was parked versus attempting to read the terms and
conditions before deciding against parking/entering into a contract.
PoFA 2012 Schedule 4 paragraph 9 refers at numerous times to the !!!8220;period of
parking!!!8221;. Most notably, paragraph 9(2)(a) requires the NtK to:

!!!8220;specify the vehicle, the relevant land on which it was parked and the period of
parking to which the notice relates;!!!8221;

National Car Parks Ltd!!!8217;s NtK simply claims that the vehicle !!!8220;entered [xxx] at [xxx] and
departed at [xxx]!!!8221;. At no stage does National Car Parks Limited explicitly specify the !!!8220;period of parking to which the notice relates!!!8221;, as required by POFA 2012.
National Car Parks Limited uses ANPR (while failing to comply with the data protection
'ICO Code of Practice' applicable to ANPR) to capture images of vehicles entering
and leaving the vast unbounded and unmarked area to calculate their length of stay.
Any vehicle passing by will be captured by ANPR. National Car Parks Ltd, however, does
not provide any direct evidence of its alleged violation. It is not in the gift of National Car Parks Ltd to substitute !!!8220;entry/exit!!!8221; or !!!8220;length of stay!!!8221; in place of the POFA
requirement - !!!8220;period of parking!!!8221; - and hold the keeper liable as a result.
By virtue of the nature of an ANPR system recording only entry and exit times, National Car Parks Ltd are not able to definitively state the period of parking.
I require National Car Parks Limited to provide evidence to show the vehicle in question was parked on the date/time (for the duration claimed) and at the location stated in the NtK, NOT merely evidence of entering and exiting, which does NOT specifically identify period of parking.

8. Vehicle Images contained in PCN: BPA Code of Practice !!!8211; non-compliance
The BPA Code of Practice point 20.5a stipulates that:
"When issuing a parking charge notice you may use photographs as evidence
that a vehicle was parked in an unauthorized way. The photographs must refer to
and confirm the incident which you claim was unauthorized. A date and time
stamp should be included on the photograph. All photographs used for
evidence should be clear and legible and must not be retouched or digitally
altered."
The NtK in question contains two close-up license plate images. The time and date
stamp inserted into above (but not part of) the images and an enhanced image of the number plate inserted below. The images do not show the vehicle parked in the carpark in an unauthorized way. Thus I require confirmation of the vehicle parked in an unauthorized way and hence National Car Parks Limited claim was unauthorized.
I require National Car Parks Limited to produce evidence of the original images containing the required date and time stamp and images showing the car is actually parked in the
location stated rather than simply entering and exiting.

Recent investigation (27 Apr 2018) by BBC (LINK REMOVED) shows that the private parking industry is unregulated and does not have any accountability. Various cases show the industry!!!8217;s priority is maximizing the penalty received from the motorist without due regard to the integrity of the evidence. Private parking operators are financially incentivized not to use the original image as evidence, but putting partial evidence
together to generate a case biased towards generating a penalty fee. Based on the
fact above, I require National Car Parks Limited to produce strong evidence, audited by
qualified third party, to prove that its process is not biased to suit its financial
objective.

Nonum2018

9. The ANPR System is Neither Reliable nor Accurate
National Car Parks Ltd!!!8217;s NtK simply claims !!!8220;that the vehicle !!!8220;entered [xxx] at [xxx] and
departed at [xxx]!!!8221;. National Car Parks Limited states the images and time stamps are collected by its ANPR camera system installed on site.
In terms of the technology of the ANPR cameras themselves, POPLA please take
note and bin your usual 'ANPR is generally OK' template because:
The British Parking Association DOES NOT AUDIT the ANPR systems in use by
parking operators, and the BPA has NO WAY to ensure that the systems are in good
working order or that the data collected is accurate. Independent research has NOT
found that the technology is 'generally accurate' or proportionate, or reliable at all, and
this is one of the reasons why Councils are banned from using it in car parks.
As proof of this assertion here are two statements by the BPA themselves, the first
one designed to stop POPLA falling into error about assumed audits:
Steve Clark, Head of Operational Services at the BPA emailed a POPLA 'wrong
decision' victim back in January 2018 regarding this repeated misinformation about
BPA somehow doing 'ANPR system audits', and Mr Clark says:
"You were concerned about a comment from the POPLA assessor who determined
your case which said:
"In terms of the technology of the cameras themselves, the British Parking
Association audits the camera systems in use by parking operators in order to ensure
that they are in good working order and that the data collected is accurate"
You believe that this statement may have been a contributory factor to the POPLA
decision going against you, and required answers to a number of questions from us.
This is not a statement that I have seen POPLA use before and therefore I
queried it with them, as we do not conduct the sort of assessments that the
Assessor alludes to.

