threatening debt recovery unpaid parking charge letter- please help

Thorndorise

Further to my PM, I'm sharing the overarching principle that I wrote to DCBL/Legal with - addressing their DPOs (but copying the info@ emails)

Essentially NPC do not have an adequate privacy policy that allows them to share keeper details outside their company after acquiring them from the DVLA/KADOE service....that is, they do not have 'recipients' or 'groups of recipients' that fall into the category of Debt recovery agents or their legal counterparts. (in this instance DCBL and DCB Legal).

I therefore wrote to DCBL and Legal's DPOs making them aware of this unlawful sharing of my details and they informed me (after prevarication about how they had followed the correct process), that they would no longer be pursuing the PCN in questions.

My letter hinged on:

NPC failed to inform the data subject that they (NPC) would be passing the data subject details to a third party in their (NPCs) privacy policy (as is mandated by GDPR law - Regulation EU 216/679 (the General Data Protection Regulation), the Data Protection Act 2018).

Specifically a lack of ‘recipients’ or ‘groups of recipients’ in NPCs privacy policy since their inception as a business (and they have been requesting keeper details from the DVLA since Q1 2021) – and then passing those details to Debt Recovery Agents or their legal firms unlawfully. (ref: https://www.nationalparkingcontrol.co.uk/privacy-policy ).

Also, I made a complaint to the IPC recently about the aforementioned PPC's lack of a complaints policy published on their website - this was after much tooing and froing about signs and generally crap attitude, however they immediately responded to let it be known that IPC were aware NPC didn't have CP on their website, their exact words were "This has been raised with them and will be published by the end of the week."

Ha, watch this space!!!

Coupon-mad

Thorndorise said:

Further to my PM, I'm sharing the overarching principle that I wrote to DCBL/Legal with - addressing their DPOs (but copying the info@ emails)

Essentially NPC do not have an adequate privacy policy that allows them to share keeper details outside their company after acquiring them from the DVLA/KADOE service....that is, they do not have 'recipients' or 'groups of recipients' that fall into the category of Debt recovery agents or their legal counterparts. (in this instance DCBL and DCB Legal).

I therefore wrote to DCBL and Legal's DPOs making them aware of this unlawful sharing of my details and they informed me (after prevarication about how they had followed the correct process), that they would no longer be pursuing the PCN in questions.

My letter hinged on:

NPC failed to inform the data subject that they (NPC) would be passing the data subject details to a third party in their (NPCs) privacy policy (as is mandated by GDPR law - Regulation EU 216/679 (the General Data Protection Regulation), the Data Protection Act 2018).

Specifically a lack of ‘recipients’ or ‘groups of recipients’ in NPCs privacy policy since their inception as a business (and they have been requesting keeper details from the DVLA since Q1 2021) – and then passing those details to Debt Recovery Agents or their legal firms unlawfully. (ref: https://www.nationalparkingcontrol.co.uk/privacy-policy ).

Also, I made a complaint to the IPC recently about the aforementioned PPC's lack of a complaints policy published on their website - this was after much tooing and froing about signs and generally crap attitude, however they immediately responded to let it be known that IPC were aware NPC didn't have CP on their website, their exact words were "This has been raised with them and will be published by the end of the week."

Ha, watch this space!!!

Interesting.

Watch the IPC jump only when it's something that benefits them or their members.

  

Thorndorise

Coupon-mad said:

Thorndorise said:

Further to my PM, I'm sharing the overarching principle that I wrote to DCBL/Legal with - addressing their DPOs (but copying the info@ emails)

Essentially NPC do not have an adequate privacy policy that allows them to share keeper details outside their company after acquiring them from the DVLA/KADOE service....that is, they do not have 'recipients' or 'groups of recipients' that fall into the category of Debt recovery agents or their legal counterparts. (in this instance DCBL and DCB Legal).

