POPLA Appeal Review Please

acarty

4. BPA!!!8217;s Code of Practice (21.4) states that:
!!!8220;It is also a condition of the Code that, if you receive and process vehicle or registered keeper data, you must:

• be registered with the Information Commissioner
• keep to the Data Protection Act
• follow the DVLA requirements concerning the data
• follow the guidelines from the Information Commissioner!!!8217;s Office on the use of CCTV and ANPR cameras, and on keeping and sharing personal data such as vehicle registration marks

The guidelines from the Information Commissioner!!!8217;s Office that the BPA!!!8217;s Code of Practice (21.4) refers to is the CCTV Code of Practice found at:
LINK


The ICO!!!8217;s CCTV Code of Practice makes the following assertions:


!!!8220;This code also covers the use of camera related surveillance equipment including: Automatic Number Plate Recognition (ANPR);!!!8221;


!!!8220;the private sector is required to follow this code to meet its legal obligations under the DPA. Any organization using cameras to process personal data should follow the recommendations of this code.!!!8221;


!!!8220;If you are already using a surveillance system, you should regularly evaluate whether it is necessary and proportionate to continue using it.!!!8221;


!!!8220;You should also take into account the nature of the problem you are seeking to address; whether a surveillance system would be a justified and an effective solution, whether better solutions exist, what effect its use may have on individuals!!!8221;


!!!8220;You should consider these matters objectively as part of an assessment of the scheme!!!8217;s impact on people!!!8217;s privacy. The best way to do this is to conduct a privacy impact assessment. The ICO has produced a !!!8216;Conducting privacy impact assessments code of practice!!!8217; that explains how to carry out a proper assessment.!!!8221;


!!!8220;If you are using or intend to use an ANPR system, it is important that you undertake a privacy impact assessment to justify its use and show that its introduction is proportionate and necessary.!!!8221;


!!!8220;Example: A car park operator is looking at whether to use ANPR to enforce parking restrictions. A privacy impact assessment is undertaken which identifies how ANPR will address the problem, the privacy intrusions and the ways to minimize these intrusions, such as information being automatically deleted when a car that has not contravened the restrictions leaves a car park.!!!8221;


!!!8220;Note:... in conducting a privacy impact assessment and an evaluation of proportionality and necessity, you will be looking at concepts that would also impact upon fairness under the first data protection principle. Private sector organisations should therefore also consider these issues.!!!8221;


!!!8220;A privacy impact assessment should look at the pressing need that the surveillance system is intended to address and whether its proposed use has a lawful basis and is justified, necessary and proportionate.!!!8221;


The quotations above taken directly from the ICO!!!8217;s CCTV Code of Practice state that if Civil Enforcement Ltd wish to use ANPR cameras then they must undertake a privacy impact assessment to justify its use and show that its introduction is proportionate and necessary. It also states that Civil Enforcement Ltd must regularly evaluate whether it is necessary and proportionate to continue using it. It therefore follows that I require Civil Enforcement Ltd to provide proof of regular privacy impact assessments in order to comply with the ICO!!!8217;s CCTV Code of Practice and BPA!!!8217;s Code of Practice. I also require the outcome of said privacy impact assessments to show that its use has !!!8220;a lawful basis and is justified, necessary and proportionate!!!8221;.


The ICO!!!8217;s CCTV Code of Practice goes on to state:


!!!8220;5.3 Staying in Control


Once you have followed the guidance in this code and set up the surveillance system, you need to ensure that it continues to comply with the DPA and the code!!!8217;s requirements in practice. You should:


!!!8226; tell people how they can make a subject access request, who it should be sent to and what information needs to be supplied with their request;!!!8221;


!!!8220;7.6 Privacy Notices


It is clear that these and similar devices present more difficult challenges in relation to providing individuals with fair processing information, which is a requirement under the first principle of the DPA. For example, it will be difficult to ensure that an individual is fully informed of this information if the surveillance system is airborne, on a person or, in the case of ANPR, not visible at ground level or more prevalent then it may first appear. One of the main rights that a privacy notice helps deliver is an individual!!!8217;s right of subject access.!!!8221;


