ECP refusing SAR without V5C escalated to ICO

w12ee3e

I have had an ongoing complaint with the ICO regarding ECP required a copy of the V5C. I have argued this was unfair, and in my case one of the vehicles I had was sold on therefore I don't possess the V5C any more, thus effectively this allows ECP to deny me my SAR.

Unfortunately, the ICO has backed ECP on this. Any thoughts on how to proceed? Here's the ICO's response.

I have now received a response from Euro Car Parks (ECP) about its level of identity checks.

(

ECP has explained that most of the data it holds relates to a vehicle registration number and therefore a VC5 document is requested as this allows ECP to be satisfied that it is disclosing information to the correct person who owns the car.

As a VC5 document directly relates to the information that ECP holds, we are satisfied that this is a proportionate ID request. As such, we would advise you to provide the requested information to ECP to allow it to progress your SAR.

In light of the above, we do not consider that further action is required from the ICO at this time. However, please note that we keep a record of all the complaints raised with us about the way organisations process personal information. The information we gather from complaints may form the basis for action in the future where appropriate.

)

Any thoughts?

Coupon-mad

Well you must reply to that idiot and tell them in words of one syllable why you cannot, and why other ID must be accepted.

Fruitcake

As above. You want to know what personal data of yours ECP hold on you, not what data they hold about a car that you do not own, and are no longer the registered keeper.

I suggest you research the ICO's complaints procedure.

GrumpyDil

I'd also point out that the V5 doesn't prove ownership and as ECP must have obtained your data from the DVLA they already know you are linked to the vehicle. 

w12ee3e

Thanks I have complained to the ICO. Spelt everything out in bullets from beginning to end.

w12ee3e

ICO have come back to me

Dear X

Thank you for your email. I am sorry you are disappointed with the decision-making in this case.

We do not consider that ECP is blocking your right of access, because the information ECP holds relates to the vehicle registration number. As such, ECP needs to ensure that any information released about this is disclosed to the owner of the vehicle.

In instances where someone other than the registered keeper is driving, the information that a parking company can disclose will be minimal.

I did however ask ECP to consider whether it can request another form of ID from you in my correspondence sent to them yesterday if you are unable to provide a copy of a V5C.

Any thoughts?

Fruitcake

The ICO obviously don't get it, but should know that the V5C does not hold any information about the owner of a vehicle. It actually says this on the V5C.
Again, you are not asking ECP to supply information about a vehicle for which you are not the registered keeper, you are asking what information they hold about the data subject. They (ECP) are being unreasonable by demanding you supply a copy of, or information from, a document that lawfully is no longer in your possession. 

You are simply asking what data they hold about you, and have reasonably supplied information that identifies you as the data subject, therefore the PPC must supply you with any and all data they hold about you.

I would complain again, and ask again about the ICO's complaints procedure because the person or persons who have replied so far obviously don't understand the problem.

I suggest you also complain to your MP about ECP and the ICO. It is quite simple. You do not have, nor have access to the document ECP are requesting. You have suppled reasonable proof of ID. The PPC are being unreasonable and intransient in their attitude. The ICO are either being deliberately obtuse, or simply do not understand how to do their job.
I would also ask your MP to forward this complaint to Michael Gove MP and Neil O'Brien MP at the department for levelling up, to show yet another problem with the unregulated parking industry, and their unreasonable behaviour, as well as the inefficiency of the ICO.

Is there a higher power that overseas the ICO? An ombudsman or Secretary of State perhaps to whom you could refer this problem.

D_P_Dance

I agree with fruity, get your MP on side, point him to theC5 programme..

w12ee3e

Done, I have complained to my MP as well. Also mentioned Michael Gove MP and the other chap thanks for the suggestion.

w12ee3e

Update on this. I have articulated all the points raised and escalated it to the complaints handling team at the ICO. Here's the response I've just had. TDLR - Eurocar Parks are justified in refusing to comply with the SAR for my personal information as I have not provided them with a V5C.