I therefore wrote to DCBL and Legal's DPOs making them aware of this unlawful sharing of my details and they informed me (after prevarication about how they had followed the correct process), that they would no longer be pursuing the PCN in questions.

My letter hinged on:

NPC failed to inform the data subject that they (NPC) would be passing the data subject details to a third party in their (NPCs) privacy policy (as is mandated by GDPR law - Regulation EU 216/679 (the General Data Protection Regulation), the Data Protection Act 2018).

Specifically a lack of ‘recipients’ or ‘groups of recipients’ in NPCs privacy policy since their inception as a business (and they have been requesting keeper details from the DVLA since Q1 2021) – and then passing those details to Debt Recovery Agents or their legal firms unlawfully. (ref: https://www.nationalparkingcontrol.co.uk/privacy-policy ).

Also, I made a complaint to the IPC recently about the aforementioned PPC's lack of a complaints policy published on their website - this was after much tooing and froing about signs and generally crap attitude, however they immediately responded to let it be known that IPC were aware NPC didn't have CP on their website, their exact words were "This has been raised with them and will be published by the end of the week."

Ha, watch this space!!!

Interesting.

Watch the IPC jump only when it's something that benefits them or their members.

  

I know it's like trying to swim in treacle - but I thought that given their rapid response to the above about NPC's lack of a published Complaints Policy, I thought I would cut and paste into their complaints portal a complaint for each of the (reported to DVLA) 47 out of 83 AOS members - I've now gotten to 4 pages of complaints on my list of complaints to the IPC...

They have immediately come back with a (yes of course) cut and paste response to each and every one...stating that...

Dear Conscientious Motorist

Thank you for flagging your concerns.

We are currently working with the parking operator to rectify the matter.

Kind regards
The IPC

They answered like this for 11 of the complaints then on the 12th one they wrote this....

Dear Conscientious Motorist
Thank you for contacting us.
We are in possession of a full list of parking operators who do not have their complaints policy on their website and we are working with them to resolve this, therefore there is no need to inform us of each company individually.
I will now conclude all your previous complaints.
Thank you for flagging this to us.
Kind regardsThe IPC

I thought this a little weird, so they know about all of the individual companies that have not adhered to the Code of Practice, yet the complaints were made about individual companies and were individual complaints, obviously there was a red herring in there too (one with a complaints policy published) - so what they've basically said is

'We know loads of our companies haven't been adhering to the Code since January 1st 2024, and subsequently since the single Code came out, we've done nothing about it - as it doesn't help us in any way (and certainly doesn't help the motorist). We haven't done anything about it, or reported it to the DVLA as that would make us look rubbish and possibly lose our superb Accreditation as a Trade Association which takes things seriously. Sorry about that...' _ that's my interpretation anyway - sorry @lizzieloopinloo didn't mean to hijack your thread.

lizzieloopinloo

Honestly not a problem Thorndorise, you've been so helpful.  So DCBL have finally written to my correct address and this time I have the "Notice of intended legal action" so guess I'm at at the next stage now!

Thorndorise

Thorndorise said:

Further to my PM, I'm sharing the overarching principle that I wrote to DCBL/Legal with - addressing their DPOs (but copying the info@ emails)

Essentially NPC do not have an adequate privacy policy that allows them to share keeper details outside their company after acquiring them from the DVLA/KADOE service....that is, they do not have 'recipients' or 'groups of recipients' that fall into the category of Debt recovery agents or their legal counterparts. (in this instance DCBL and DCB Legal).

I therefore wrote to DCBL and Legal's DPOs making them aware of this unlawful sharing of my details and they informed me (after prevarication about how they had followed the correct process), that they would no longer be pursuing the PCN in questions.

My letter hinged on:

NPC failed to inform the data subject that they (NPC) would be passing the data subject details to a third party in their (NPCs) privacy policy (as is mandated by GDPR law - Regulation EU 216/679 (the General Data Protection Regulation), the Data Protection Act 2018).

