Parked unaware due to mental health in 2015, now received a Letter of Claim

moonpie1963

It's interesting to note they've replied requesting we fill out a form for the request that asks for waaaaay more information than is appropriate, including asking if we were the driver at the time of the incident. Very scammy. They're hoping we're gullible enough to fill it all out.

Le_Kirk

If they persist in being obstructive and unhelpful, send a complaint to the ICO.

D_P_Dance

Complain, even if they do not persist,  It will cost them money to deal with it.  

nosferatu1001

Tell them to !!!!!! off, you will not fill out their form and they are not allowed to make that a requirement
Deal with the SAR in a timely fashion, as that will affect how your complaint to the ICO is worded. Their obstruction has been recorded and reported on.

moonpie1963

I have complained to the ICO and given them a copy of the scammy form from Cp Plus

blackdog2220

there reply in 2022 should make nice reading , if you can remember what it was about 

joking 
its running at 50 working days for reply , thats 10 weeks , so mark your calender 

thats reply to say they are GOING to look at your case 

moonpie1963

I don't think I'm going to get a response at all, since I haven't specifically complained to CP Plus about the content of their form.
I received this auto-reply from the ICO:
----------------------------------------

Thank you for contacting the Information Commissioner’s Office. We confirm that we have received your correspondence. During the Coronavirus pandemic, please see our website for updates on the service you can expect from us during this time.  You can also call us on 0303 123 1113 or contact us via live chat. 

 If you have asked us for advice - we will respond within 14 days. While you wait, you should regularly check our website for relevant guidance, as we are updating this all the time. You should also read our GDPR myth busting blogs. If you have raised a question that we have answered on our website, we may respond by sending you a link to it.  But we will do our best to provide you with the information you need.

 If you have made a new complaint - we’re unlikely to look into it unless you have raised it with the responsible organisation (for a data protection complaint) or the responsible public authority (for a freedom of information complaint) first. Please make sure you have sent us a copy of their final response to you. We will assign your complaint to a case officer as soon as we can, and they will contact you in due course. 

If your correspondence relates to an existing case - we will add it to your case and consider it on allocation to a case officer. If you believe we have either failed to take appropriate steps to respond to your data protection complaint, or we do not provide you with information about the progress or outcome of your complaint within the next three months, you may be able to apply to the First-tier Tribunal to require us to respond to your complaint or to provide you with information about its progress.

 If you represent an organisation and you are reporting a personal data breach under the GDPR or the Data Protection Act 2018 - we aim to contact you within seven days to confirm receipt and to provide you with a case reference number. If you want advice urgently, you should telephone our helpline on 0303 123 1113. If we consider the incident is minor or you have indicated that you do not consider it meets the threshold for reporting, you may not receive a response from us, or we may respond by sending you a link to the relevant part of our guidance. You can find out more about data breach reporting on our website.

Where a significant cyber incident occurs, you may also need to report this to the National Cyber Security Centre (the NCSC). To help you decide, you should read the NCSC’s guidance about their role and the type of incidents that you should consider reporting.  

Incidents that might lead to a heightened risk of individuals being affected by fraud, should be reported to Action Fraud – the UK’s national fraud and cybercrime reporting centre. If your organisation is in Scotland, then reports should be made to Police Scotland.

If you are a Communications Service Provider reporting a security breach under the Privacy and Electronic Communications Regulations – you will need to report the security breach via this secure portal.

If you represent an organisation and are reporting a potential incident under the NIS Directive - we will contact you as soon as we can. You can find out more about the NIS Regulations on our website.

If you represent an organisation and you are reporting a security breach within the definition of the eIDAS regulation – we will contact you as soon as we can. You can find out more about the eIDAS regulation on our website.

If you have reported spam email – we are unlikely to need to contact you again, unless we need more information to help with our investigations. We publish details about the action we've taken on nuisance messages on our website.

 If you have asked for information you think we might hold - we will contact you if we need any more information to help us respond. Otherwise, we will respond within our public and statutory service levels.

 If you have only copied your correspondence to us - we will not respond.

 There is more information on our service standards and what to expect webpage. You can also call 0303 123 1113. We welcome calls in Welsh on 0330 414 6421. You can also contact us on live chat.

 For information about what we do with personal data please see our privacy notice.

 

Yours sincerely

 

The Information Commissioner’s Office

Umkomaas

The ICO always requires a DPA/GDPR complaint to first have been raised with the organisation about which you are wishing to complain. Send it to CP Plus and tell them that without a satisfactory response within 7 days you will be making a formal complaint to the ICO. Carry out the threat, never threaten without the determination to do so if needed. 

Coupon-mad

moonpie1963 said:

It's interesting to note they've replied requesting we fill out a form for the request that asks for waaaaay more information than is appropriate, including asking if we were the driver at the time of the incident. Very scammy. They're hoping we're gullible enough to fill it all out.

Show us that whole form please!

I want to refer that form to the BPA.  Very recently when discussing a different case, Steve Clark agreed with me that asking who was driving, as part of processing a SAR, is absolutely unacceptable.

moonpie1963

Here's a link to the doc: https://drive.google.com/file/d/1faQVPoJulmEE24Bhy05e8UHwWZexmn57/view?usp=sharing