Update Judgement - Both struck out (29th Feb) - Victoria Quays - Sheffield, S2 5SY

YankeeBrit

Remind Eddisons that as you are disputing VCS's allegation and that you have not breached any contractual terms, they have requested your details from the DVLA unlawfully, thus breaching your GDPR. As a breach of the GDPR is a criminal matter and Eddisons, as the contractor for VCS, they are jointly and severally liable for the actions of their agents. They must now either get their agent VCS to cancel the PCN or, should VCS continue to a court claim, they should seek advice from their own legal advisors as they, Eddisons, will become the subject of a claim for the breach of your GDPR.

Article 12 of the UK GDPR legally requires data controllers to store and process personal data accurately: clearly, any data controller issuing an invoice to you because it has wrongly recorded that you parked in breach of the alleged contract between you and the landowner (or, as in this case, an agent of the landowner) is processing your personal data unlawfully. 

The precedents for claiming damages and compensation for such unlawful processing are the decisions of the Court of Appeal in Zeta Jones & Douglas v Hello! Magazine [2003] EWHC 786 and Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333, both being binding on all County Courts in England and Wales.  In the latter claim, Mr Halliday was awarded compensation of £750 at what the Court regarded was the lowest level of award, and although this was a claim under Section 13 of the Data Protection Act 1998, similar provisions - amended to take account of a decision by the EU Grand Chamber that the 1998 Act did not properly implement EU law into UK domestic legislation - replaced the old Section 13 provisions with Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018.

In short, you ought to give 21 days notice (the pre-action protocol only really requires 14 days but hey, you can be charitable!) to the data controller of your intention to seek (say) £100 nominal damages and compensation under Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018 for their unlawful processing of your personal data: you could say that you will not file your claim with the County Court if they confirm in writing that all references to this alleged debt have been deleted within (say) 14 days. Clearly mark your letter as a "Letter before County Court proceedings".

Anyone who is fairly confident can claim as a litigant-in-person in Part 27 proceedings in the County Court (commonly but wrongly described as "the Small Claims Court").  Each party is responsible for their own legal costs whether they win or lose and the claim for £100 can be issued online for a fee of £35 at moneyclaimonline.gov.uk which also gives useful advice if you want to have a look at what is involved.  Your claim will automatically be listed as being for a total of £135, i.e. the successful party gets their Court fees back.

Anto_28

YankeeBrit said:

In short, you ought to give 21 days notice (the pre-action protocol only really requires 14 days but hey, you can be charitable!) to the data controller of your intention to seek (say) £100 nominal damages and compensation under Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018 for their unlawful processing of your personal data: you could say that you will not file your claim with the County Court if they confirm in writing that all references to this alleged debt have been deleted within (say) 14 days. Clearly mark your letter as a "Letter before County Court proceedings".

Thank you for your input @YankeeBrit, the info provided looks pretty damning for Eddisons who are trying to wash their hands of me.

Should I be sending this to the Eddisons DPO or VCS or Both?

I'm assuming this is a LBCC i'm sending to the DPO and giving them either 14 or 21 days notice to respond.

Coupon-mad

You could send a suitable version to both and tell them you will sue them both.  It might work.

YankeeBrit

At this stage, it would cost you 10 minutes of your time and however many milliWatts of your electricity to email them a PDF LBCCC. If you do, please keep us updated on their response.

Anto_28

YankeeBrit said:

At this stage, it would cost you 10 minutes of your time and however many milliWatts of your electricity to email them a PDF LBCCC. If you do, please keep us updated on their response.

Removed comment - redrafting

YankeeBrit

Typo... "...I have adjusted the contract levels..." should be contrast.

The letter is a little bit too "ChatGPTish". Should just be started "Dear Sir," and signed "Yours faithfully,".

