'PCN NOW CANCELLED' data privacy & complaints NPC Group, DCB Legal, DVLA, IPC, ICO & MP

Thorndorise

DCB Legal have responded on the final day of their 'investigation'

Summary of the email is: matter arises from a PCN, they've then explained how NPC were allowed to get data from the DVLA - the date DCB Legal were instructed as all previous attempts to recover payment had failed. DCB Legal issued a LoC in accordance with the PAP.

It then says I responded, and they got the answer wrong, then they responded again and they said "We apologise for any confusion that the original email may have created, however, once this mistake was noted a sufficient response was issued accordingly." Sufficient response being subjective of course - this was the one that prompted and little trip to the HMRC site.

They rightly point out they have a legitimate interest, and that they cannot respond about the actions of their client - as it's outside the scope of their complaint. Then a bold statement from a legal firm...

"To clarify DCB Legal have followed the correct process".

Then some probably mandated rubbish about how stressful this all is and if I am unsure of my position they I may wish to seek independent legal advice and then...

"As a gesture of goodwill, we will now be closing this matter and you will not be pursued for this PCN by DCB Legal from this point" 

So, whilst good(ish) news I took umbrage at this, how on earth have they decided that not making money from me is a good idea? - unless they agreed with the points made that NCP had no legal basis to share personal data with them - i.e. NPC shared it unlawfully (by not explicitly stating recipients of said data in their only privacy policy online - which has been the same since the company inception).

I'm not even sure this makes it into @Umkomaas list of DCB Legal discontinuances? I think it could do - but if I'm honest what I want DCB legal to acknowledge that any personal details (from any PCN) they may have had from NPC have been unlawfully passed to them since NPC's inception, assuming they've always used DCB Legal, that's >110k KADOE requests, so using  @kryten3000 shared figures from X there must be about 36k cases passed to them from NPC - which in theory could have all been processed unlawfully.

@Nellymoser
@Coupon-mad
@Gr1pr
@LDast
@1505grandad
@KeithP
@fisherjim
@Grizebeck
@Castle
@Le_Kirk
@Fruitcake

All of your advice has been well received thank you (sorry if I've missed anyone) - sharing as I believe that they've admitted that they cannot pursue this PCN as it reeks of unlawful to do so. Welcome your thoughts. Sharing also with @TAC842 or interest with NPC.

Coupon-mad

Just because DCB Legal have stepped away because this one is too hard for them to bother with, doesn't mean the PCN is cancelled.

Thorndorise

Coupon-mad said:

Just because DCB Legal have stepped away because this one is too hard for them to bother with, doesn't mean the PCN is cancelled.

Thanks, yes - fully aware of that - obviously NPC can go with whomever they choose to pursue this - or themselves even. That's my next hurdle. NPC have overshot their complaints timeline (not that it counts for anything) - but really had to chase to get it in front of their DPO, who has now gone quiet on me.

Be interesting to see what they say....I'm hoping with the other stuff going on elsewhere NPC will go to the doghouse for a bit - but I think it's wishful thinking!

Nellymoser

"you will not be pursued for this PCN by DCB Legal from this point" 
Is the PCN cancelled? They say DCB Legal won't be pursuing it from this point does that mean it could be pursued by another legal?

Thorndorise

Nellymoser said:

"you will not be pursued for this PCN by DCB Legal from this point" 
Is the PCN cancelled? They say DCB Legal won't be pursuing it from this point does that mean it could be pursued by another legal?

Absolutely not cancelled, absolutely yes can be pursued by someone else, but I wonder what their rationale is for not pursuing (other than laziness) - I very much doubt it is as a goodwill gesture! I can't help but think maybe the risk was too high with regards to how I've laid out the unlawful processing bit - OR -  I'm overthinking it!

Coupon-mad

You don't fit in their box. It is that simple.

Good on you! 

Nellymoser

Going back to your complaint. It's ridiculous IPC suggest signage has to be addressed at an appeal. I'd consider sending copy of their replies to DVLA, point out IPC are failing to adhere to DVLA ATA standards. And if it's not DVLA responsibility to monitor and address ATAs' non adherence whose role is it?

For info - 2022 the BPA were no better than IPC at managing a complaint re car park entrance signs 

https://uk.trustpilot.com/reviews/62ab4429787382efe20e84dd

https://uk.trustpilot.com/reviews/63052ab47f7a8621ee478d4a

You may have seen this letter from ICO although it's from 2013 it's an interesting read. 

https://www.whatdotheyknow.com/request/unlawful_release_of_data#outgoing-257779

Thorndorise

Nellymoser said:

Going back to your complaint. It's ridiculous IPC suggest signage has to be addressed at an appeal. I'd consider sending copy of their replies to DVLA, point out IPC are failing to adhere to DVLA ATA standards. And if it's not DVLA responsibility to monitor and address ATAs' non adherence whose role is it?

