Euro Car Parks Ltd reported to ICO over DSAR breach.

Blindside6

The more one has to deal with PPCs such as Euro Car Parks Ltd (ECP) the more perplexing and frustrating the situation becomes. 

Last Tuesday, i made a series of DSAR requests to a series of PPC's and their partner agencies. All acknowledged, except Direct Collection Bailiffs and DCB Legal (no surprises there). 

The responses, so far, from ECP could best be described as bizarre - probably either template or AI generated - and have led to this complaint being sent to the Information Commissioner's Office, with whom I have dealt for professionally many years. 

It must be some sort of record to have to file a complaint to the statutory regulator, just three days after making what should be a non-complex request for disclosure.

"Subject: Complaint Regarding Non-Compliance with UK GDPR by Euro Car Parks Ltd

"Dear Information Commissioner's Office,

"I am writing to lodge a formal complaint against Euro Car Parks Ltd for failing to comply with their obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

"Background of the Case:

"On 31 March 2025, I submitted a Data Subject Access Request (DSAR) under Article 15 of the UK GDPR to Euro Car Parks Ltd, requesting access to my personal data.

"Despite providing adequate verification of my identity (including my driving licence), the company imposed additional requirements to establish a link between me and my vehicle, which I believe to be disproportionate and unnecessary given their existing possession of my data.

"Their insistence on sight of the V5C (vehicle registration certificate) constitutes an undue delay and imposes unreasonable barriers to my lawful right of access, as outlined in:

• Article 12(2): Organisations must facilitate the exercise of data subject rights.

• Article 12(3): Responses to DSARs must be provided without undue delay and, at the latest, within one calendar month.

"Steps Taken:

"I sent multiple emails detailing the legal basis for my DSAR and requesting compliance. However, Euro Car Parks Ltd has failed to process my request appropriately, as per the Regulations.

"Complaint Details:

"I believe Euro Car Parks Ltd has breached Articles 12 and 15 of the UK GDPR by:

1. Refusing to fulfil my DSAR despite possessing sufficient information to identify me.

2. Imposing disproportionate demands that delay compliance unnecessarily.

3. Applying blanket policies about data release that are not tailored to the individual case (which the ICO strongly advises against).

"Attached are the email exchanges with Euro Car Parks Ltd, providing evidence of their failure to comply.

"Their data from DVLA and County Court Claim [redacted] suffices for ID, per ICO guidance on ‘reasonable’ verification. It also begs the question: What if I had sold the car in the intervening 5 years since the alleged parking contraventions (which are robustly denied) and no longer held the V5C?

"I kindly request your prompt investigation into this matter and guidance on further steps I should take. The ongoing harm (distress, delay in court preparation, etc.), adds urgency.

"Thank you for your attention to this complaint. 

"Yours sincerely, 

[redacted]"


If any other forum user has similar difficulties with ECP (or any other PPC) I am more than happy for them to use this letter as a template. Or, it can be readily adapted if, for example, disclosure via DSAR is incomplete or over-redacted.

Hope this helps.

bill93326

Great work. I would recommend complaining to the DVLA as well.

I received a parking charge notice from ECP and the DVLA are currently investigating it for me. I complained to the BPA but did not hear back from them. If several people complain to the DVLA it is possible they could lose their access to DVLA data which is by far their biggest fear... 

I imagine your PCNs have the exact same errors as mine...

The PCN I received was issued on 29-Jan-25. It said payment must be made "within 28 days of date issued: by 26/02/2025". However later it says payment must be made within "28 days beginning with the day after that on which the notice is given (which is presumed to be the second working day after the Date issued)". This date would be 01-Mar. The date posted and the date issued are both the same date which I think is a clear breach of PoFA. The fact that both dates are presented on the same document is clearly confusing and appears to be in breach of the Protection of Freedoms Act (PoFA). 

The parking charge also says "You must include a £2.50 handling charge for cheque processing". Under the Consumer Rights (Payment Surcharges) Regulations 2012, businesses cannot impose additional fees for payments made by common methods, including cheques. I think ECP are acting outside the law by demanding an extra fee for paying by cheque.