Specifically a lack of ‘recipients’ or ‘groups of recipients’ in NPCs privacy policy since their inception as a business (and they have been requesting keeper details from the DVLA since Q1 2021) – and then passing those details to Debt Recovery Agents or their legal firms unlawfully. (ref: https://www.nationalparkingcontrol.co.uk/privacy-policy ).

Also, I made a complaint to the IPC recently about the aforementioned PPC's lack of a complaints policy published on their website - this was after much tooing and froing about signs and generally crap attitude, however they immediately responded to let it be known that IPC were aware NPC didn't have CP on their website, their exact words were "This has been raised with them and will be published by the end of the week."

Ha, watch this space!!!

Not sure I updated, NPC did actually put a published complaints policy on their website before the end of that Friday (I was gobsmacked - although the draft I received as a word doc weeks after requesting one from them only had a date on a few days before - so they had 'just' written their draft)!

Obviously other's haven't been so quick to act.

The above isn't super helpful, but it does show that not only do IPC pick and choose how to enforce the Code (this was mandatory from Jan 2024), but that due to that inconsistency - the PPCs really don't have to do anything about the Code, as there are zero repercussions.

lizzieloopinloo

So just to update.  This has now gone to Claim. I believe it is the same car park as @londonerryan .  It’s the Chichester Southgate car park and if you scroll down on the right hand side to this link below you can see 1 awful review after another awful review all saying a similar line- that letters arrive from DCBL demanding £170 without ever receiving PCN’s/ NTK’s. https://www.parkopedia.mobi/parking/carpark/southgate/po19/chichester/?arriving=202505151730&leaving=202505151930 

The signage is confusing and contradictory too- I added some photos earlier upthread. Despite there being a cash machine (albeit it is out of order and rather hidden), the signs say you cant use it- they say you MUST register and then pay by RINGO but it is a town with recognised bad mobile signal.  My car was allegedly in the car park for 30 minutes- the time it would take to try and find a signal, attempt to register with ringo, get super frustrated and then give up and leave and pay for parking elsewhere. Being sought for £256.12 for my car being in a car park for 30 minutes seems crazy. 

I agree with @Thorndorise statement above that the sharing of my personal data by NPC with DCBL, and subsequently DCB Legal, was unlawful. NPC failed to inform me, as a data subject, that my details would be shared with a third party in their Privacy Policy (or their signage or NTK), which is a clear violation of GDPR and the UK Data Protection Act 2018. At the time the data was shared between NPC, DCBL, and DCB Legal, NPC’s Privacy Policy did not mention the recipients or categories of recipients, as required by the GDPR. This omission rendered the sharing of my personal data unlawful. It is clear that NPC is aware of this issue, as evidenced by their attempt to update the Privacy Policy on 29th January, following my email on the 28th.

I’ve explained this to both NPC and (crazily for a legal firm) DCB Legal too.  As per Articles 17 and 19 of the GDPR (which are also incorporated into the UK Data Protection Act 2018), data subjects can request the deletion of their personal data when it has been unlawfully processed.  Therefore, I’ve requested that my data be deleted under my right to erasure, however, I still find myself with a claim.

Any advice at this stage would be massively appreciated.   @KeithP you've been so helpful on other cases, if you have any snippet of wisdom that you think may help, I'd gladly take it.  I'll post the particulars of claim below

lizzieloopinloo

This is the particulars of claim: 

lizzieloopinloo

And just checking does anyone know if the Registration of Judgements means I can receive a CCJ if the court finds against me?

Coupon-mad

Yes (of course it does if you fail to defend, or refuse to pay if you lost at a hearing) but what we do never risks a CCJ.

lizzieloopinloo

Thanks @Coupon-mad As long as it doesn't mean I automatically get a CCJ if I defend myself and don't win, then that's ok.  Have nothing to loose but keep fighting the good fight then!