Civil Enforcement Ltd has not stated on their signage a Privacy Notice explaining the keepers right to a Subject Access Request (SAR). In fact, Civil Enforcement Ltd has not stated a Privacy Notice or any wording even suggesting the keepers right to a SAR on any paperwork, NtK, reminder letter or rejection letter despite there being a Data Protection heading on the back of the NtK. This is a mandatory requirement of the ICO!!!8217;s CCTV Code of Practice (5.3 and 7.6) which in turn is mandatory within the BPA!!!8217;s Code of Practice and a serious omission by any data processor using ANPR, such that it makes the use of this registered keeper!!!8217;s data unlawful.


As such, given the omissions and breaches of the ICO!!!8217;s CCTV Code of Practice, and in turn the BPA!!!8217;s Code of Practice that requires full ICO compliance as a matter of law, POPLA will not be able to find that the PCN was properly given.




5. Contrary to the mandatory provisions of the BPA Code of Practice, there is no record to show that the vehicle was parked versus attempting to read the terms and conditions before deciding against parking/entering into a contract.


PoFA 2012 Schedule 4 paragraph 9 refers at numerous times to the !!!8220;period of parking!!!8221;. Most notably, paragraph 9(2)(a) requires the NtK to:
!!!8220;specify the vehicle, the relevant land on which it was parked and the period of parking to which the notice relates;!!!8221;


Civil Enforcement Ltd!!!8217;s NtK simply claims that the vehicle !!!8220;entered the car park at 19:27:04 and departed at 21:17:12!!!8221;. At no stage does Civil Enforcement Ltd explicitly specify the !!!8220;period of parking to which the notice relates!!!8221;, as required by POFA 2012. Civil Enforcement Ltd uses ANPR (while failing to comply with the data protection'ICO Code of Practice' applicable to ANPR) to capture images of vehicles entering and leaving the vast unbounded and unmarked area to calculate their length of stay. Any vehicle passing by will be captured by ANPR. Civil Enforcement Ltd, however, does not provide any direct evidence of its alleged violation. It is not in the gift of Civil Enforcement Ltd to substitute !!!8220;entry/exit!!!8221; or !!!8220;length of stay!!!8221; in place of the POFA requirement - !!!8220;period of parking!!!8221; - and hold the keeper liable as a result.


By virtue of the nature of an ANPR system recording only entry and exit times, Civil Enforcement Ltd are not able to definitively state the period of parking.


I require Civil Enforcement Ltd to provide evidence to show the vehicle in question was parked on the date/time (for the duration claimed) and at the location stated in the NtK.



6. BPA Code of Practice point 20.5a stipulates that:


"When issuing a parking charge notice you may use photographs as evidence that a vehicle was parked in an unauthorized way. The photographs must refer to and confirm the incident which you claim was unauthorized. A date and time stamp should be included on the photograph. All photographs used for evidence should be clear and legible and must not be retouched or digitallyaltered."


The NtK does not contain any images to evidence the alleged offence. I require Civil Enforcement Ltd to produce evidence of the alleged offence with original images containing the required date and time stamp and images showing the car is actually parked in the location stated rather than just passing by. Given the unbounded nature of the venue, failing to produce such evidence would indicate the Civil Enforcement Ltd has been using ANPR to engage random license plate collection of all vehicles passing by and send NtK!!!8217;s with the aim to extract penalty. Such action is no different from sticking parking tickets to all vehicles passing by.


Recent investigation (27 Apr 2018) by BBC (LINK) shows that the private parking industry is unregulated and does not have any accountability. Various cases show the industry!!!8217;s priority is maximizing the penalty received from the motorist without due regard to the integrity of the evidence. Private parking operators are financially incentivized not to use the original image as evidence, but putting partial evidence together to generate a case biased towards generating a penalty fee. Based on the fact above, I require Civil Enforcement Ltd to produce strong evidence, audited by qualified third party, to prove that its process is not biased to suit its financial objective.



