Letter of Claim from DCB Legal - PCN dated 2019

anotheronewasted

Another little update...

I raised a complaint with the ICO against UKPC, based on their incomplete response to my SAR, and their very apparent poor data handling process.
After clearing up a little confusion with the ICO, they confirmed:
"We have considered the issues that you have raised with us and based on this information, it is our view that there is more work for the organisation to do"

This definitely rattled UKPC, and I had a mail from them stating they "do not see a basis of your complaint, and have informed the ICO of same."

I further responded highlighting that the SAR response was not complete, attached mails, key dates, quotes etc.

UKPC finally conceded that data shared with third parties is done so via an API, and signed of the mail with 
"And we again emphasis that there is no basis to your complaint. It is unreasonable to expect documentation to be provided to you, that we do not have.

We will further confirm this with the ICO, and defend any legal implications as you state."

Rattled 

Now, as far as I can make out data sharing via an API is standard, and legal?
And I am fully aware there probably is no case / merit in following up with the ICO.
But the fact UKPC never divulged this, and it took me telling them which of their own e-mail addresses I had been corresponding with, to get some data, is evidence enough for me that their processes are not robust?

And I am more than happy to be a total pain and nuisance to them.

B789

Of course, it is perfectly acceptable to be a pain and a nuisance to them. Even one missing bit of your information is cause for a complaint to the ICO. If they are claiming and you can prove that they have passed on your data to a third party and have not evidenced it in the SAR, that also is cause for the ICO to follow up.

Has the ICO now left the ball in your court or did they say that they will be back in touch?

anotheronewasted

B789 said:

Of course, it is perfectly acceptable to be a pain and a nuisance to them. Even one missing bit of your information is cause for a complaint to the ICO. If they are claiming and you can prove that they have passed on your data to a third party and have not evidenced it in the SAR, that also is cause for the ICO to follow up.

Has the ICO now left the ball in your court or did they say that they will be back in touch?

The ICO seem to have left in a somewhat limbo kind of state.
I think they actually tried to leave the ball in the court of UKPC.
They advised me to contact them again if i am not happy with the response of UKPC.

UKPC have definitely shared my data with multiple companies, 6 infact
This sharing was not demonstrated in their initial SAR response, nor even acknowledged until after I had raised the complaint with the ICO, and even now, their only comment / response was 
"Any transfer of your data to third parties is done by an API."
No details of to whom, and when for example.

B789

So get back to the ICO with your complaint reference and state those facts. They are obliged to follow this up and it is likely to get the UKPC DPO into a lot of trouble if they don't give the ICO a satisfactory explanation. The ICO is acting on your behalf and you should make full use of the service.

Not_A_Hope

I love it when a PPC is getting some justified grief. Keep it up

anotheronewasted

Hi again folks, another update....
This time from DCB Legal.
A short recap: on 06.03.23 I emailed 'Morgan Falconer' at DCB Legal, asking a direct question:

"Has DCB Group (any iteration) paid this parking firm, UK Parking Control Ltd., or any associated firm, legal or otherwise (by any convoluted arrangement), up front for my data, or the batch of data it was in?

If so, please provide me with your Deed of Assignment which I require under my SAP rights."

This was unanswered, so on 04.04.23, I sent a reminder email, again to Morgan Falconer.
The mail I received today is "in response to your email dated the 4th of April 2023."
Clearly this is more than 30 days...so is it a 'breach' of any kind, baring in mind I never worded my question as a form SAP request?
Any way, onto the latest e-mail, this time from Charlotte Evans

We are writing in response to your email dated the 4th of April 2023.

Firstly, regarding the information you have previously requested, any queries which have not already been responded to we have deemed to be disproportionate and/or not relevant to the substantive issues in dispute.

Furthermore, regarding the amount owed, to clarify, as stated under Schedule 4 (4)(5) of the Protection of Freedoms Act 2012, our client is not pursuing any more for the Parking Charge Notice (PCN)  than the sum indicated (£100) on the notice to keeper sent on the 25th of July 2019. As stated on the notice to keeper and the signs surrounding the car park, as a result of non-payment our client is entitled to instruct debt recovery agents / solicitors to pursue payment and is therefore entitled to recover the costs of doing so following the BPA codes of practice.

To extend on this, the sum added to the original amount owed is a contribution to the actual costs incurred by our client as a result of your non-payment. Our client’s employees have spent time and material attempting to recover the debt. This is not our client’s usual business, and the resources could have been better spent in other areas of the business.

This is our client’s full position which remains unchanged.

Consequently, the outstanding balance of your debt is £160.00 which must be paid 30 days from the date of this email.

To complete this you can contact DCB Legal Ltd on 0203 434 0437 to make payment over the telephone or online at https://dcblegal.co.uk/response/pay-online/

Alternatively, payment can be made via bank transfer to our designated client account:

Account Name: DCB Legal Ltd Client Account

Sort Code: 20-24-09

Account Number: 60964441

You must quote the correct case reference (101473.106221D) when making payment. If you do not, we may be unable to correctly allocate the payment. If further action is taken by us as a result of an incorrect reference being quoted, you will be liable for any further fees or costs incurred.

Please note failure to make the above payment will result in a claim being issued against you without further notice.

Kind Regards,

So I assume their opening comment of, "any queries which have not already been responded to we have deemed to be disproportionate and/or not relevant to the substantive issues in dispute.", is a rider to cover all unanswered questions.
Including the question of whether this is purchased debt by DCB, and what 'costs' are / means / the breakdown.
And so any complaint to the ICO is pointless? (Other than being a nuisance)

The NtK that they quote, was never received by me in the post. Which I have made clear.
And the pictures of the signage 'in' the car park prove nothing to my mind, other than they are unreadable. Seen further back in this thread.
This is ignoring the fact they are no longer there, as UKPC do not operate this car park any more.