Umkomaas

bill93326 said:

Great work. I would recommend complaining to the DVLA as well.

I received a parking charge notice from ECP and the DVLA are currently investigating it for me. I complained to the BPA but did not hear back from them. If several people complain to the DVLA it is possible they could lose their access to DVLA data which is by far their biggest fear... 

I imagine your PCNs have the exact same errors as mine...

The PCN I received was issued on 29-Jan-25. It said payment must be made "within 28 days of date issued: by 26/02/2025". However later it says payment must be made within "28 days beginning with the day after that on which the notice is given (which is presumed to be the second working day after the Date issued)". This date would be 01-Mar. The date posted and the date issued are both the same date which I think is a clear breach of PoFA. The fact that both dates are presented on the same document is clearly confusing and appears to be in breach of the Protection of Freedoms Act (PoFA). 

The parking charge also says "You must include a £2.50 handling charge for cheque processing". Under the Consumer Rights (Payment Surcharges) Regulations 2012, businesses cannot impose additional fees for payments made by common methods, including cheques. I think ECP are acting outside the law by demanding an extra fee for paying by cheque.

Don't be surprised or disappointed if the DVLA send you a fob off letter telling you how seriously they take their responsibilities in protecting your data ...."

The two 28 day periods have different meanings and application. The first period is for the driver to make payment, the second period is the warning that the PPC has the right (under PoFA) to pursue the keeper if the driver does not pay. Have another read of the detail on the NtK. 

LDast

Why did you send a copy of your DL which has much more personal info such as your DoB, your signature and your photo instead of your V5C in the first place?

Blindside6

LDast said:

Why did you send a copy of your DL which has much more personal info such as your DoB, your signature and your photo instead of your V5C in the first place?

Because, in my extensive experience, photo ID is, generally, required to make a data subject access request.

Moreover, because of my vocation, anyone who knew where to look could find my DoB, signature and photo. 

Blindside6

bill93326 said:

Great work. I would recommend complaining to the DVLA as well.

I received a parking charge notice from ECP and the DVLA are currently investigating it for me. I complained to the BPA but did not hear back from them. If several people complain to the DVLA it is possible they could lose their access to DVLA data which is by far their biggest fear... 

I imagine your PCNs have the exact same errors as mine...

The PCN I received was issued on 29-Jan-25. It said payment must be made "within 28 days of date issued: by 26/02/2025". However later it says payment must be made within "28 days beginning with the day after that on which the notice is given (which is presumed to be the second working day after the Date issued)". This date would be 01-Mar. The date posted and the date issued are both the same date which I think is a clear breach of PoFA. The fact that both dates are presented on the same document is clearly confusing and appears to be in breach of the Protection of Freedoms Act (PoFA). 

The parking charge also says "You must include a £2.50 handling charge for cheque processing". Under the Consumer Rights (Payment Surcharges) Regulations 2012, businesses cannot impose additional fees for payments made by common methods, including cheques. I think ECP are acting outside the law by demanding an extra fee for paying by cheque.

I'm pleased to see that you are robustly addressing some more of the many defects in ECPL's deeply flawed business model. The DVLA could only have locus in a complaint if ECPL didn't disclose their communications with them in obtaining KADOE details.

Coupon-mad

LOL!        

Jambo27

I am currently also dealing with ECP for a DSAR where they are asking for proof of ownsership. Well firstly the V5 does not show proof of ownership, only registered keeper.

I haven't been the registered keeper for about 2 years so don't have any paperwork anymore anyway.

The link to the vehicle is that they wrote to me because I was registered as the keeper at the time, so it's self evident.

Yes I sent them a copy of driving license, maybe not the best idea considering the data it contains, but it's done now.  This was my reply last night to them, but this morning received a reply with their same default response asking for V5:

-----------------------------------------------------------------------------------------------------------

A SAR (DSAR) is dependent on identifying the Data Subject.

As per DPA2018, Section52 & UK GDPR Article 12, Paragraph 6, please state what your "reasonable doubts" are in relation to my identity. You have received a copy of my driving license which shows my name and address that you will hold in relation to Parking Charge Number: xxxxxxxxx

If you still claim that I need to show you information relating to the vehicle to comply with my SAR request, please explain your justification, in law.