7. A search in Warrington Borough Council!!!8217;s planning and building control database (LINK) does not show any planning permission for the pole-mounted ANPR cameras for the car park at Postern ate, St Austin Lane, WA1 1HE, nor does it show any advertising consent for signage.


UK government guidance on advertisement requires:
!!!8220;If a proposed advertisement does not fall into one of the Classes in Schedule 1 or Schedule 3 to the Regulations, consent must be applied for and obtained from the local planning authority (referred to as express consent in the Regulations). Express consent is also required to display an advertisement that does not comply with the specific conditions and limitations on the class that the advertisement would otherwise have consent under. It is criminal offence to display an advertisement without consent.!!!8221;


This clearly proves Civil Enforcement Ltd is/has been seeking to enforce Terms & Conditions displayed on illegally erected signage, using equipment (pole-mounted ANPR cameras) for which no planning application had been made.


I request Civil Enforcement Ltd provides evidence that the correct Planning Applications were submitted (and approved) in relation to the pole-mounted ANPR cameras and that Advertising Consent was gained for signage exceeding 0.3 m2, prior to the date to which this appeal relates (5 July 2018).


8. Civil Enforcement Ltd!!!8217;s NtK simply claims !!!8220;that the vehicle !!!8220;entered the car park at 19:27:04 and departed at 21:17:12!!!8221;. Civil Enforcement Ltd collects these time stamps by its ANPR camera system installed on site.


In terms of the technology of the ANPR cameras themselves, POPLA please take note and bin your usual 'ANPR is generally OK' template because:


The British Parking Association DOES NOT AUDIT the ANPR systems in use by parking operators, and the BPA has NO WAY to ensure that the systems are in good working order or that the data collected is accurate. Independent research has NOT found that the technology is 'generally accurate' or proportionate, or reliable at all, and this is one of the reasons why Councils are banned from using it in car parks.


As proof of this assertion here are two statements by the BPA themselves, the first one designed to stop POPLA falling into error about assumed audits:


Steve Clark, Head of Operational Services at the BPA emailed a POPLA 'wrong decision' victim back in January 2018 regarding this repeated misinformation about BPA somehow doing 'ANPR system audits', and Mr Clark says: "You were concerned about a comment from the POPLA assessor who determined your case which said:


"In terms of the technology of the cameras themselves, the British Parking Association audits the camera systems in use by parking operators in order to ensure that they are in good working order and that the data collected is accurate"


You believe that this statement may have been a contributory factor to the POPLA decision going against you, and required answers to a number of questions from us.


This is not a statement that I have seen POPLA use before and therefore I queried it with them, as we do not conduct the sort of assessments that the Assessor alludes to.


POPLA have conceded that the Assessor's comments may have been a misrepresentation of Clause 21.3 of the BPA Code which says:
''21.3 You must keep any ANPR equipment you use in your car parks in good working order. You need to make sure the data you are collecting is accurate, securely held and cannot be tampered with. The processes that you use to manage your ANPR system may be audited by our compliance team or our agents.''


Our auditors check operators compliance with this Code clause and not the cameras themselves.''


Secondly, ANPR data processing and/or system failure is well known, and is certainly inappropriate in a mixed retail and residential area, such as the location in question.


The BPA even warned about ANPR flaws:
LINK


''As with all new technology, there are issues associated with its use'' and they specifically mention the flaw of assuming that 'drive in, drive out' events are parking events. They state that: ''Reputable operators tend not to uphold charge certificates issued in this manner''.


In this case, as the driver drove in and briefly stopped where there are no signs or bays at all (not in any retail area, but at a private residence not signed as being managed by Smart Parking) the ANPR system has indeed failed and the operator has breached the first data protection principle by processing flawed data from their system.


