First Parking PCN at Newborough National Nature Reserve - WON! - ICO complaint

Coupon-mad

OK, cc in that email address and use my recommended complaint in full. Should put a bat up their nightdress, so to speak!

piggypower

https://forums.moneysavingexpert.com/discussion/comment/82062080#Comment_82062080

Absolutely staggering draft @Coupon-mad

Thankyou. I have replied with it just now, been a mad couple days in the heat working.

In this time I have had two emails, one from NRW;

Dear Mr hotandbothered,

 

Thank you for your emails below.

 

Your complaint has been referred to the appropriate team to investigate and is being considered as a Stage 1 complaint. You will receive a response within 10 working days at the latest.

 

A copy of our complaints policy can be viewed in full on our website. If you are unable to access our website, please tell us and we will provide a copy for your information.

 

We would like to thank you for raising your concerns and bringing this to our attention.

 

Kind regards,

 

Alys Williams

 

Swyddog Cwynion a Mynediad at Wybodaeth – FOI/EIR / Complaints and Access to Information Officer FOI/EIR 

Cyswllt Cyfoeth / Customer Hub

Cwsmeriaid, Cyfathrebu a Masnach / Customer, Communications and Commercial Directorate

—

piggypower

also had my first response from F1rst Parking as follows;

cooldude255220

https://forums.moneysavingexpert.com/discussion/comment/82064107#Comment_82064107

You have written to me as the keeper. I am appealing as the keeper. I note that the Single Sector Code of Practice states, at Annex C:

where a NTK … has been issued in accordance with POFA, the Keeper … may appeal the parking charge if the driver has not previously been given the opportunity to appeal.

You must therefore proceed to consider my appeal - as the keeper - in accordance with the CoP. This is not contingent on me naming the driver.

piggypower

https://forums.moneysavingexpert.com/discussion/comment/82064131#Comment_82064131

this was great thankyou. I used this, to the word, as a base for my email reply.

I had a reply from F1rst Parking, which is interesting I think, as they have twisted the words quite a bit I feel;

"

Good afternoon

 

Thank you for your email.

 

Your refusal to identify the driver has been noted.

 

This information has been passed to the appeals panel to review.

 

Please monitor your mailbox for an appeal outcome.

 

Kind regards,

Administration Assistant

"

Refusal?? I don't see in the email I sent, where I refused. Quite an aggressive reply I would have said.

Umkomaas

Doesn’t matter what they say. It’s meaningless.

Coupon-mad

"The Appeals Panel" LOL! 🤣

piggypower

Well hello and good weekend to you all!

I have received a reply from NRW regarding the well written and lengthy detailed email I sent, thanks to you guys.

Unless I have missed something, its a lot of word salad but no action. lots of 'we hear you but we are not doing anything about it'. I am not impressed at all. Email as follows;

"

Dear Mr !"£$%^&*(,

Thank you for your further email and for providing additional information regarding your concerns about the parking arrangements at Newborough National Nature Reserve and Forest.

Having reviewed the issues you have raised, we would like to respond to the points in turn.

Firstly, we would like to apologise for the broken website link included in our previous correspondence. Thank you for bringing this to our attention. Please see the updated link: Natural Resources Wales / Newborough National Nature Reserve and Forest, Anglesey

With regard to your comments about the introduction of the new parking arrangements and the requirements within the relevant Code of Practice concerning material changes, we note your concerns regarding the signage arrangements at the site, including your reference to repeater notices and your view that First Parking has not complied with the relevant Code of Practice. NRW understands that signage was installed at the site entrance as well the car park itself to advise visitors that new parking arrangements were in operation and to direct users to the relevant parking information displayed on site. Information regarding the forthcoming changes to parking arrangements was also communicated externally in advance of the new parking system being introduced. We also note that there was a period between the introduction of the new parking system and the commencement of parking enforcement activity. We have recorded the concerns you have raised regarding compliance with the relevant Code of Practice and these have been shared with the appropriate NRW teams for their awareness and consideration.

 

You have also raised concerns regarding the operation and description of the 30-minute free parking period, including how this is presented through the RingGo system and on NRW's website. We appreciate you taking the time to provide this feedback. Your comments have been recorded and will be shared with the relevant teams for consideration as part of future reviews of parking arrangements, signage and customer information relating to the site.

In relation to the concerns you have raised regarding the ANPR camera system, the Surveillance Camera Code and compliance with the Data Protection Act 2018, these matters are being considered separately by NRW's specialist Data Protection team. As such, a response on those specific issues will be provided through that process rather than as part of this complaint response.