21 December 2021 

Case Reference: IC-1X

Dear XI am writing further to your request of 9 December 2021 in which you have asked us to review the handling of your data protection complaint. Your complaint has been passed to me for consideration and my role as a reviewing officer is to look at what we have done and why. Although I may not necessarily respond separately to each of the points you have raised I have:  reviewed the information relating to your data protection complaint and considered the points you have raised; considered whether the complaint was dealt with reasonably; considered whether the matter was handled in line with our casework processes; andconsidered whether there are any outstanding matters for us to pursue.Your complaint and our reviewI understand we have investigated your data protection complaint about Euro Car Parks and you’re unhappy with the outcome and our decision not to take further action.I have considered the points you have raised and have also reviewed the relevant information we hold about your case. I am satisfied that Ms Brewster dealt with your complaint appropriately and in line with our case handling procedures.In this case Ms Brewster explained the reasons for her view in the letter of 17 November 2021 where she found that Euro Car Parks has not complied with its data protection obligations as it failed to respond to your SAR within the one calendar month statutory timeframe.Ms Brewster also contacted you on the 6 December 2021 as it appears Euro Car Parks required documentation from you to verify your identity. You were concerned that they required a copy of your VC5 as a form of identity; Ms Brewster then contacted Euro Car Parks to query this. Upon receipt of its response Ms Brewster then contacted you again on the 9 December 2021 to explain we are satisfied it was a proportionate request.I note that Ms Brewster asked Euro Car Parks if you were able to provide another form of ID as you say you are not the registered keeper of the vehicle however you remain unhappy.Our position is that the data controller has to be satisfied as to the identity of the requester before releasing any personal data. In a situation where some information held may relate to a vehicle registration number but also to a driver of a vehicle (rather than the registered keeper), we would expect that a data controller would request a form of ID that would allow them to be satisfied as to the requester’s identity, and would also expect that they would only release information that they could be certain is the personal data of the requester. We understand that due to this, the information disclosed may be minimal in some instances.Having reviewed the matter, I am satisfied that Ms Brewster dealt with your complaint appropriately. As such this is not something that we intend to pursue further.Next steps and your optionsPart of the Information Commissioner’s Office (ICO) role is to consider complaints from people who believe there has been an infringement of the data protection law.Under data protection legislation (Section 165 of the Data Protection Act 2018) we must investigate a complaint to an appropriate extent, and inform you of the outcome. Part of this process includes considering whether further action is necessary or appropriate, in line with our Regulatory Action Policy.If we think an organisation has not complied with its obligations we can give advice and ask them to solve the problem. Our main aim is to improve the information rights practices of organisations, where there is an opportunity for us to do so.A case review is the final stage of the ICO’s case handling process which means that we won’t consider this complaint further. However I recognise that you may continue to disagree with our view.It may be helpful to explain that you are entitled to take your own cases to court under data protection legislation, irrespective of our decision. The ICO has no role in individual applications to the court, so if you wish to pursue this option, you may wish to seek private legal advice.Alternatively if you believe that the ICO has provided you with a poor service, or if you believe we have not treated you properly or fairly then you may be able to complain to: The Parliamentary and Health Service Ombudsman (PHSO), Millbank Tower, Millbank, London, SW1P 4QP.
 
All complaints to the PHSO must be made through an MP. If you require further information about the PHSO, you can call its helpline on 0345 015 4033.Yours sincerely,
Sacha Brannan 
Reviewing Officer 
Information Commissioner's Office

I've written to my MP to complain, I'm not sure what else to do. In conclusion I'm furious.

MrFrugalFever

I think it is disgusting that both ECP and the ICO are refusing to provide you with the information you have requested.
the information you have requested is clearly about YOU as a person and not the vehicle in which it relates to, I’m fairly certain your vehicle (at the time) doesn’t have a conscience nor the ability to request what data is held about it, so is, in my opinion, completely irrelevant.

At this stage, I would pursue the avenue in which the ICO case reviewer has suggested and also discuss with a solicitor with a view to taking ECP to court.