PLEASE NOTE: In this case, the driver entered the car park and then proceeded to leave the car park some 20 seconds later. The flawed ANPR technology assumed that this drive in, drive out event was a parking event.


Excessive use of ANPR 24/7 when such blanket coverage is overkill in terms of data processing, was also condemned by the BPA and the ICO:


LINK


As POPLA can see from that, excessive use of ANPR is in fact, illegal, and no-one audits it except for the ICO when the public, or groups, make complaints.


Civil Enforcement Ltd is put to strict proof that the system has not failed visitors to the residential homes within this site.


POPLA cannot use your usual 'the BPA audits it' erroneous template which needs consigning to the bin.


Please show the above email from Steve Clark, to your Lead Adjudicator.


Kindly stop assuming ANPR systems work, and expecting consumers to prove the impossible about the workings of a system over which they have no control but where independent and publicly available information about its inherent failings is very readily available.


I require the Operator to present records as to the dates and times of when the cameras at this car park were checked, adjusted, calibrated, synchronised with the timer which stamps the photos and generally maintained to ensure the accuracy of the dates and times of any ANPR images. This is important because the entirety of the charge is founded on two images purporting to show the vehicle entering and exiting at specific times. It is vital that this Operator must produce evidence in response to these points and explain to POPLA how their system differs (if at all) from the flawed ANPR system which was wholly responsible for the court loss by the Operator in Parking Eye v Fox-Jones on 8 Nov 2013. That case was dismissed when the judge said the evidence form the Operator was 'fundamentally flawed' as the synchronisation of the camera pictures with the timer had been called into question and the operator could not rebut the point. Civil Enforcement Ltd has not provided any evidence to show that their system is reliable, accurate or maintained. I request that you uphold my appeal based on this.

With the above points taken into account, I therefore request that POPLA uphold my appeal and cancel this PCN.

Redx

in the ANPR capture section , add the specific point that the vehicle entered and exited the car park TWICE and so should have been captured by anpr ON 4 OCCASIONS , 2 entry times and 2 exit times, not one single continuous visit as recorded by CEL, I put CEL to strict proof by way of the anpr logs captured between the first entry and second exit


or something to that effect, embellishing what you have already stated above, as this is a typical DOUBLE DIP case

acarty

Redx wrote: »

in the ANPR capture section , add the specific point that the vehicle entered and exited the car park TWICE and so should have been captured by anpr ON 4 OCCASIONS , 2 entry times and 2 exit times, not one single continuous visit as recorded by CEL, I put CEL to strict proof by way of the anpr logs captured between the first entry and second exit


or something to that effect, embellishing what you have already stated above, as this is a typical DOUBLE DIP case

Thanks very much for your comments. On the first entry, there was no exit (three point turn) and on the second exit, there was no entry (three point turn). They were simply three point turns in the car park entrance, the car wasn't even driven into the car park. I will make this clearer in the appeal.


Thanks

KeithP

Forgive me for asking, but why did you do a three point turn in the car park entrance?

Also, why did you do it a second time?

To me, this almost looks like you were trying to trick, or fool, the ANPR system and your prank has backfired.

I hope I am wrong.

acarty

KeithP wrote: »

Forgive me for asking, but why did you do a three point turn in the car park entrance?

Also, why did you do it a second time?

To me, this almost looks like you were trying to trick, or fool, the ANPR system and your prank has backfired.

I hope I am wrong.

Yes it definitely wasn't a prank. I had turned into the car park entrance to reverse into a vacant space on the road (reverse parallel park). Leaving the space on the road, I used the car park entrance to make another three point turn in order to drive away in the opposite direction that I had initially come in.


I would have no pleasure in trying to trick or fool the ANPR system, which I didn't know was there or I would have never even thought about doing this. I would never want this headache and certainly wouldn't think about trying to trick the system as a prank?