1. Data Protection Act 2018, Section 52:
“Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—
(a)request the provision of additional information to enable the controller to confirm the identity, and
(b)delay dealing with the request until the identity is confirmed.”

2. UK GDPR, Article 12, Paragraph 6:
“where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.”

3. The ICO’s "Right of Access":
“You can ask for enough information to judge whether the requester (or the person the request is made on behalf of) is the person that the data is about. The key point is that you must be reasonable and proportionate about what you ask for."

Blindside6

Jambo27 said:

I am currently also dealing with ECP for a DSAR where they are asking for proof of ownsership. Well firstly the V5 does not show proof of ownership, only registered keeper.

I haven't been the registered keeper for about 2 years so don't have any paperwork anymore anyway.

The link to the vehicle is that they wrote to me because I was registered as the keeper at the time, so it's self evident.

Yes I sent them a copy of driving license, maybe not the best idea considering the data it contains, but it's done now.  This was my reply last night to them, but this morning received a reply with their same default response asking for V5:

-----------------------------------------------------------------------------------------------------------

A SAR (DSAR) is dependent on identifying the Data Subject.

As per DPA2018, Section52 & UK GDPR Article 12, Paragraph 6, please state what your "reasonable doubts" are in relation to my identity. You have received a copy of my driving license which shows my name and address that you will hold in relation to Parking Charge Number: xxxxxxxxx

If you still claim that I need to show you information relating to the vehicle to comply with my SAR request, please explain your justification, in law.

1. Data Protection Act 2018, Section 52:
“Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—
(a)request the provision of additional information to enable the controller to confirm the identity, and
(b)delay dealing with the request until the identity is confirmed.”

2. UK GDPR, Article 12, Paragraph 6:
“where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.”

3. The ICO’s "Right of Access":
“You can ask for enough information to judge whether the requester (or the person the request is made on behalf of) is the person that the data is about. The key point is that you must be reasonable and proportionate about what you ask for."

I issued them with a Pre-Action Protocol Letter before Claim on 17th April 2025. They have not responded, of course:


"To: DPO;

17/04/2025 10:50

"Dear ECP DPO

"It is apparent that you have not read the pdf attached to my email of 15th April.

"The text of that pdf is reproduced below for emphasis.

"Please clearly understand that if the terms of the Pre-Action Protocol Letter before Claim are not complied with fully by 30th April, 2025 then County Court proceedings will be issued against Euro Car Parks Ltd. As such you are strongly urged to seek appropriate legal advice. 

"Yours sincerely

 

"[redacted]

 

 

"To: The Data Protection Officer Euro Car Parks Ltd
Date: 15 April 2025
Subject: Pre-Action Protocol Letter Before Claim under the UK General Data Protection
Regulation

"Dear Sir/Madam,

Background I write regarding the failure of Euro Car Parks Ltd ("ECPL") to comply with
its legal obligations under the UK General Data Protection Regulation (UK GDPR) in
response to a Data Subject Access Request (DSAR) I submitted on 31 March 2025.
Despite providing adequate identification and a clear request under Article 15 UK
GDPR, ECPL has refused to comply, instead imposing disproportionate and
unnecessary barriers that obstruct the lawful exercise of my data subject rights.
This non-compliance arises in the context of active civil litigation (Claim No. L0KF9T5H)
brought by ECPL against me, where access to personal data is crucial to preparing my
defence and evaluating the lawfulness of ECPL's data handling.

"Cause of Action This claim arises from ECPL's breaches of Articles 12 and 15 of the UK
GDPR. Specifically:
• Failure to respond to a valid DSAR within the statutory time limit, in breach of
Article 12(3);
• Imposition of unreasonable and excessive identity verification requirements
(e.g., insisting on sight of a V5C document despite already holding sufficient
data to verify my identity), in breach of Article 12(2);
• Refusal to process my DSAR without justification under Article 15(4) or Schedule
2 of the Data Protection Act 2018;
• Application of inflexible internal policies not tailored to the facts of the case,
contrary to ICO guidance and the principle of fairness under Article 5(1)(a).
These actions amount to a serious and deliberate obstruction of my statutory rights and
give rise to a claim for declaratory relief, compliance, and compensation under Article
82 UK GDPR.