Finally, we acknowledge your clarification that you are not seeking to appeal the Parking Charge Notice through NRW, but are instead raising concerns about the parking management arrangements and related compliance matters. Those concerns have been considered here and shared with the appropriate teams. As previously advised, NRW's position regarding individual Parking Charge Notices remains unchanged and any appeal or challenge relating to the issuance of a Parking Charge Notice must be submitted through First Parking's established appeals process.

Thank you for taking the time to contact us and share your concerns. We value feedback from visitors and will ensure that the points you have raised are considered as part of ongoing reviews of the visitor experience at the site.

Kind regards,

 

Alys Williams

 

Swyddog Cwynion a Mynediad at Wybodaeth – FOI/EIR / Complaints and Access to Information Officer FOI/EIR 

Cyswllt Cyfoeth / Customer Hub

Cwsmeriaid, Cyfathrebu a Masnach / Customer, Communications and Commercial Directorate

"

Half_way

Why do blue badge holders have to jump through extra hoops?

Free parking for Blue Badge holders

Parking is free for Blue Badge holders between 6am and 11:59pm.

You can either register your vehicle for free parking on the day of your visit or apply for free parking for a year.

Displaying a blue badge should suffice and if their ANPR wonder cameras cant detect vehicles where someone has a disability as per the equalities act then ANPR cameras should not be used.

In other words, parking companies should be prohibited from using ANPR cameras /systems as the sole means to generate parking charge notices/so called parking enforcement in car parks and any other area of private land

Coupon-mad

As a reminder, this was the complaint:

—————————————-

Dear Eira,

It sounds like you expect me to assume the burden to tell NRW (a Welsh Government backed authority with core responsibilities including land management) why a camera that purports to calculate the time 'parked', yet is sited 1.2 miles away from the relevant car park, isn't lawful or justified in terms of its placement!

Even before considering relevant consumer legislation, it is plain that this situation is resulting in premature surveillance and blatantly unfair data processing that any Data Protection Officer should be able to spot at forty paces.

But I'll endeavour to point NRW and your agents in the right direction.

ANPR cameras process personal data when vehicles drive past their field of vision. The Information Commissioner ('the ICO') has previously confirmed that Vehicle Registration Marks (VRMs) are personal data and you can read about that - and about NRW's obligations as the land manager and principal service provider - in the second link below.

I'm providing the below detail because I'm keen to raise a complaint about the unlawful camera surveillance at this site with the ICO.

However, I am confident that NRW will agree that my data processing objection and complaint exposes a level of basic due diligence that was for NRW and/or its agents to undertake. The issues I'm raising should have been addressed in advance of commencing ANPR enforcement, when you carried out necessary site discussions and either NRW or F1rst Parking completed a Data Protection Impact Assessment (DPIA).

Talking of which, by return (and certainly within 14 days) I require a true copy of NRW's site-specific DPIA and this must not be a blanket British Parking Association template version, nor can it be one that F1rst Parking hurriedly mock up now.

If no DPIA exists for this site, kindly reply 'none' and explain why this wasn't done and what NRW will now do in order to bring the site within full compliance with the Data Protection Act and UK GDPR 2018 and the Data (Use and Access) Act 2025 ('the DUAA').

The DUAA is UK-wide legislation and its provisions - including updates to UK GDPR and data protection complaints processes - are fully enforceable across Wales. Whilst the DUAA is fairly new, it was enacted a good year before this inappropriate and unlawful ANPR system went live. It has specific requirements for Automated Decision-Making ('ADM') which would include remote, unmanned AI camera systems automatically processing and retaining VRMs to make DVLA KADOE requests and churning out template postal 'PCNs', with no human involvement.

All professional parking firms should be familiar with this legislation, especially those relying on camera surveillance and ADM to automatically generate 'PCNs' with no checks and balances. The DUAA includes a 'right to object' to data processing and I have clearly exercised that right.

So far, your response is sparse, out of date (you seem to think an ANPR system is only covered by the DPA 2018) and it is quite frankly woefully inadequate, so am I to assume that your supposed 'ANPR specialist' agents F1rst Parking are unaware of the law?

NRW also claimed in your first reply that the first 30 minutes is not 'free parking' but 'a free period of time to drop off passengers' yet that's not true. My research this week shows that the Ringo app for this parking site allows you to BOOK 30 minutes 'FREE PARKING' for the car park and a friend did just that.

Further, I found this web page:

car park | Newborough Anglesey

Note the sign at the old toll booth / barriers, where the ANPR is now located, offered 30 minutes free parking, not 'drop off' only and certainly not 'total stay starting from this point' which is what F1rst have secretly imposed.

This is a complete mess.