Redx

either way , 3 point turn or whatever you wish to call it , their system failed to capture the entry and exit of the vehicle in the car park entrance on occasion number one and yet again on occasion nunber two - so spell it out in black and white

do not rely on your interpretation of what constitutes an entry and an exit, or what the assessor may believe, spell it out like you would to a 4 year old kid in a patronising way

as far as we are concerned, the driver had 2 entry times and 2 exit times , each one for just a few seconds in the car park entrance whilst a 3 point turn was being performed

so each visit comes under the grace period allowed to stay or go , as defined in #13 of the BPA CoP


the same would have applied had the driver driven into the car park, reversed into a space and then immediately driven out again, only it would have taken a minute or two instead of a few seconds, same arguments apply

acarty

Redx wrote: »

either way , 3 point turn or whatever you wish to call it , their system failed to capture the entry and exit of the vehicle in the car park entrance on occasion number one and yet again on occasion nunber two - so spell it out in black and white

do not rely on your interpretation of what constitutes an entry and an exit, or what the assessor may believe, spell it out like you would to a 4 year old kid in a patronising way

as far as we are concerned, the driver had 2 entry times and 2 exit times , each one for just a few seconds in the car park entrance whilst a 3 point turn was being performed

so each visit comes under the grace period allowed to stay or go , as defined in #13 of the BPA CoP

That's fantastic and is very clear to me now, thanks so much for the advice Redx :beer:

Coupon-mad

You need that clearly stated for POPLA to read, near the top.

Your first numbered point should be explaining what happened, that the car didn't even enter, let alone park.

Redx

as above, that point is the strongest point to make, as it is also stating that no period of parking ever happened , hence why subsequent points put CEL to strict proof that the vehicle remained on site for the duration (which it clearly didnt)

took me a while to find it buried in all the guff and also it too me a while to figure out what the circumstances were , hence why you spell it out at the beginning , so the assessor is in no doubt about it

its probably the strongest point that can be made , so do not bury it

acarty

Thanks both. I have added this as the first point and improved my wording on all the other points. I have raised issues with the flawed ANPR system (which didn't capture entry/exit on both occasions), lack of evidence to show the period of parking and other points as detailed in post #3 of the newbies thread. It feels stronger to read now than what I first posted yesterday afternoon:

I have included the first point below for a proof read if someone wouldn't mind. Hopefully my grammar is better coupon-mad?

• No Period of Parking Occured
• The ANPR System is Neither Reliable nor Accurate
• No Vehicle Images contained in PCN: BPA Code of Practice
• No landowner contract nor legal standing to form contracts or charge drivers
• No Evidence of Period Parked – NtK does not meet PoFA 2012 requirements
• Inadequate and unclear signage
• No grace period given (Clause #13 BPA Code of Practice)
• Failure to comply with the data protection 'ICO Code of Practice' applicable to ANPR (no information about SAR rights, no privacy statement, no evaluation to justify that 24/7 ANPR enforcement at this site is justified, fair and proportionate). A serious BPA CoP breach
• No Planning Permission from Warrington Borough Council for Pole-Mounted ANPR Cameras and no Advertising Consent for signage

1. At 19:27:04 on 05/07/2018, the vehicle in question was driven into the entrance of the car park. A legal three point turn was then carried out in the unbounded and unclear entrance of the car park and then vehicle was parked in a vacant parking space on Cairo Street. Approximately 110 minutes later, the vehicle left the space on Cairo Street and used the entrance of the car park for a second time to conduct another legal three point turn, allowing the vehicle to progress in the direction it had initially come from on Cairo Street.

Since the vehicle did not enter the car park (and therefore did not park), no period of parking elapsed. I require Civil Enforcement Ltd to present strict proof that the vehicle remained on site for the alleged period of parking. The ANPR system failed to capture the entry and exit of the vehicle in the car park entrance on both occasion number one and again on occasion number two. It is therefore considered that each visit is covered under the permitted grace period, as defined in section 13 of the BPA CoP (please see point 4).