"Factual Matrix
• On 31 March 2025, I submitted a DSAR to ECPL, including a copy of my driving
licence as identity verification;
• ECPL responded by demanding a copy of my V5C logbook, despite already
holding relevant data (via DVLA and civil claim L0KF9T5H) linking me to the
vehicle in question;
• I sent follow-up correspondence outlining the legal basis for my DSAR and the
ICO’s guidance on reasonable verification;
• Notably, other entities in the same data processing chain—Direct Collection
Bailiffs Ltd (DCBL), ZZPS Ltd, and QDR Solicitors—have all acknowledged and
responded to similar DSARs without requesting a copy of the V5C. DCBL and
ZZPS concluded their internal reviews without querying vehicle ownership, and
QDR Solicitors accepted a driving licence alone as adequate identification;
• This inconsistency in verification standards between ECPL and its
agents/affiliates highlights the arbitrary and obstructive nature of ECPL’s refusal.
It also reinforces the fact that ECPL already holds sufficient information
(including via DVLA and litigation records) to link me to the subject vehicle;
• ECPL refused to engage further or comply with the DSAR, with no lawful basis
cited for its refusal.

"Applicable Law
• Article 12(2) UK GDPR – Obligation to facilitate the exercise of data subject
rights;
• Article 12(3) UK GDPR – DSARs must be responded to without undue delay and
within one calendar month;
• Article 15 UK GDPR – Right of access to personal data;
• Article 82 UK GDPR – Right to compensation for material and non-material
damages arising from breaches;
• Section 167 Data Protection Act 2018 – Right to seek compliance via the courts.

"Case Authorities
• Driver v Crown Prosecution Service [2022] EWHC 2500 (KB): DSAR failures found
to give rise to compensable distress;
• Österreichische Post AG (C-300/21): Confirmed the right to non-material
damages for fear of data misuse;
• Rudd v Bridle & JTRIG [2019] EWHC 366 (QB): Confirmed controller obligations
and appropriate responses to DSARs;
• ICO Guidance: Clear warnings against excessive identity demands and blanket
DSAR refusal policies.

"Harm and Distress ECPL’s unlawful refusal to comply with my DSAR has caused the
following harms:
• Procedural prejudice in Claim [redacted], where withheld data may reveal
material handling flaws, processing defects, or unlawful escalation practices;
• Emotional distress caused by the refusal to engage meaningfully with a data
rights request in the context of an ongoing legal dispute;
• Frustration, anger, anxiety and cost in seeking recourse via the ICO and legal system, including
delays in resolving the underlying claim;
• The contrast between ECPL’s obstructive conduct and the responses of its
processing partners has exacerbated the sense of procedural unfairness. It has
caused unnecessary delay, additional correspondence, and forced the
escalation of a matter that could—and should—have been resolved informally in
line with established data protection norms.

"These harms clearly exceed the de minimis threshold and are actionable under Article
82 UK GDPR.

"Next Steps In accordance with the Practice Direction – Pre-Action Conduct and
Protocols, I request that ECPL:
1. Fully comply with my DSAR, without unreasonable verification demands;
2. 3. Provide all personal data held in relation to me, including correspondence,
tracing activity, DVLA records, and any data shared with third parties such as
ZZPS, DCBL, or DCB Legal;
Provide a clear explanation of the processing purposes, source and recipients of
the data, retention policies, and my data subject rights.

"If ECPL fails to respond substantively within 14 days of receipt of this letter, I intend to
commence legal proceedings without further notice, seeking a compliance order and
compensation for non-material damage under Article 82 UK GDPR and section 167 DPA
2018.

"Yours faithfully,

[redacted]"

kryten3000

I don't consider a request for the V5C as excessive and would always suggest sending a copy of page 1 with the SAR.

Blindside6

kryten3000 said:

I don't consider a request for the V5C as excessive and would always suggest sending a copy of page 1 with the SAR.

The point is: Such a demand is unlawful - and I intend to get a court declaration as such.