Claim against UKPC for their unreasonable behaviour and misuse of data - Update: I WON!

dxbcc

Firstly, thanks to everyone for the great advice in the stickies and the various threads on this forum, it's been invaluable so far. Apologies for the length of this post, but the background is important.

Back in January I was doing some work in what you might call a business estate/campus, there's a small security hut that's staffed 24/7 where the entrance barrier is. The site is a big horseshoe shape, with visitor parking off the 'horseshoe' in front of each building. Parking used to be managed by the site security folks, but a couple of years ago UKPC took over the management of the visitor car parking and installed ANPR cameras at the entrance and exit barriers. There are also building specific car parks, each with their own access barrier, managed by the occupiers of each building.

Visitor parking is limited to 1 hour, but myself and a colleague had some extended work to do in one of the buildings over a 3 day period so we arranged permission to park in their private car park and we were told that both vehicles had been added to the ANPR system for those 3 days. Notably this building is the first building as you enter the site, and the entrance to this car park is before you reach the visitor parking and the UKPC signs. We did the work, no drama at the time.

7 days later I recieve 5 x £100 NtK charges from UKPC for 5 separate parking sessions. I immediately complain to the company I was visiting (a large uncaring multinational), write a single letter quoting all 5 reference numbers to UKPC to contest the charges, pointing out that their terms don't apply as we had authorisation to be on-site and were not parked in the area they manage. As my colleague was driving a hire vehicle I let him know so he can tell the hire company that these charges are unwarranted and not to pay them or charge an admin fee.

After a few back and forth emails, the company I was working at forward on a copy of the authorization email and an attached excel document that was sent to the site management team with details for both vehicles and say that I can use those to contest the charge, but they're unhelpful about simply getting them cancelled.

3 weeks after writing to them I recieve 5 responses from UKPC. 2 charges cancelled, 2 where they rejected my appeal and provide POPLA codes, and 1 inexplicably asking for more information about a "gym visit". I write back again pointing out that they have cancelled 2 of the charges and that the others should be cancelled on the same grounds. I include a copy of the authorisation email and once again point out to them that I wasn't parked in the vistor car park and as such their terms do not apply. I also tell them that if they do not cancel these charges at this point I shall charge for the time I have to spend appealing to POPLA or preparing for court.

A few days before the POPLA deadline I recieve a letter (dated 29th Feb) regarding one of the charges from UKPC stating that they "confirm that we have made our final decision regarding your appeal", so I submit appeals for the 2 cases with POPLA codes. While writing the appeal I noticed that that someone in one of the on-site teams transposed 2 of the letters in my vehicle reg. It explains why my colleague didn't recieve any charges and seems to be an easy win according to the BPA CoP, so I add this as one of the appeal points.

The following day (5th March) I get a notice from POPLA that one case has been withdrawn claiming I had paid or asked for it to be withdrawn. I email POPLA asking why as neither of these were true, and they confirm that UKPC had actually withdrawn that appeal on the 29th Feb. A couple of days after that I get another pair of letters from UKPC both also dated 29th Feb (arriving on 9th March!), one confirming that one of the charges (the one I had notification from POPLA for) had been cancelled, and that the one asking for more info had also been cancelled. At this stage, 4 of the charges had been cancelled, and UKPC have confirmed that one still stands.

8 days after submitting the appeals to POPLA, UKPC finally withdraw the final charge. Technically this is a win, and I've no doubt the advice from this forum helped but I am annoyed about the wasted time and their unreasonable behaviour. I did tell UKPC I would charge them for that, so a few days ago I wrote to them demanding £120 for the time spent researching, writing and submitting both POPLA appeals. I also included an SAR, with a specific request for the justification for why each of my appeals was accepted or rejected. I am looking forward to seeing them explain why the didn't just cancel them all at the same time as the first two.

In summary:

1) I had authorisation from the occupier of one of the buildings to park in their car park.

2) UKPC terms don't apply, I was parked in a private car park which is before their entrance signage to the visitor parking but UKPC's ANPR catches everyone who enters the site.

3) Someone in the on-site team typo'ed my reg no when adding me to 'the system', which the BPA CoP is very clear about: "If a typing error such as this leads to a PCN being issued and the motorist appeals, the PCN must be cancelled at the first stage of appeal." - I didn't know this at the time but I believe I'd provided enough information in my first and second letters that UKPC should have easily been able to check their records and see that this was the issue.

4) UKPC cancelled 2 charges after my first letter, 2 of them after the second before POPLA (although I didn't recieve their letter until it was too late for one of them) and left one of the 5 to go through POPLA until it was clear they were going to lose before withdrawing the charge. I have no idea why they didn't cancel all 5 after the first letter, but the end result was a load of wasted time.

My question is: Should UKPC not pay up (obviously I expect they won't), is it worth taking it to small claims or is it unlikely to result in a win? If I do is it worth also claiming damages for the data protection breach? Arguably UKPC never had the right to request my details from the DVLA, and I've had a few sleepless nights as a result of this.

