First Parking PCN at Newborough National Nature Reserve - WON! - ICO complaint

Coupon-mad

I'd like to do a CMA complaint about F1rst, citing:

• inadequate consideration period. Especially given that the camera records cars and unfairly starts the 'period of parking' 1.2 miles before the car park;
• extremely wordy signs with very small print, with a confusing '70p per 20 minutes' way to have to self-calculate the tariff. So, consumers can't make a decision on whether to accept the parking contract (or just leave without accepting it) until they have either fully downloaded the app and started a parking session, or joined the long queue at the machine. And it's unclear how to calculate extending initial time and drivers are unlikely see the 'afterthought' small print about the £100 PCN risk, which only says a charge "will be issued" which isn't a contractual term (the sign should say: by parking and being afforded a fair opportunity to accept these terms, the driver agrees to pay £TARIFF per hour and/or a parking charge notice of £100 in the following circumstances…").
• ambiguous and unfair terms. The signs used to offer 30 minutes free parking, with charges only applying after that. Since the ANPR cameras were added, they are pretending that there isn't "30 mins free parking" any more. The cameras are now starting the clock 10-15 minutes early, 1.2 miles back along the road, yet the new signage says that you are charged "for the time you park";
• Disability concerns: it says on the sign: "FREE for Blue Badge Holders (see tge accessibility information for more details)" unjustified use of cameras with no DPIA and no Disability Impact Assessment, yet they are now requiring blue badge holders to 'register' as well as display their badge. This means that the parking firm is collecting and processing 'special category' data without the double justification set out in the DUA Act 2025, and is requiring disabled people to take extra steps, purely because First Parking 'want' to run the site remotely with no-one checking blue badges on foot. That isn't a lawful reason to use ANPR and a system that collects identifying data related to health.

"You are charged for the length of time you park" says that sign. That's the key offer then. Nothing to do with cameras.

The sign also states:

"If you are dropping someone off, you have 30 minutes from the time you enter the carpark to the time you get to the exit barrier before you are charged"

 Yet there is no 'exit barrier' and the ANPR camera is over a MILE away. Hidden ANPR camera red arrow, on the approach road waaaay back, top right of the image below..

Car park, green circle, 7-10 minutes drive away & you get '30 minutes free' but that's exactly what the Supreme Court in Beavis meant by a 'concealed pitfall or trap':

We can talk about the ICO complaint later, and that one is best coming from you as the data subject affected.

piggypower

@Coupon-mad

You do your thing and let me know how I can help. If the PCN is cancelled I would like to persue the complaints with whoever needed, with your assistance, to sort this out. I have joined the FB group for this forest/area and its full of people paying the fines and being upset about it. Its affecting a lot of vulnerable people, and many say they wont come back.

I will reply as per your last post to NRW/F1rst.

piggypower

Is there need for me to pursue F1rst Parking about the appeal? Their email in response to my appeal was;

"

Your appeal has been received and the PCN/PPN is on hold whilst the details are being reviewed. Providing the information you have submitted is accurate you will receive a response within 14 days.

"

That email was received 16 days ago.

Coupon-mad

No just wait during July.

piggypower

I sent this email to NRW and F1rst Parking;

Dear NRW and F1rst Parking,

Thankyou for this reply, from which I have taken NRW's position to be that (apart from the DPA and DUA Act/surveillance camera and premature data use concerns) you are saying I have reached the end of your complaints system.

F1rst Parking's silence on the matter is taken to be the same: I have exhausted their complaints procedure too.

As such, this site and F1rst Parking's conduct will now be referred to the Competition and Markets Authority without further notice.

When I receive your reply about the data concerns I will consider that your final word and will make a separate complaint to the ICO.

This isn't just about my PCN, it has wider implications, so even cancelling it now will not stop the two complaints to the Regulators.

Yours faithfully,

—response today (21/7/26) from F1rst Parking as follows;

Good Morning,

 

Thank you for your email.

 

Please see below links to our complaints policy.

https://firstparking.co.uk/motorists/complaints/

 

https://firstparking.co.uk/complaints-policy/

 

Kind regards,

Administration Assistant

—so helpful and informative!

I know its not really that interesting but just want to keep and gather all info in this one thread, for any potential need in future.

Coupon-mad

Dear Administration Assistant,

You haven't assisted with the administration of my complaint, in fact you have obstructed it. You've read and took time to reply to me by email but you can't be bothered to provide a meaningful response.

It is ludicrously obstructive that your so-called complaints policy requires people to complain only by snail mail and you corral complaints to "within 56 days"!

"A complaint must be made in writing via post: Postal Address: First Parking LLP, 27 Old Gloucester Street, London, WC1N 3AX.

The complaint must be made within 56 days of the incident taking place."

You are digging your company a deeper hole and will have to explain yourselves to the regulators. And I don't mean the BPA.