POPLA have conceded that the Assessor's comments may have been a
misrepresentation of Clause 21.3 of the BPA Code which says:
''21.3 You must keep any ANPR equipment you use in your car parks in good working order. You need to make sure the data you are collecting is accurate, securely held and cannot be tampered with. The processes that you use to manage your ANPR system may be audited by our compliance team or our agents.'' Our auditors check operators compliance with this Code clause and not the cameras themselves.''
Secondly, ANPR data processing and/or system failure is well known, and is certainly
inappropriate in a mixed retail and residential area, such as the location in question.
The BPA even warned about ANPR flaws:
LINK REMOVED
''As with all new technology, there are issues associated with its use'' and they
specifically mention the flaw of assuming that 'drive in, drive out' events are parking events. They state that: ''Reputable operators tend not to uphold charge certificates issued in this manner''.
As POPLA can see from that, excessive use of ANPR is in fact, illegal, and no-one
audits it except for the ICO when the public, or groups, make complaints.
National Car Parks Limited is put to strict proof that the system has not failed visitors to
this site.
POPLA cannot use your usual 'the BPA audits it' erroneous template which needs
consigning to the bin.
Please show the above email from Steve Clark, to your Lead Adjudicator.
Kindly stop assuming ANPR systems work, and expecting consumers to prove the
impossible about the workings of a system over which they have no control but where
independent and publicly available information about its inherent failings is very
readily available.

10. The Signs Fail to Transparently Warn Drivers of what The ANPR Data will be used for
The signs fail to transparently warn drivers of what the ANPR data will be used for
which breaches the BPA Code of Practice and the Consumer Protection from Unfair
Trading Regulations 2008 due to inherent failure to indicate the 'commercial intent' of
the cameras.
Paragraph 21.1 of the BPA Code of Practice advises operators that they may use
ANPR camera technology to manage, control and enforce parking in private car parks,
as long as they do this in a reasonable, consistent and transparent manner. The Code
of Practice requires that car park signs must tell drivers that the operator is using this
technology and what it will use the data captured by ANPR cameras for.
National Car Parks Ltd!!!8217;s signs do not comply with these requirements because these car
park signage failed to accurately explain what the ANPR data would be used for,
which is a 'failure to identify its commercial intent', contrary to the BPA CoP and
Consumer law.
There is no information indicates that these camera images would be used in order to
issue Parking Charge Notices. There is absolutely no suggestion in the sentence
above that the cameras are in any way related to Parking Charge Notices.

Fig 1.3 contains a notice describing the use of cameras and simply states:
!!!8220;Our cameras record your number plate on entry and exit. ANPR technology is in use in this car park.!!!8221;
This in no way indicates how your date is stored, captured and then used to obtain information from the DVLA in order to raise a PCN.
11. No Planning Permission from Stoke on Trent city Council for Pole-Mounted ANPR Cameras and no Advertising Consent for signage
A search in Stoke on Trent city council planning database does not show any planning
permission for the pole-mounted ANPR cameras, nor does it show any advertising consent for signage exceeding 0.3m2.
UK government guidance on advertisement requires:
!!!8220;If a proposed advertisement does not fall into one of the Classes in Schedule 1
or Schedule 3 to the Regulations, consent must be applied for and obtained from
the local planning authority (referred to as express consent in the Regulations).
Express consent is also required to display an advertisement that does not
comply with the specific conditions and limitations on the class that the
advertisement would otherwise have consent under.
It is criminal offence to display an advertisement without consent.!!!8221;

This clearly proves National Car Parks Limited is/has been seeking to enforce Terms &
Conditions displayed on illegally erected signage, using equipment (pole-mounted
ANPR cameras) for which no planning application had been made.
I request National Car Parks Limited provides evidence that the correct Planning Applications were submitted (and approved) in relation to the pole-mounted ANPR cameras and that Advertising Consent was gained for signage exceeding 0.3 m2, prior to the date to
which this appeal relates.

