First Parking PCN at Newborough National Nature Reserve - WON! - ICO complaint

piggypower

trying to find more signs pictures online… bought me to this web page;

car park | Newborough Anglesey

very interesting page and info. Note the sign at the old toll booth/barriers, where the ANPR is now located, CLEARLY states 30 minutes free PARKING!… not "drop off"

and on this page

Update on new hi-tech parking system for iconic Anglesey beach and why barriers will remain | North Wales Live

A spokesperson for NRW says;

"However, during peak season, a temporary exit barrier will be used by NRW to help manage traffic flow and prevent congestion in the village."

…so they intend to hold people inside the carpark/forest, which would/could/will cause people to get fines as they will overstay the parking they have paid for, while waiting in a queue controlled by a barrier, controlled by NRW representatives.

WOW.

Coupon-mad

OK, so reply citing the ICO's view:

Dear Eira,

It sounds like you expect me to assume the burden to tell NRW (a Welsh Government backed authority with core responsibilities including land management) why a camera that purports to calculate the time 'parked', yet is sited 1.2 miles away from the relevant car park, isn't lawful or justified in terms of its placement!

Even before considering relevant consumer legislation, it is plain that this situation is resulting in premature surveillance and blatantly unfair data processing that any Data Protection Officer should be able to spot at forty paces.

But I'll endeavour to point NRW and your agents in the right direction.

ANPR cameras process personal data when vehicles drive past their field of vision. The Information Commissioner ('the ICO') has previously confirmed that Vehicle Registration Marks (VRMs) are personal data and you can read about that - and about NRW's obligations as the land manager and principal service provider - in the second link below.

I'm providing the below detail because I'm keen to raise a complaint about the unlawful camera surveillance at this site with the ICO.

However, I am confident that NRW will agree that my data processing objection and complaint exposes a level of basic due diligence that was for NRW and/or its agents to undertake. The issues I'm raising should have been addressed in advance of commencing ANPR enforcement, when you carried out necessary site discussions and either NRW or F1rst Parking completed a Data Protection Impact Assessment (DPIA).

Talking of which, by return (and certainly within 14 days) I require a true copy of NRW's site-specific DPIA and this must not be a blanket British Parking Association template version, nor can it be one that F1rst Parking hurriedly mock up now.

If no DPIA exists for this site, kindly reply 'none' and explain why this wasn't done and what NRW will now do in order to bring the site within full compliance with the Data Protection Act and UK GDPR 2018 and the Data (Use and Access) Act 2025 ('the DUAA').

The DUAA is UK-wide legislation and its provisions - including updates to UK GDPR and data protection complaints processes - are fully enforceable across Wales. Whilst the DUAA is fairly new, it was enacted a good year before this inappropriate and unlawful ANPR system went live. It has specific requirements for Automated Decision-Making ('ADM') which would include remote, unmanned AI camera systems automatically processing and retaining VRMs to make DVLA KADOE requests and churning out template postal 'PCNs', with no human involvement.

All professional parking firms should be familiar with this legislation, especially those relying on camera surveillance and ADM to automatically generate 'PCNs' with no checks and balances. The DUAA includes a 'right to object' to data processing and I have clearly exercised that right.

So far, your response is sparse, out of date (you seem to think an ANPR system is only covered by the DPA 2018) and it is quite frankly woefully inadequate, so am I to assume that your supposed 'ANPR specialist' agents F1rst Parking are unaware of the law?

NRW also claimed in your first reply that the first 30 minutes is not 'free parking' but 'a free period of time to drop off passengers' yet that's not true. My research this week shows that the Ringo app for this parking site allows you to BOOK 30 minutes 'FREE PARKING' for the car park and a friend did just that.

Further, I found this web page:

car park | Newborough Anglesey

Note the sign at the old toll booth / barriers, where the ANPR is now located, offered 30 minutes free parking, not 'drop off' only and certainly not 'total stay starting from this point' which is what F1rst have secretly imposed.

This is a complete mess.

The ICO's 'ANPR Checklist' for organisations can be found here:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/additional-considerations-for-technologies-other-than-cctv/automatic-number-plate-recognition-anpr/?search=Taxi#top

It is my position that the placement of the camera and the info on signage fails to meet these aspects of the ICO's Checklist:

☐ the cameras plus the ambiguously worded signage are unfair, unlawful and not transparent in terms of when the parking session commences. When drivers finally reach the bays and find a space to park, then they walk over to stand in front of the main t&cs sign for the first time, it offers this information: "You are charged for the length of time you park." That's the key offer but it's untrue because (unbeknown to drivers, who are unaware of the GDPR surveillance data processing and whose attention is not drawn to the non-prominent ANPR camera whilst in fast-moving traffic over a mile away!) NRW's agent has already prematurely gathered VRM data some 10/15 minutes before.