So ignoring all the BS comments of "Our client’s employees have spent time and material attempting to recover the debt", the
mail doesn't say anything new, or answer any questions really...

Is it worth replying, or just wait for the claim (which I know will come)
Like I have said previously, I am more than happy to be a pain and cause them extra 'work', be that via pointless mails, pointless SARs, or pointless complaints to the ICO
Here, I am half tempted to reply once again, and ask the question of whether this is a purchased debt / data batch again, and to ask more around the signage pictures they sent, e.g. who took them? when?

Thoughts?

Coupon-mad

And so any complaint to the ICO is pointless? 

Eh?!

They've avoided the question!

You still are entitled to know whether OR NOT they effectively 'assigned' or otherwise purchased the alleged debt (either individually or as part of a batch of data passed to them by UKPC).

The valid reason for asking is because 'debt purchase' (whether by formal assignment or not) is banned by the DVLA specifically, in parking cases:
http://notomob.co.uk/discussions/index.php?topic=6110.0

Show them that link and invite them to confirm or deny that money being passed or promised to UKPC (regardless of success) is - or is not - the arrangement under which they sourced your data.

You only want a simple yes or no.

The refusal to answer at all to a question that is entirely relevant in a private parking case, is unprofessional, in breach of the SRA STaRs and looks like a DPA 2018 breach too.  This question surely cuts right to the heart of how they sourced the data and whether the arrangement (which you are not asking to actually see, because you realise that the details are commercially sensitive) was legal in the context of DVLA KADOE rules.

If no money was advanced or promised for the enormous amount (looks tike tens of thousands of cases) of old data they've been passed by UKPC, then they only need to say 'no'.  It's not a difficult question.

Give them seven days to confirm or deny and if they fail to put your mind at rest then complaints will be made to the ICO, the DVLA and the SRA by the end of April.

And do exactly that.

Both the ICO and SRA complaints can be done online.  Don't write more, don't go on any tangents. Use my words and that link so the (often clueless) ICO and SRA know why it is entirely proper and proportionate for you to expect a 'yes or no' answer.

Same for the DVLA except that complaint is done by email.  Use my wording and link.  The DVLA data complaints email address is in the 5th post of the NEWBIES thread.

anotheronewasted

Coupon-mad said:

And so any complaint to the ICO is pointless? 

Eh?!

They've avoided the question!

You still are entitled to know whether OR NOT they effectively 'assigned' or otherwise purchased the alleged debt (either individually or as part of a batch of data passed to them by UKPC).

The valid reason for asking is because 'debt purchase' (whether by formal assignment or not) is banned by the DVLA specifically, in parking cases:
http://notomob.co.uk/discussions/index.php?topic=6110.0

Show them that link and invite them to confirm or deny that money being passed or promised to UKPC (regardless of success) is - or is not - the arrangement under which they sourced your data.

You only want a simple yes or no.

The refusal to answer at all to a question that is entirely relevant in a private parking case, is unprofessional, in breach of the SRA STaRs and looks like a DPA 2018 breach too.  This question surely cuts right to the heart of how they sourced the data and whether the arrangement (which you are not asking to actually see, because you realise that the details are commercially sensitive) was legal in the context of DVLA KADOE rules.

If no money was advanced or promised for the enormous amount (looks tike tens of thousands of cases) of old data they've been passed by UKPC, then they only need to say 'no'.  It's not a difficult question.

Give them seven days to confirm or deny and if they fail to put your mind at rest then complaints will be made to the ICO, the DVLA and the SRA by the end of April.

And do exactly that.

Both the ICO and SRA complaints can be done online.  Don't write more, don't go on any tangents. Use my words and that link so the (often clueless) ICO and SRA know why it is entirely proper and proportionate for you to expect a 'yes or no' answer.

Same for the DVLA except that complaint is done by email.  Use my wording and link.  The DVLA data complaints email address is in the 5th post of the NEWBIES thread.

Brilliant
Thanks for the excellent advice. 
I'll go back to DCB and see how they react.

anotheronewasted

So I mailed DCB as per the advice of @Coupon-mad

And have already had a response from DCB...

To provide clarity, we (DCBLegal) are the data processor and our client UKPC are the data controller.

We have been instructed to collect the outstanding balance of £160.00 by our client.

We have not purchased the debt. We have been instructed to commence legal action, hence the file being with oursleves.

That's it. (Spelling mistake is from Ms Evans at DCB  )

Snippets of my mail to them:
"I am entitled to know whether OR NOT the alleged debt was effectively 'assigned', or otherwise purchased (either individually or as part of a batch of data passed to DCB by UKPC)."
"I invite you to confirm or deny that money being passed or promised to UKPC (regardless of success) is - or is not - the arrangement under which you sourced your data."

So maybe its rattled them a little, but this seems to be an answer to the question - they have not purchased the debt.
Although I am still not 100% clear if they have answered fully?
Nor the 'real life' meaning of data processor / data controller. This is ambiguous to me...both of these entity types could be, or could not be the data owner?

I still (for some unknown reason), feel amongst all the legal BS, DCB / UKPC are hiding or withholding something.
Don't know why, or how I have the feeling, just something doesn't ring true....the way in which mails are composed, written and sent. All mail trails are cleared by DCB when they reply for example.

Please feel free to correct me, or point out anything I have missed.
Cheers

DE_612183

Data Processor and Data Controller are GDPR terms - Some basic concepts | ICO - scroll down to see definitions.