Claim against UKPC for their unreasonable behaviour and misuse of data - Update: I WON!

ChirpyChicken

which court?

dxbcc

Canterbury. £120 for my time and £200 for the data protection breach (that's based on Clay vs CEL). I've also asked for them to be ordered to comply with the DPA, because they're still claiming to have deleted my PII when I can prove they haven't, but I realise that might be a stretch for small claims.

ThorOdinson

Is the £120 including the time for going to SCC, or will you ask for that on top afterwards?

I'm just thinking that if I had to take a day off work, it would cost more than £120.

The data protection thing seems low too, isn't £750 the norm for breaches with moderate consequences?

Good luck, looking forward to hearing the result.

dxbcc

Is the £120 including the time for going to SCC, or will you ask for that on top afterwards?

It's for the time I spent appealing to POPLA long after the charges should have been cancelled. I warned them I would be billing for my time in advance, and it's a figure I can easily back up with evidence. I'll ask for the £95 loss of earnings allowed under the CPR if I win. None of it will cover the amount of time I've actually put in, but that's not really the point now.

The data protection thing seems low too, isn't £750 the norm for breaches with moderate consequences?

The judge in Clay vs CEL suggests £200 as a reasonable figure (down from the £250 suggested by the claimant) for this sort of breach, which makes it very easy for me to justify without looking unreasonable.

ThorOdinson

Thanks. You have done your research.

dxbcc

Well that was an experience. Despite saying that they weren't sending anyone to the in-person hearing and were happy for the case to proceed on the papers, they changed their mind for some reason and sent one of their paralegals. Bit of a trek from High Wycombe to Canterbury.

The case was scheduled for 90 minutes which I thought was going to be plenty of time. A paperwork mixup in the court meant the judge spent some time reading my witness statement while we sat in silence before asking me to set out my argument. I explained what had happened and he took a lot of notes, then asked a number of questions based on both my answers and he'd read in the WS. He was asking some quite challenging questions, but thankfully I was well prepared with maps, photos and correspondence, and this took an hour or so. He then asked the UKPC person to explain their case, and there were a few awkward moments when he asked why they'd failed to respond to the SAR and why they'd handled my appeals the way that they did. The UKPC person was clearly not used to being the defendant which was fun. I'd say he was quite hard on both of us, and I'm glad I'd put in the effort to be well prepared.

We overran a bit, but it was the last case of the day, and he sent us away for 25 minutes or so to figure out his judgment. I WON! He awarded the £200 damages for the data protection breach and seemed to consider Clay vs CEL persuasive. He didn't allow the £120 claim for my time for the POPLA appeals, but I'll take the win.

I think with the benefit of hindsight I'd have pushed harder on making the case for the £120 time claim being a contractual one (which I did suggest, but clearly not strong enough) or unjust enrichment (possibly a harder sell). It was all a bit of a blur to be honest but in the end I think he was treating it as if it were effectively 2 claims for damages for the same breach, and I should have been clearer in my particulars to differentiate them. There was more I'd have liked to cover in detail that we just didn't have time for, but lesson learned on that one.

Obviously in the grand scheme of things well over 100 hours of my time, but I do feel it was worth it to hold them to account. It's a shame their business model makes it unlikely they'll ever be seriously challenged in court in a way that actually hurts them, but this has cost them hundreds of pounds and many hours of time from their in-house legal team for some PCNs that could (and should) just have been immediately cancelled. I just wish I had any confidence that it might change the way they do business.

ChirpyChicken

Well done on your win!

Coupon-mad

This is brilliant!  Well done on winning this claim against UKPC! 

So others can quote it, can you tell us:

Claim number

Date of hearing

Judge's name?

It's a shame their business model makes it unlikely they'll ever be seriously challenged in court in a way that actually hurts them.

I have high hopes of some PPCs being fined by the CMA in future, in view of their new powers this month as a result of the DMCC Act.

They'll be enforcing the CPUTRs. Nice.

PPC World should be very afraid.

Good article here:

https://www.lexology.com/library/detail.aspx?g=7dfea36f-6a75-431c-8a81-8bbe519f28a5

"The DMCC Act radically alters the shape of consumer protection enforcement in the UK by introducing an administrative enforcement model - bringing the regime more closely into line with the CMA’s existing antitrust enforcement regime. Whereas previously the CMA had no powers to sanction businesses in its own right for breaches of UK consumer protection laws, but rather had to seek enforcement via the courts in contested cases (in what was often a protracted process), the CMA can now directly impose fines based on the offending company’s global turnover, as well as additional daily fines for continued non-compliance."

  

dxbcc

This is brilliant!  Well done on winning this claim against UKPC! 

So others can quote it, can you tell us:

Claim number
Date of hearing
Judge's name?

Thanks! I couldn't have done it without the incredible advice on this forum.

The case was L6QZ0K0Q, Charlton vs UK Parking Control Ltd, 17/04/2025 and it was DDJ Ramsden.

I have high hopes of some PPCs being fined by the CMA in future, in view of their new powers this month as a result of the DMCC Act.

I would certainly love to see that - thanks for the article link. It's hard to think of any other group that relies on unfair and unreasonable behaviour at such scale as the PPC industry.

dxbcc

One further thing I've kicked off this weekend is opening a complaint with the ICO about their handling of my original complaint. Back when they upheld my complaint against UKPC the ICO assessor emailed them this, which UKPC then used as evidence in the court case to argue they hadn't breached the data protection act, and that the ICO had told them the VRM isn't personal data!

“VRM is not personal data when it can not (their emphasis) be used with other personal information to be able to identify a living person."

This is a poor choice of words I think based on the idea that the VRM isn't personal data if it's a fleet or hire vehicle, but the ICO has been consistent in rulings that the VRM of a vehicle where the registered keeper is an individual *is* personal data because anybody can request the keeper details from the VRM with any reasonable excuse and £2.50.  -- this decision notice is very clear on the matter, for example. https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2614512/fs50793373.pdf - Thankfully I had also included this in my evidence bundle.

They also took UKPC's claim that they'd deleted all the personal data at face value: "However, I note that as you appear to have deleted ...'s personal data, you would not be able to do any searches for information using the VRM anyway.”

I know UKPC still have the VRM stored and they've admitted as much. They also claimed that the other information I asked for (reasoning behind appeal decisions) also isn't personal data, which is not correct - it's clearly personal data under the "relates to" definition, and they ignored my follow up email.

The ICO at the time basically washed their hands of it with a "you'll need to take them to court to go any further", and obviously I did exactly that. It's clear that UKPC either do not understand the law or are wilfully disregarding it, but their misuse of the vague guidance they were given in court is clearly unacceptable, and the assessor should have been much more definitive in the questions they asked.

I'm not sure if anything productive will come of it, but I figure it's worth escalating.