☐ I've seen no evidence that NRW/your agents have conducted a DPIA that fully addresses the decision to replace the Toll Booth with ANPR, and explores any impact on the rights and freedoms of individuals whose personal data is processed.

☐ Your ANPR camera is poorly placed and is not in a 'specific area to address a particular need'. It's in the wrong area, attempting to cover several car parks but the car park we used is over a mile away. If you are to run a fair and transparent ANPR system, NRW needs a separate camera that only collects VRM data at the point when cars enter the parking area.

☐ NRW has failed to 'ensure that the location(s) of cameras are fully justifiable'.

☐ NRW does not have (at the entrance to this car park) 'clear and prominent signage in place to inform individuals that ANPR is in use, with sufficient detail about who to contact if they have a query.' Further, the t&cs sign you do have within the parking area is ambiguous (at best) in terms of the time when a parking session begins. Under the Consumer Rights Act 2015 ('the CRA') ambiguous terms MUST be interpreted in the way that most favours the consumer but F1rst Parking calculate the time differently than offered on the sign and are refusing appeals.

☐ I do not believe NRW/your agent have 'efficient governance procedures in place' given it has fallen to me to tell you about the ICO's ANPR Checklist and NRW appear unaware of my right to object to unfair data processing.

☐ Given that F1rst Parking automatically process supplementary data (i.e. matching payments made and/or applying the longstanding allowance of 30 minutes free parking) for the purpose of comparing that to the times and data obtained from the camera, they are clearly failing to 'ensure that it is relevant to the purpose of the ANPR system'. It may surprise you to learn that, for motorists who park & remain on private land, there is no 'arrival' (consideration period) time allowance in the self-serving private parking sector single Code of Practice ('the ppssCoP'). My PCN shows that NRW has also failed to include a mandatory 'consideration period' in your landowner agreement to mitigate the extra 10-15 minutes to drive along the mile of roadway then enter the car park, find a space, read the t&cs, download the app and pay or select the '30 minutes free parking' offer.

Conclusions and key concerns:

The supposed 'parking period' in this car parks - for every driver - is being calculated (and VRM data is being harvested) unreasonably early.

To any average person with an objective view, relying upon a camera that has already secretly started the 'parking period' clock some 10-15 minutes earlier than the time that a driver has a chance to read the t&cs sign (that promises a different calculation of session start time) and eventually pay by app, is neither 'relevant' nor fair data processing.

In my view, the above demonstrates that F1rst Parking are breaking various consumer protection laws, as well as failing to comply with or operate in line with the Surveillance Camera code of practice which (where ANPR is used by this sector) is a mandatory requirement of the ppssCoP.

Further, the ppssCoP clause 3.2. mandates that operators must display additional (temporary) 'changed restrictions / new ANPR' warning notices at the actual car park entrance (note: not 1.2 miles away on a road). These extra signs are required in addition to the Entrance sign and must be prominent and remain in place for a minimum of 4 months from the date when any material changes started.

Introducing ANPR surveillance is a material change and NRW's system only went live in March, it seems. We had no idea of any changes or ANPR surveillance and I don't believe the signs in/at the actual car park comply with that clause. Why not take a look?

I urge NRW to do an unannounced site visit now, before contacting F1rst Parking. Please choose a busy daytime visit, so that NRW staff can accurately note the lengthy time taken:

• to drive all the way from camera to an empty parking bay and
• to park up, gather belongings and walk over to read the sign, and
• to download thd RingGo app by following the wordy signage instructions, and
• to select '30 minutes free' parking which is not only offered by RingGo but the contracted session only commences at that time, and isn't backdated to barrier arrival time.

Then please consider how much longer a disabled motorist or those unfamiliar with the RingGo app might take…

By breaching those Codes, I suggest NRW's agent is obtaining DVLA KADOE data without 'reasonable cause' in every case, not just mine. This means the data processing for every PCN generated since the new system went live, is unlawful. Arguably, further legislative breaches also come into play.

The Competition and Markets Authority enforces consumer rights legislation, with powers to directly penalise businesses for unfair commercial practices. This includes breaches of the CRA (such as ambiguous or misleading terms, as I have already raised above) and

• the Consumer Protection from Unfair Trading Regulations 2008 makes it an offence for a trader to claim to comply with a Code of Practice when that isn't true.
• the Digital Markets, Competition and Consumers Act 2024 covers misleading information and unbalanced or unclear consumer contracts (the signs, in this case).

Given the unfair placement of the camera, you will be unable to justify to the ICO or to the CMA, your agent's decisions (ADM or not) surrounding the data it captures and the misleading nature of the 'parking period' start time. Not just in my case but in every case.