For info - 2022 the BPA were no better than IPC at managing a complaint re car park entrance signs 

https://uk.trustpilot.com/reviews/62ab4429787382efe20e84dd

https://uk.trustpilot.com/reviews/63052ab47f7a8621ee478d4a

You may have seen this letter from ICO although it's from 2013 it's an interesting read. 

https://www.whatdotheyknow.com/request/unlawful_release_of_data#outgoing-257779

Thanks @Nellymoser - Re that last link - I hadn't seen that, thank you - interesting read and although from 2013 the principles still I think, and actually what seems to be happening is, well, 'nothing' - it doesn't really look like the DVLA are on top of it at all. Throw into the mix and even worse ATA in the IPC - and it's a total washout.

I do note there is a distinct difference between the codes of the BPA and IPC wrt to entrance signage, but I also noted that the IPC made a big deal of including Annex A from the Gov's code too.

I've had shockingly bad responses from the DVLA, mainly citing the same blurb that the PPC quote. I've pushed back on this, I did note in that ICO letter FOI request this statement from the DVLA "If companies act in a manner which is non-compliant with the Code of Practice, DVLA will take the appropriate action." Which we know isn't true as I've flagged to them non-compliance and they've stated its the ATA's job. When you rely on self-regulation there needs to be robust CoP, and one's that are not just self-serving (look at say the pharma industry which has many more players that self-regulate vociferously - and the CoP is backed up by law).

And agreed, if not the DVLA then who?! 

Thorndorise

After going a bit back and forth with NPC on them not responding to my complaint here https://forums.moneysavingexpert.com/discussion/comment/81001148/#Comment_81001148

I did finally receive a response from the DPO stating this...

Good morning,

Thank you for your email and allowing time to look into your complaint.

I will look at addressing each point you have raised below:

I have looked through the photos from our installation and have found that in each area we look after and patrol there is the correct signage installed, in the area you have parked, prior to the date of the offence there is a welcome entrance sign to that car park and signs throughout the area, in the photos of your vehicle you can see the signage throughout the car park, there are clear and visible signs in the photos of the front and rear of your vehicle, all these photos have been time and date stamped using the metadata from our installers equipment when on site, these were taken in January. This site has also been through an audit process and has passed the audit process, this happens prior to any site going live.

Looking at the details and photos from our installs and the fact the same signage can be seen within the photos of your vehicle on the day of the offence, I am happy the site has been setup correctly and the PCN issue in a correct manor given the fact you have passed multiple signage upon entering and leaving the car park, the fact you were not in possession of a valid permit and had not registered your vehicle via one of the kiosks located on site.

With your second point again, the signage is clearly visible in the photos of your vehicle when in situ on site, we have complied in terms of the site been set up correctly and have the permission of the landowner to be on site and enforce the parking rules as per our signage. I have no issues with the signage on site and can see the positioning and wording is correct for this site.

After looking into the manor of the PCN, whether the PCN was issued correctly and if any breach has happened my findings are below.

I have concluded my report and my findings are, the PCN in questions was issued correctly, all the photo evidence show the signage has been installed correctly and compliant inline with the IPC audit process. There has not been any breaches as suggested given the signage is correct and that this vehicle did not have permission to be on site as was not in possession of a valid permit or e-permit session through an onside kiosk. My decision for this PCN would be we would not look to cancel the PCN given this PCN was issued correctly.

Whilst I understand this may not be the outcome you had hoped for, If you are unhappy with the outcome of your complaint, please refer this to the IPC, our Accredited Trade Association.

Kind regards

DPO

Entirely missed the unlawful sharing of personal data complaint element (and couldn't spell 'manner' or 'onsite'). They also have patently not been to the site at all, and I suspect neither have the IPC, which is why I asked them to show me the 'welcome entrance signs' - as you know there are some on site for one of the car parks, and I think they've got their wires crossed, and the IPC made it very clear it wasn't mandatory (even though IMHO that is also rubbish).

Probably won't come as a surprise that I've let them know that they need to pull their fingers out and get this cancelled otherwise I'm coming after them for about 36k PCNs unlawfully shared with a third party (might do it anyway)!

Them referring to me raising it with the IPC made me want to say something, or laugh uncontrollably.

DVLA complaint is at second stage (avoiding the awful FOI request teams)

Thorndorise

Brief update (aside from all the privacy policy stuff going on), I went back to NPC's DPO and flagged he had missed the COMPLAINT about data protection and that he needed to try harder... (abridged version).

Did that on the 22nd Oct, chased on the 30th, then on the 5th Nov, then on the 8th reminding him of their own complaints timelines...Got a reply (on the 12th Nov)!

He was sorry but it was taking longer than he'd hoped, and he would come back to me 'by the end of this week' (Fri 15th)

15th Nov came and went, on Monday 18th he emailed again and said crikey this is a toughy (made that up), I will come back to you 'within 24hrs'

Almost there methinks - but, alas, I gave him 8 weeks before I replied on Mon 13th Jan (plenty of time to throw a complaint into the IPC for what it's worth) - having reminded him the original data protection complaint was made 120 days ago. I decided after some reading around the whole data protection and sharing piece that given the unlawful nature of the sharing I had a 'right to erasure' - they have the statutory one calendar month but given how late it was I asked them to expedite it. PS can't remember if I told you, DCBL and DCB Legal have now fully removed my data from their databases also....clean slate so to say.

Watch this space.