Data Protection Breach

Fruitcake

Covid_Vaccinator said:

Fruitcake said:

I suggest you send an urgent request to the DPO of the scammers, telling them to confirm that they have not sent your data to anyone else.

I would warn the other person whose data you have been sent. At the moment, it is they who have been the subject of the data breach and they should be complaining like mad as well as you.

Both of you should be complaining to the scammer's ATA.

It really would help for us to know who the scammers are because some of them have form for doing this before.

PS. What does ATA mean?

Common acronyms can be found in the fifth post of the NEWBIES.


It was VCS who did this before. Remind the ATA, DVLA, and ICO that this is not the first time this has happened.

D_P_Dance

Reading and understanding that thread is a sine qua non in dealing with this matter.

Covid_Vaccinator

Sending letter now - clinical work & other commitments took over.
Actually useful with the delay - VCS sent another letter through - still same issue with attaching a car reg number that is clearly not mine.
Letters going tomorrow morning.

Covid_Vaccinator

@Fruitcake, @Le_Kirk, @Half_way, @Coupon-mad, @Ralph-y , @beamerguy



I appreciate your thoughts on the following;

To Whom It May Concern,

 I wish to highlight my concerns with Vehicle Control Services (VCS). There is a case pending at Gateshead Law Courts.

 1)      I filed my defence with CCBC via email on Thursday 11th February. VCS were made aware that this was a defended claim when they contacted the CCBC the following day. On Tuesday 16th February, VCS wrote a “NOTICE OF RECOVERY” letter stating that they had been awarded a CCJ on Friday 12th February. They stated that I needed to pay a fee immediately otherwise enforcement action would commence. Furthermore, I was threatened with bailiffs and additional charges. This was HUGELY distressing. I was left shaken and unable to concentrate due to the contents of the letter. I would not have been in a fit state to safely complete my clinical duties. Thankfully, the letter was received on a day when I was not due to undertake clinical activities.

I immediately contacted CCBC who confirmed that my defence was filed in time by email to customerservice.mcol@hmcourts-service.gsi.gov.uk . VCS have failed to acknowledge this fact. They have also failed to apologise for their inaccurate and distressing letter.

 

2)      VCS have failed to send me their form N180. This was due by 1st March 2021. My Form N180 was emailed to the CCBC within the deadline.

 

3)      On 16th March, VCS sent me the details of a court case against Mr. xxx xxx. Claim reference number xxxxx. It will be heard at Liverpool Civil and Family Court. The letter was from Ambreen Arshad, and was attached to a screenshot stating my name and home address. My concern is two-fold, namely that I have the details of another case (thus breaching GDPR), and that this person may have my details (breaching GDPR). I have flagged this to VCS today by email (please see attached printed copy of email). I understand that the car park owners, xxxxxx are potential liable for a substantial claim as they are jointly and severally liable for the actions of their agents (VCS).

 

4)      The aforementioned document also contained colour photographs with an electronic date and time stamp showing “Aug09 2016 1045am.” In this photo are six (6) different vehicles. The registration plates are visible. This is a data breach under GDPR. I have flagged this to VCS today by email (please see attached printed copy of email). I understand that the car park owners, xxxxx are potential liable for a substantial claim as they are jointly and severally liable for the actions of their agents (VCS).

 

5)      On Thursday 25th March 2021 Ambreen Arshad, VCS Litigation department, posted another document. This document was stapled and contained the same photograph mentioned in point 3. This document can be shared if requested.

 

6)      Within the documents mention in points 3-5, Ambreen Arshad, VCS Litigation department has stated that I have not sent them a copy of my defence. This is untrue. As highlighted by the County Court Business Centre, VCS were provided with a copy of my defence. I also confirmed this by telephone to CCBC on Monday 19th April.

 

7)      The document mentioned in points 3-5 state that I was sent two parking charge notices. I do not recall receiving such letters. Moreover, the attached photos demonstrate no notices were attached on vehicles. Given that VCS sent me details of another party, it is possible that VCS failed to send letters to the appropriate address. This could also have implications for other drivers.

 

8)      I understand that similar concerns have been raised against VCS. Moreover, VCS have been advised to report previous data protection breaches to relevant parties. I am not in a position to know whether the latter has been actioned, however it raises further concerns regarding VCS.