I suggest reading the Pre-Action Protocol for Media and Communication Claims before you proceed.

https://www.justice.gov.uk/courts/procedure-rules/civil/protocol/prot_def

YankeeBrit

Something a bit more along these lines in order to comply with the PAP for a privacy breach:


Data Protection Officer
Eddisons
Conway House
1 Blackburn Road
Sheffield
S61 2DW

2nd August 2023


Dear Sir,

Letter of Claim for Breach of General Data Protection Regulation (GDPR)

My name is Antony Healy and this is my Letter of Claim (LoC) in the matter of a breach of Article 12 of the UK General Data Protection Regulation (GDPR) by your company, Eddisons. The purpose of this letter is to inform you of my intention to pursue legal action for the unauthorised acquisition and processing of my personal information.

The claim arises from your company's use of Vehicle Control Services Ltd (VCS), which you have contracted to manage your car park at Victoria Quays. It has come to my attention that VCS has unlawfully obtained my personal information, in direct violation of the GDPR and the provisions set forth by the "Keeper at Date of Event" (KADOE) rules.

Article 12 of the UK GDPR legally requires data controllers to store and process personal data accurately. Clearly, any data controller issuing a speculative invoice to me for an alleged breach of contract, because it has wrongly recorded that I parked in breach of said alleged contract between myself and the landowner (or, as in this case, an agent of the landowner), is processing my personal data unlawfully.

The precedents for claiming damages and compensation for such unlawful processing are the decisions of the Court of Appeal in Zeta Jones & Douglas v Hello! Magazine [2003] EWHC 786 and Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333, both being binding on all County Courts in England and Wales.  In the latter claim, Mr Halliday was awarded compensation of £750 at what the Court regarded was the lowest level of award, and although this was a claim under Section 13 of the Data Protection Act 1998, similar provisions - amended to take account of a decision by the EU Grand Chamber that the 1998 Act did not properly implement EU law into UK domestic legislation - replaced the old Section 13 provisions with Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018.

Your company, Eddisons, is jointly and severally liable for the actions of its agent, VCS. Therefore, I hold your company responsible for the data protection breach committed by your agent.

I am seeking £100 nominal damages and compensation under Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018 for your unlawful processing of my personal data.

I am willing to allow you to address this matter before taking legal action. I hereby give you 21 days from the date of this letter to provide a satisfactory response to this Letter of Claim. In your response, I expect you to:

1. Acknowledge the breach of GDPR and the mishandling of my personal information by your agent, VCS.

2. Provide assurances that steps will be taken to prevent similar breaches from occurring in the future.

3. Confirm within 14 days of the date of this letter that your agent, VCS, has been instructed to cancel the Parking Charge Notice (PCN) issued in breach of my GDPR rights and that all references to this alleged debt have been deleted.

Please be advised that if I do not receive a satisfactory response and the PCN has not been cancelled within the 21-day notice period, I reserve the right to initiate legal proceedings against your company in the County Court without further notice or communication. The claim will be for the sum of £100, reflecting the compensation for the GDPR breach, and an additional £35, representing the hearing fee.

I believe that an amicable resolution of this matter is in both parties best interest. Therefore, I urge you to consider this LoC as an opportunity to avoid costly and time-consuming court proceedings. Should you comply with the requests outlined above and rectify the breach, I am prepared to withdraw the claim.

Yours faithfully,

Grizebeck

You don't need to say " my name is" sounds like your at primary school

Anto_28

YankeeBrit said:

Something a bit more along these lines in order to comply with the PAP for a privacy breach:


Data Protection Officer
Eddisons
Conway House
1 Blackburn Road
Sheffield
S61 2DW

.....

Thank you so much for this.

I started a new draft last night and it reads similar to this but not quite the same so will use yours. Will fire it off today and hopefully Eddisons will see the error of their and their agents ways and common sense can prevail.

Anto_28

@YankeeBrit - can I just check, is it Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) or Article 5 (Principles relating to processing of personal data)?

Article 12 appears to be about a subjects right to access their data whereas Article 5 appears to be about how Data Controllers can process the data