The ICO's 'ANPR Checklist' for organisations can be found here:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/additional-considerations-for-technologies-other-than-cctv/automatic-number-plate-recognition-anpr/?search=Taxi#top

It is my position that the placement of the camera and the info on signage fails to meet these aspects of the ICO's Checklist:

☐ the cameras plus the ambiguously worded signage are unfair, unlawful and not transparent in terms of when the parking session commences. When drivers finally reach the bays and find a space to park, then they walk over to stand in front of the main t&cs sign for the first time, it offers this information: "You are charged for the length of time you park." That's the key offer but it's untrue because (unbeknown to drivers, who are unaware of the GDPR surveillance data processing and whose attention is not drawn to the non-prominent ANPR camera whilst in fast-moving traffic over a mile away!) NRW's agent has already prematurely gathered VRM data some 10/15 minutes before.

☐ I've seen no evidence that NRW/your agents have conducted a DPIA that fully addresses the decision to replace the Toll Booth with ANPR, and explores any impact on the rights and freedoms of individuals whose personal data is processed.

☐ Your ANPR camera is poorly placed and is not in a 'specific area to address a particular need'. It's in the wrong area, attempting to cover several car parks but the car park we used is over a mile away. If you are to run a fair and transparent ANPR system, NRW needs a separate camera that only collects VRM data at the point when cars enter the parking area.

☐ NRW has failed to 'ensure that the location(s) of cameras are fully justifiable'.

☐ NRW does not have (at the entrance to this car park) 'clear and prominent signage in place to inform individuals that ANPR is in use, with sufficient detail about who to contact if they have a query.' Further, the t&cs sign you do have within the parking area is ambiguous (at best) in terms of the time when a parking session begins. Under the Consumer Rights Act 2015 ('the CRA') ambiguous terms MUST be interpreted in the way that most favours the consumer but F1rst Parking calculate the time differently than offered on the sign and are refusing appeals.

☐ I do not believe NRW/your agent have 'efficient governance procedures in place' given it has fallen to me to tell you about the ICO's ANPR Checklist and NRW appear unaware of my right to object to unfair data processing. 

☐ Given that F1rst Parking automatically process supplementary data (i.e. matching payments made and/or applying the longstanding allowance of 30 minutes free parking) for the purpose of comparing that to the times and data obtained from the camera, they are clearly failing to 'ensure that it is relevant to the purpose of the ANPR system'. It may surprise you to learn that, for motorists who park & remain on private land, there is no 'arrival' (consideration period) time allowance in the self-serving private parking sector single Code of Practice ('the ppssCoP'). My PCN shows that NRW has also failed to include a mandatory 'consideration period' in your landowner agreement to mitigate the extra 10-15 minutes to drive along the mile of roadway then enter the car park, find a space, read the t&cs, download the app and pay or select the '30 minutes free parking' offer.

Conclusions and key concerns:

The supposed 'parking period' in this car parks - for every driver - is being calculated (and VRM data is being harvested) unreasonably early.

To any average person with an objective view, relying upon a camera that has already secretly started the 'parking period' clock some 10-15 minutes earlier than the time that a driver has a chance to read the t&cs sign (that promises a different calculation of session start time) and eventually pay by app, is neither 'relevant' nor fair data processing.

In my view, the above demonstrates that F1rst Parking are breaking various consumer protection laws, as well as failing to comply with or operate in line with the Surveillance Camera code of practice which (where ANPR is used by this sector) is a mandatory requirement of the ppssCoP.

Further, the ppssCoP clause 3.2. mandates that operators must display additional (temporary) 'changed restrictions / new ANPR' warning notices at the actual car park entrance (note: not 1.2 miles away on a road). These extra signs are required in addition to the Entrance sign and must be prominent and remain in place for a minimum of 4 months from the date when any material changes started.

Introducing ANPR surveillance is a material change and NRW's system only went live in March, it seems. We had no idea of any changes or ANPR surveillance and I don't believe the signs in/at the actual car park comply with that clause. Why not take a look?

I urge NRW to do an unannounced site visit now, before contacting F1rst Parking. Please choose a busy daytime visit, so that NRW staff can accurately note the lengthy time taken:

• to drive all the way from camera to an empty parking bay and
• to park up, gather belongings and walk over to read the sign, and
• to download thd RingGo app by following the wordy signage instructions, and
• to select '30 minutes free' parking which is not only offered by RingGo but the contracted session only commences at that time, and isn't backdated to barrier arrival time.

Then please consider how much longer a disabled motorist or those unfamiliar with the RingGo app might take…

By breaching those Codes, I suggest NRW's agent is obtaining DVLA KADOE data without 'reasonable cause' in every case, not just mine. This means the data processing for every PCN generated since the new system went live, is unlawful. Arguably, further legislative breaches also come into play.