I think that NRW will also agree that, in all the premises, my PCN must be cancelled but so should all PCNs issued by this ADM system.

With that in mind, even if you confirm that my PCN is cancelled, I still require a copy of your DPIA, or your explanation as to why NRW didn't comply with that responsibility when allowing your agents to set up a 24/7 camera and process personal data.

I will still escalate this complaint to the ICO and the CMA's parking team, whether or not my PCN is cancelled.

To this end, I will also need to know that NRW's and F1rst Parking's data complaints processes have both been exhausted, and whether the 'data controller' for the purposes of the ICO complaint is NRW or is it F1rst Parking?

Both NRW and F1rst Parking must consider this a formal objection to the surveillance, the data processing, the ADM and to the unfair parking charges issued to all site users.

I urge NRW to:

• order refunds and PCN cancellations immediately, and
• switch off and move the ANPR camera and/or have your erring agent add extra entry/exit cameras properly placed within the curtilage of each car park, and
• set in place a fair arrival 'consideration period' prior to paying or starting the free 30 minutes, and
• review the 'grace' period at the end of parking, as this will need to be flexible. In particular, the ANPR time limit enforcement must be paused in advance of times when the exit barrier is down, trapping drivers on site, as NRW states here:

Update on new hi-tech parking system for iconic Anglesey beach and why barriers will remain | North Wales Live

I note that a spokesperson for NRW said: "However, during peak season, a temporary exit barrier will be used by NRW to help manage traffic flow and prevent congestion in the village."

Given that NRW intend to hold motorists inside the carpark/forest, this will cause yet more unfair parking charges as they will overstay the parking session they have paid for, while waiting in a queue at a barrier. On these peak season days, NRW cannot allow F1rst Parking to continue to calculate parking time remotely.

The cameras would need to be turned off on those peak days and instead, wardens on foot used to manage the queues and reduce emissions by ensuring engines are turned off. That's real traffic management, not imposing wholly inappropriate 'parking' time limits on motorists queuing to leave.

Even on days when the exit barrier isn't closed, the nature of this busy and sprawling attraction sees pedestrians and other moving vehicles inadvertently delaying any driver's progress to the exit. Thus, it needs longer than the usual ten minutes at the end of a session to pack up and leave past a camera, even if better positioned.

I trust your site visit will confirm this and I expect a substantive reply within 14 days.

Be advised that I reserve the right to share this correspondence and all documents with local or national press, as well as my MS, the local Trading Standards office and the MHCLG who are responsible for the soon to be enacted parking on private land statutory rules across the UK.

Yours sincerely,

YOUR NAME

GrannyKate

Thats a very good draft letter. I assume the 'Data Protection Team' will regret their stance here as failing to answer the relatively simple complaint has resulted in a much more comprehensive and detailed set of questions. I will be interested to see if they did a DPIA which would need to be produced under FOIA. If the parking company did one (which I very much doubt) NRW may hold a copy from the contracting process which would then be disclosable. The ICO guidance for ANPR refers to privacy concerns for public authorities and does not make any distinction between simple personal data and special category/sensitive data.

James_Poisson

A classic from @Coupon-mad you'll need a new keyboard after that one!😃

Umkomaas

https://forums.moneysavingexpert.com/discussion/comment/82062189#Comment_82062189

@Coupon-mad - are you still doing all this on your mobile phone? Great draft response, by the way. 👍

1505grandad

Apologies - a pedantic observation - the following link refers to the 2024 version not the latest 2025 version:-

 "…..in the self-serving Private Parking Sector Single Code of Practice. ('the PPSCoP')."

Also there is an "s" missing in various references to "ppssCoP"

daveyjp

And as previously advised copy in the Chair of the governing body with that response.

Coupon-mad

"are you still doing all this on your mobile phone?"

Yep. It's easier for most things. Causes the odd typo but I don't want a laptop out while catching up with Corrie at 1am!

And I blame AI for the PPS(S)CoP version error because I asked t'internet for which clause in the Code talks about additional signs for new enforcement.

I have put right the acronym now but who cares what they call their Code? IMHO it's clearly designed to be so easy for them to keep churning out PCNs that maybe we should call it 'the piece of p.ssCoP'

😀

Castle

https://forums.moneysavingexpert.com/discussion/comment/82055602#Comment_82055602

Under Section 164(a) Para 2 of the DPA2018 Act (Complaints by Data Subjects to Controllers)

A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

kryten3000

I have been given an email address in reply to my query sent via their web form: sales@firstparking.co.uk

I expect they will try and weasel out of responding by referring people to their policy but that's more evidence to show their breach of the DPA 2018