Coupon-mad

Yes you can try it.  Small fee, no risk really. Search the forum for Simon Clay v Civil Enforcement Ltd - he did exactly this.

The very good thing is, UKPC have a wet-behind-the-ears new 'legal team' who are making a right hash of court claims, IMHO, and only started litigation 4 months ago.

I can't see them defending a claim properly. You might even win by default.

patient_dream

Seema like UKPC have got themselves in a right mess again

They cancelled then pulled out of POPLA and still want money from you for the same thing.   

A court Judge will rip them apart.  UKPC claims are well known in the courts thanks to the legal they use called DCBL

dxbcc

Thanks for the advice. As expected: "UKPC does not accept your invoice or claim for expenses. The parking charge has been legitimately issued blah blah blah categorically rejected.". Obviously this is a stock response, but still hilarious.

They have acknowledged the SAR though which is nice. They've got just under 2 weeks left to actually respond. Once I can see how they've tried to justify the behaviour then I'll get onto sending them an LBC.

Half_way

While your at it, see if you can claim against whoever/whatever took on UKPC as they will be jointly and severally liable for their agents ations

dxbcc

Not much of a follow up at this point, but UKPC failed to respond to my SAR. After chasing them, I had a few emails back and forth, mostly them claiming they don't hold any personal data even though I can prove they still hold the VRM. The ICO is pretty clear that this counts as PII. 

I submitted a formal complaint to UKPC (required for the ICO to investigate) which they didn't really engage with, so the ICO complaint went in. I was hoping for a definitive answer from the ICO before starting a court claim but there's currently a 14 week wait for them to start looking at it. LBC sent to UKPC this week.

LoneStarState

dxbcc said:

Not much of a follow up at this point, but UKPC failed to respond to my SAR. After chasing them, I had a few emails back and forth, mostly them claiming they don't hold any personal data even though I can prove they still hold the VRM. The ICO is pretty clear that this counts as PII. 

I submitted a formal complaint to UKPC (required for the ICO to investigate) which they didn't really engage with, so the ICO complaint went in. I was hoping for a definitive answer from the ICO before starting a court claim but there's currently a 14 week wait for them to start looking at it. LBC sent to UKPC this week.

Might be worth doing a Freedom of Information request to the DVLA for the KADOE service user agreement for UKPC.  Will almost definitely be an unambiguous clause in the contract that they they need to retain the evidence used to establish "reasonable cause" (the ANPR images) for a fixed period of time after the request.  Could then be used as part of the ICO complaint.

EDIT:  I just looked at such a contract for UKCPM. It seems the clause states data should only be "held for as long as necessary with reference to the reasonable cause for which it was shared".  

However there is this clause:

"D6.3. The Customer shall retain for two years from the date of the request, to allow inspection by the DVLA, the evidence that the Customer relies on to show its compliance with the requirements of this Contract and of the relevant ATA Code of Practice or conduct. Such evidence shall include evidence relating to any mismatched or incorrect enquiries, which the Customer shall ensure are cross referenced to the correct enquiry with a full audit trail also retained. There is no need, for DVLA’s inspection purposes, for the Data to be retained as part of this requirement. The Data must be disposed of in accordance with the provision of clause D6.2 above."

D6.2 is in reference to data deletion as soon as it is no longer necessary to retain it.

Guess it depends on whether your instance is classed as an incorrect enquiry.

Might be worth probing UKPC's data/privacy policy to see if any data retention requirements are listed in there.

dxbcc

Good idea, and useful update, thank you. I've submitted an FOI request, will see if it's the same.

fisherjim

I would also request info from the DVLA about who requested your data between the dates concerned as UKPC should have mad a request for each and every event, knowing how dodgy they are they might not have complied with that.

dxbcc

fisherjim said:

I would also request info from the DVLA about who requested your data between the dates concerned as UKPC should have mad a request for each and every event, knowing how dodgy they are they might not have complied with that.

Indeed, I did that earlier also - kicking myself a bit for not thinking about it sooner, in case they no longer hold that data, but I have asked.

Castle

LoneStarState said:

dxbcc said:

Not much of a follow up at this point, but UKPC failed to respond to my SAR. After chasing them, I had a few emails back and forth, mostly them claiming they don't hold any personal data even though I can prove they still hold the VRM. The ICO is pretty clear that this counts as PII. 

I submitted a formal complaint to UKPC (required for the ICO to investigate) which they didn't really engage with, so the ICO complaint went in. I was hoping for a definitive answer from the ICO before starting a court claim but there's currently a 14 week wait for them to start looking at it. LBC sent to UKPC this week.

EDIT:  I just looked at such a contract for UKCPM. It seems the clause states data should only be "held for as long as necessary with reference to the reasonable cause for which it was shared".  

However there is this clause:

"D6.3. The Customer shall retain for two years from the date of the request, to allow inspection by the DVLA, the evidence that the Customer relies on to show its compliance with the requirements of this Contract and of the relevant ATA Code of Practice or conduct. 

The BPA requires their members to keep details of all Appeals, (23.13), and Complaints, (23.26), for 36 months under version 9 of their Code.