The Competition and Markets Authority enforces consumer rights legislation, with powers to directly penalise businesses for unfair commercial practices. This includes breaches of the CRA (such as ambiguous or misleading terms, as I have already raised above) and 

• the Consumer Protection from Unfair Trading Regulations 2008 makes it an offence for a trader to claim to comply with a Code of Practice when that isn't true.
• the Digital Markets, Competition and Consumers Act 2024 covers misleading information and unbalanced or unclear consumer contracts (the signs, in this case).

Given the unfair placement of the camera, you will be unable to justify to the ICO or to the CMA, your agent's decisions (ADM or not) surrounding the data it captures and the misleading nature of the 'parking period' start time. Not just in my case but in every case.

I think that NRW will also agree that, in all the premises, my PCN must be cancelled but so should all PCNs issued by this ADM system.

With that in mind, even if you confirm that my PCN is cancelled, I still require a copy of your DPIA, or your explanation as to why NRW didn't comply with that responsibility when allowing your agents to set up a 24/7 camera and process personal data.

I will still escalate this complaint to the ICO and the CMA's parking team, whether or not my PCN is cancelled.

To this end, I will also need to know that NRW's and F1rst Parking's data complaints processes have both been exhausted, and whether the 'data controller' for the purposes of the ICO complaint is NRW or is it F1rst Parking?

Both NRW and F1rst Parking must consider this a formal objection to the surveillance, the data processing, the ADM and to the unfair parking charges issued to all site users.

I urge NRW to: 

• order refunds and PCN cancellations immediately, and
• switch off and move the ANPR camera and/or have your erring agent add extra entry/exit cameras properly placed within the curtilage of each car park, and
• set in place a fair arrival 'consideration period' prior to paying or starting the free 30 minutes, and
• review the 'grace' period at the end of parking, as this will need to be flexible. In particular, the ANPR time limit enforcement must be paused in advance of times when the exit barrier is down, trapping drivers on site, as NRW states here:

Update on new hi-tech parking system for iconic Anglesey beach and why barriers will remain | North Wales Live

I note that a spokesperson for NRW said: "However, during peak season, a temporary exit barrier will be used by NRW to help manage traffic flow and prevent congestion in the village."

Given that NRW intend to hold motorists inside the carpark/forest, this will cause yet more unfair parking charges as they will overstay the parking session they have paid for, while waiting in a queue at a barrier. On these peak season days, NRW cannot allow F1rst Parking to continue to calculate parking time remotely.

The cameras would need to be turned off on those peak days and instead, wardens on foot used to manage the queues and reduce emissions by ensuring engines are turned off. That's real traffic management, not imposing wholly inappropriate 'parking' time limits on motorists queuing to leave.

Even on days when the exit barrier isn't closed, the nature of this busy and sprawling attraction sees pedestrians and other moving vehicles inadvertently delaying any driver's progress to the exit. Thus, it needs longer than the usual ten minutes at the end of a session to pack up and leave past a camera, even if better positioned.

I trust your site visit will confirm this and I expect a substantive reply within 14 days.

Be advised that I reserve the right to share this correspondence and all documents with local or national press, as well as my MS, the local Trading Standards office and the MHCLG who are responsible for the soon to be enacted parking on private land statutory rules across the UK.

Yours sincerely,

YOUR NAME

——————————————
I think you will have to wait for this because you want the DPIA for your ICO complaint:"In relation to the concerns you have raised regarding the ANPR camera system, the Surveillance Camera Code and compliance with the Data Protection Act 2018, these matters are being considered separately by NRW's specialist Data Protection team. As such, a response on those specific issues will be provided through that process rather than as part of this complaint response.

I doubt they have a DPIA. But the ICO complaint can come after that is clarified.

Anyway, you CAN do a CMA complaint (or I can, if you prefer) but first reply now and cc in F1rst Parking's complaints email and say:

Dear NRW and F1rst Parking,

Thankyou for this reply, from which I have taken NRW's position to be that (apart from the DPA and DUA Act/surveillance camera and premature data use concerns) you are saying I have reached the end of your complaints system.

F1rst Parking's silence on the matter is taken to be the same: I have exhausted their complaints procedure too.

As such, this site and F1rst Parking's conduct will now be referred to the Competition and Markets Authority without further notice.

When I receive your reply about the data concerns I will consider that your final word and will make a separate complaint to the ICO.

This isn't just about my PCN, it has wider implications, so even cancelling it now will not stop the two complaints to the Regulators.

Yours faithfully,