'PCN NOW CANCELLED' data privacy & complaints NPC Group, DCB Legal, DVLA, IPC, ICO & MP

Coupon-mad

Nice.     

Thorndorise

Thorndorise said:

Brief update (aside from all the privacy policy stuff going on), I went back to NPC's DPO and flagged he had missed the COMPLAINT about data protection and that he needed to try harder... (abridged version).

Did that on the 22nd Oct, chased on the 30th, then on the 5th Nov, then on the 8th reminding him of their own complaints timelines...Got a reply (on the 12th Nov)!

He was sorry but it was taking longer than he'd hoped, and he would come back to me 'by the end of this week' (Fri 15th)

15th Nov came and went, on Monday 18th he emailed again and said crikey this is a toughy (made that up), I will come back to you 'within 24hrs'

Almost there methinks - but, alas, I gave him 8 weeks before I replied on Mon 13th Jan (plenty of time to throw a complaint into the IPC for what it's worth) - having reminded him the original data protection complaint was made 120 days ago. I decided after some reading around the whole data protection and sharing piece that given the unlawful nature of the sharing I had a 'right to erasure' - they have the statutory one calendar month but given how late it was I asked them to expedite it. PS can't remember if I told you, DCBL and DCB Legal have now fully removed my data from their databases also....clean slate so to say.

Watch this space.

Hi all

I'm not quite at 1 calendar month from when I sent the Right of erasure - but nearly, the 28 days is the 10th, so the month is the Thursday (13th).

I've not heard a peep, not even an acknowledgement. I think I know the answer - but does anyone have any advice or experience with these Data protection requests at all? I'm assuming I won't hear as they're not very clever - but I may do and not 100% sure that I can actually get them to erase my data...Just any titbits would be useful

Also< NPC have not updated their privacy policy and it literally states "DCBL" under who do we share data with, now....I'm no expert but I don't think that cut's the proverbial mustard for transparency...that may well could be ASAP or AFIK etc...means nothing! 

pinkelephant12

You can apply to the County Court for a compliance order under s.167 Data Protection Act 2018. 

No point asking the ICO for information about these; I have to explain it to their staff.

It might be worth sending a letter before action stating that this is your intention with all costs to be paid by them.  I find this quite effective and it gets results.

Thorndorise

pinkelephant12 said:

You can apply to the County Court for a compliance order under s.167 Data Protection Act 2018. 

No point asking the ICO for information about these; I have to explain it to their staff.

It might be worth sending a letter before action stating that this is your intention with all costs to be paid by them.  I find this quite effective and it gets results.

Thank you for this, I suppose though it depends on if my case for erasure is valid? As there is a caveat that talks about not having to perform the erasure if they have to use the data in the future for a legal case? Doesn't this give them a 'get out'

Found it - refused due to 'defence of legal claims' (vaguely doesn't say which way) - and is a parking charge a legal claim or a civil one that this doesn't apply to?

I think it's lightly shaky ground to say that they didn't have an adequate Privacy policy that included the recipients or categories thereof, but they shared my data anyway (and is this 'unlawful') - not sure if I'm clutching at straws..(Don't get me wrong I will persist)!

pinkelephant12

The 'get out' under Article 21 UK GDPR where personal data is being held for the establishment, exercise or defence of legal claims tends to be interpreted very widely to enable organisations to keep your data.  Often you can only get them to restrict their use of your data rather than erase it.  It depends what they have done with the data so far.  If they have actively used your data, they won't usually have to erase it.  

Thorndorise

pinkelephant12 said:

The 'get out' under Article 21 UK GDPR where personal data is being held for the establishment, exercise or defence of legal claims tends to be interpreted very widely to enable organisations to keep your data.  Often you can only get them to restrict their use of your data rather than erase it.  It depends what they have done with the data so far.  If they have actively used your data, they won't usually have to erase it.  

Thank you again @pinkelephant12 , well yes they have used in pursuit of a bogus invoice (:)) - but that use involved them sending said invoice then passing my data (what I believe to be unlawfully) to an unnamed third party (debt coll & solicitor).

My argument is that sharing was unlawful (and tbf, DCBL and legal agreed and have deleted my data and are not pursuing it) - so my push now is that NPC should never have shared my data (nor the approximate 36,000 other PCNs they've escalated to DCBL over the last 5 years....

Thorndorise

UPDATE

Well the calendar month came and went obviously, so I sent them another rocket - I copied in the CEO, as I have done with about 18 other emails to them when writing to the DPO. Flagged the delays, lack of responses in a timely fashion and against their own CoP, also threatened them with another report to the ICO for not responding to my data erasure request (actually just writing this now, they still haven't acknowledged that)... anyway I digress.

Anyway, the CEO came back with a 'we did everything correctly' and 'didn't breach any protocols' whatever that means, but, he wasn't happy with how my case had been handled so is cancelling and there will be no further action from them or DCB Legal (which I'd already dealt with).

Bottom line, hassle them enough, they'll drop it....

I DO still think there is legs in the privacy piece, and keep my eye in on this...their update to their PP I don't believe does what they think it does - i.e. give them carte blanche to share personal details with a DRA.

THANK YOU - to all of the community, especially the regulars and those that have supported me, hoping I can stick around and support others...

Coupon-mad

Please do stick around. We hope you do!

You'll be great here posting to help people and when responding to the Public Consultation coming from the Government in the coming months to get the Code over the line. 

Thorndorise

Coupon-mad said:

Please do stick around. We hope you do!

You'll be great here posting to help people and when responding to the Public Consultation coming from the Government in the coming months to get the Code over the line. 

Thanks @Coupon-mad I will certainly stick around, I'm keen to be involved and make sure we get as many voices heard as possible...thank you also for all your continued hard work on the work with the Government!

Nellymoser

At last they say they are cancelling and no further action will be taken, unacceptable the amount of complaining you had to do to get that statement out of them.