 

9)      I request that VCS urgently notify the relevant parties of this data protection breach. I believe they have a duty to notify Mr. xxxxx xxxxxxxxx. Furthermore, I believe they have a responsibility to notify Liverpool Civil and Family Court, Information Commissioners Office, DVLA data manager, British Parking Association, County Court Business Centre, and Gateshead Law Courts.

 

10)   I request that VCS urgently notify me of any data protection breaches of my information.

 

11)   This episode has been incredibly distressing. This has been especially tough as it comes at a time when NHS staff are continuing to battle the Covid-19 pandemic. However, I feel that it is appropriate take time to raise this concerns due to the severity of the data protection breaches and misinformation that VCS have supplied the court. I have engaged with appropriate services for support due to the additional angst related to this episode.

 

12)   In view of the time taken and additional and expenses incurred, I appreciate consideration of awarding costs at the forthcoming hearing.

 

Yours sincerely,

Coupon-mad

If this is for the court don't address it to 'Whom it May Concern'.

And why not report this breach to the DVLA and GIAA who do Audits into firms who get DVLA data and tell them about your specific data concerns and ask if VCS is still red as it was after recent GIAA Audits in the public domain?   

FOI149 GIAA Audit results 2016 to 2019 - CP Plus RED, Britannia AMBER

FOI152 GIAA Audit results 2016 to 2020 - VCS RED, Indigo AMBER

https://www.whatdotheyknow.com/request/650801/response/1579051/attach/4/FOI152%20Review%20Response.pdf?cookie_passthrough=1

The Government Internal Audit Agency (GIAA) inspects data users on the DVLA’s behalf and the DVLA is alerted to any compliance related issues identified. These can range in severity from minor infringements (which companies are given an opportunity to address) to more serious cases of non-compliance resulting in the parking company being suspended from being able to request vehicle keeper data.

Why not ask DVLA what they did about the red audit companies and why they were not suspended?

Covid_Vaccinator

Coupon-mad said:

If this is for the court don't address it to 'Whom it May Concern'.

And why not report this breach to the DVLA and GIAA who do Audits into firms who get DVLA data asn tell them about your specific data concerns and ask if VCS is still red as it was after recent GIAA Audits in the public domain?   

FOI149 GIAA Audit results 2016 to 2019 - CP Plus RED, Britannia AMBER

FOI152 GIAA Audit results 2016 to 2020 - VCS RED, Indigo AMBER

https://www.whatdotheyknow.com/request/650801/response/1579051/attach/4/FOI152%20Review%20Response.pdf?cookie_passthrough=1

The Government Internal Audit Agency (GIAA) inspects data users on the DVLA’s behalf and the DVLA is alerted to any compliance related issues identified. These can range in severity from minor infringements (which companies are given an opportunity to address) to more serious cases of non-compliance resulting in the parking company being suspended from being able to request vehicle keeper data.

Why not ask DVLA what they did about the red audit companies and why they were not suspended?

@Coupon-mad - excellent as ever.
many thanks for this.
Was going to send to DVLA, but was not aware of GIAA. I will do that tomorrow.

Cheers

KeithP

If you're sending it to a named organisation, then To Whom It May Concern is not appropriate.

Use Dear Sirs.

To Whom It May Concern is used if you were to stick the thing on a notice board or lamppost for all to read.


And the valediction should be Yours faithfully, unless you are sending it to a named individual.

Jakeh_2

You may wish to edit paragraph 9 where you've accidentally (and ironically) included the name of the other victim of this data protection breach.

Umkomaas

Para 9 as well .... VCS are not BPA AOS members, but members of the International Parking Community (IPC) AOS. So you need to change that bit of the para. 

Le_Kirk

6)      Within the documents mention in points 3-5, Ambreen Arshad, VCS Litigation department has stated that I have not sent them a copy of my defence. This is untrue. As highlighted by the County Court Business Centre, VCS were provided with a copy of my defence. I also confirmed this by telephone to CCBC on Monday 19th April.

Not that you need it but you could point out that it is not your duty to serve your defence on the claimant, that is for they CCBC to deal with and you have confirmed this was done.