NPM and Gladstones

Bunglebear321

Well I wasn't expecting this reply, especially so soon:

The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

 

This right to erasure entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.

 

The conditions for erasure, include the data no longer being relevant to original purposes for processing, or a data subjects withdrawing consent.

 

The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

 

·         Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.

·         When the individual withdraws consent.

·         When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.

·         The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).

·         The personal data has to be erased in order to comply with a legal obligation.

·         Under the GDPR, this right is not limited to processing that causes unwarranted and substantial damage or distress.

 

There are some specific circumstances where the right to erasure does not apply and NPM can refuse to deal with a request.

 

The system that NPM uses (ZatPark) does not allow a name or address to be searched and accessed. Therefore, if you have a specific request to remove data related to a parking charge notice which has been issued you, you will need to supply the parking charge notice number and vehicle registration number so that we can process your request. If you cannot provide this information then we cannot process your application.

 

However, if you are requesting your data to be removed generally for example any postal correspondence or emails that you may have submitted, I can confirm that any personal data which is received via the post, once processed onto the computer system (added to the parking charge notice) it is then shredded and correctly disposed of, NPM only keep personal data in electronic format.

 

Emails received that are relevant to a parking charge notice are copied onto the parking charge notice itself and then the email is placed in the deleted items folder. All emails which are older than 6 months are deleted from the system completely and automatically.

 

Please feel free to contact the Information’s Commissions Office if you believe that we have not fulfilled our obligation regarding your personal data ‘Right to Erasure’ request.

B789

But you're not requesting a "right to erasure", you want "right to access". You're requesting the right to know what personal data and supplementary information about you that the PPC has. They state that they use a system that doesn't allow for a name and address to be searched. What utter testicles.

They then go on and say that they can search on PCN number and VRN. You have given them your VRN so they can search for that.

They obviously have information about you in their system but are claiming that they can't access it without the PCN number. You need to get on to the ICO and initiate your complaint.

https://ico.org.uk/make-a-complaint/data-protection-complaints/personal-information-complaint/

Bunglebear321

I never actually submitted my VRN within the SAR (either it's not within the template and therefore I wasn't aware that I should have) or I accidentally missed it out

Bunglebear321

Please could somebody advise if I should respond to NPM to correct them or ignore, give them 30 days and complain to ICO regardless?

Many thanks 

Coupon-mad

Give them your VRM...

Then Google & ring up Dave Herbert & co at Unity 5 Ltd (aka the Zatpark system) and ask them if this is true about a failing of their system.

Bunglebear321

I just called Zatpark- it's perfectly possible to search for a single address and bring up all of the data and list of PCNs linked to that address

B789

Bunglebear321 said:

I just called Zatpark- it's perfectly possible to search for a single address and bring up all of the data and list of PCNs linked to that address

There you go... you've caught out the lying bar-stewards at NPM and you are strongly advised to report this to the ICO using the link I provided above. There is absolutely no reason for them to withhold your personal data and they have done so by lying to you.

Jeez, if I could complain on your behalf, I'd do so right now.

Coupon-mad

Haha, Zatpark is a good system and its creators, Unity 5 Ltd are approachable, so I thought that call might catch a lying parking employee out!

Bunglebear321

I won't lie, I was worried I might be met with some resistance but the guy was quite helpful. So aside from ICO complaint and giving NPM by VRN, do you recommend I catch them out now or hold fire until it reaches claim stage?

B789

Bunglebear321 said:

I won't lie, I was worried I might be met with some resistance but the guy was quite helpful. So aside from ICO complaint and giving NPM by VRN, do you recommend I catch them out now or hold fire until it reaches claim stage?

No reason not to make your complaint to the ICO. You have been shocked, worried, upset, distressed, anxious, scared, mentally scarred, frustrated, annoyed (use as many terms that apply, even if only slightly) in your complaint about this vexatious letter that was sent to you in breach of your GDPR rights.

You also hold on to that letter and use it against them should they ever be so stupid as to progress this to a claim.