Nonum2018

I still have details to fill in, pictures to emebed and formatting to sort out. would be greatful if could advise if i should remove sections, reword anything or add anything.
Thanks

Nonum2018

Hi,
Ive updated and formatted my appeal so hoping to send it tomorrow. Ive added a link on google drive below for it. Its still pretty similar to what i posted above mainly a few words, formatting and pictures embedded.


Would be grateful if it could be looked over and get some comments before i submit.



Specifically I think my NTK is non PoFA compliant so would like confirmation that is covered well enough in points 1 and 2. Also point 3 is regarding grace periods, arguing both entry AND exit periods haven't been considered.


Ive reworded the other points too but not sure if i should leave them all in or taker some out.
Thanks in advice for taking time to have a look.




[FONT=&quot][/FONT]https://drive.google.com/open?id=13q-VGovRFZ-yi3Pk4jdG47jA90lwe2EG

KeithP

Can you not embed the Supreme Court's tweet as an image, rather than as a link?
Same for the Beavis sign.

Your ebay link doesn't work.

The pictures throughout the body of the appeal do seem rather small. Perhaps your bigger pictures at the end should be moved to the relevant places within the body of the text to replace the smaller images. I also notice that while you talk about 'fig n.n' in the text, you do not label the images within the text - only the larger images appear to be labelled as such. You cannot expect the assessor to jump around the document looking for a particular figure. They won't bother and your point will be lost.
I also notice that some of the smaller pics seem to cover some text, but that may be due to my pc or the browser I'm using - I don't know.

In the last sentence in 10. the word 'date' should be 'data'.

Nonum2018

Hi keithP
Thanks for looking through.

Do you think there main points for the Ntk being non compliant are fine and valid then?
also no need to remove any of the additional later points?

Yep will embed the images signage images rather than links, didn!!!8217;t check the ebay one so thanks. Will enlarge all the images too, just seemed to be getting too big with the large pictures in the tex which was why I shrunk them.
The picture references are all to the pictures at the rear but makes sense to label the embedded ones too.
On my laptop (using Microsoft word) the images seem fine, will convert to a pdf see if that helps for viewing on other applications.
Will get changes done tomorrow. Thanks again for taking your time to read through.

Nonum2018

Hi,
recommended changes done.


https://drive.google.com/open?id=1nt0tiTXKRe3p7rvoPG-44X7Y-I25fwFJ


The additional images and increased size have made it quite long...



Hopefully this is pretty much ready to send now once I complete some of the specifc [XXX] details and add actual NTK.


No one has commented on points 1,2 and 3 so i hope that means they are satisfactory.


Thanks

Nonum2018

I'm going to submit this tomorrow so hopefully its ok.


https://drive.google.com/open?id=1nt0tiTXKRe3p7rvoPG-44X7Y-I25fwFJ


Not sure if its too long now and should remove any of the additional points though.

Nonum2018

Big thanks to everyone who took time to advise and also everyone who contributes really as I!!!8217;ve read loads of threads and picked up bits from many.

Got email stating appeal successful as NCP are not contesting it!

Thank you for submitting your parking charge Appeal to POPLA.

An Appeal has been opened with the reference xxxxxxxx

NCP have told us they do not wish to contest the Appeal. This means that your Appeal is successful and you do not need to pay the parking charge.

Yours sincerely

POPLA Team

beamerguy

GOOD NEWS:j:j

One can only assume that NCP were scamming you, they
could have done that when you appealed to them in the
first place

Another of the BPA's bad boys