Kindly confirm that I have reached the end of your complaints service.

Telling me to write you a letter will amount to the same because I am not re-sending my complaint by post.

Your silence this week will also amount to reaching an impasse and I will send all my evidence next week, to the CMA and the ICO.

Yours sincerely,

piggypower

https://forums.moneysavingexpert.com/discussion/comment/82077077#Comment_82077077

Done.

Funnily enough, with less eloquence and smart wording, I had felt like responding in a similar way. Its incredible how a group of people have carefully thought out this parking company, to lie JUST within the law to not seem like a complete obvious scam but at the same time to deal treacherously with everyone who dares to step foot in or near a carpark "managed" by them. Really is disgusting.

thankyou again for your assistance @Coupon-mad

piggypower

https://forums.moneysavingexpert.com/discussion/comment/82077077#Comment_82077077

In reply to this email, F1rst Parking have emailed back as follows;

—

Good Morning,

 

Thank you for your email.

 

To enable us to investigate your concerns, please reply to this email outlining the basis of your complaint, including any relevant details you would like us to consider.

 

Once we have received this information, your complaint will be acknowledged and handled in accordance with our complaints procedure.

—

I would like to say that I am surprised by such a reply. But at this stage, unfortunately, I am not. Unreal. Just, unreal.

fyi; I sent a letter of complaint to the DPO for F1rst Parking dated 5/7/26, posted that day with proof of postage. No paper or email reply to that.

Also, in another email, after I asked who the DPO is… their reply:

"First Parking LLP is the registered data controller." … I thought the DPO should be an individual, no?

piggypower

should I send them a copy of the letter I already sent them? via email?

Coupon-mad

Yes I would (as an attachment) but in the body of the email, say this (below) after your intro paragraph telling them about the complaint you posted and when, and that you are attaching a copy of it and proof of posting…

…then continue:

This is a DPA/UK GDPR complaint and an objection to ADM. Specifically, F1rst is in breach of the Surveillance Camera Code of Practice and the UK data regulator's ANPR guidelines:

The Information Commissioner ('the ICO') has previously confirmed that Vehicle Registration Marks (VRMs) are personal data. ANPR cameras process personal data when vehicles drive past their field of vision.

Under the ICO guidelines on automated processing, if an ANPR system automatically calculates a stay and triggers a PC by mail without meaningful human review, it is Automated Decision-Making ('ADM') with significant and/or legal effects. This invokes high-threshold transparency duties under the UK GDPR (amended by the Data (Use and Access) Act 2025, 'the DUAA'). The intersections between ANPR technology, ADM and transparency obligations create distinct layers of compliance under ICO surveillance rules.

Under the ICO's transparency framework, the entrance signage must serve as a Layered Privacy Notice. To meet the ICO’s standard for ANPR-driven automated environments (and to meet the requirements of open dealing and fairness in the consumer protection laws overseen by the Competition and Markets Authority, 'the CMA') the entrance sign must deliver specific information before the driver passes the camera.

By definition - and to meet the duty of good faith - that camera and any purported 'entrance signs' must be placed at the entrance to the car park itself. Not 1.2 miles back on a road.

Articles 13 & 14 of the UK GDPR defines the right to be informed, which requires organisations to provide clear, concise, honest and timely (fairly placed) privacy information to individuals about how their personal data will be collected and used.

It must be clear, at the boundary to the parking spaces - not a mile away - that an automated camera tracking system is in use to calculate parking terms. The camera must not be covertly hidden or unfairly positioned (e.g. the 'free stay' clock must not start too soon). If the entrance sign and ANPR camera is deliberately or negligently positioned too far away and/or fails to direct the motorist to a privacy policy detailing their rights, the data collection fails the core legal principle of being "fair, lawful and transparent".

My data processing objection and complaint exposes a level of basic due diligence that was for NRW and/or its agents to undertake. The issues I'm raising should have been addressed in advance of commencing ANPR enforcement, when you carried out necessary site discussions and either NRW or F1rst Parking completed a Data Protection Impact Assessment (DPIA).

By return (and certainly within 14 days, regardless of whether you cancel my PCN) I require a true copy of your site-specific DPIA and this must not be a blanket British Parking Association template version, nor can it be one that F1rst Parking hurriedly mock up now.

If no DPIA exists yet for this site, kindly reply 'none' and explain why this wasn't done and what you will now do in order to bring the site within full compliance with the Data Protection Act and UK GDPR 2018 and the the DUAA.

All professional parking firms should be familiar with this legislation, especially those relying on camera surveillance and ADM to automatically generate 'PCNs' with no checks and balances. The DUAA includes a 'right to object' to data processing and I have clearly exercised that right.

Further, as this is a new ANPR set up this year (with camera surveillance having replaced the kiosk for the first time) under your self-serving joke of an industry Code of Practice, F1rst were also required to add extra 'warning: new restrictions and ANPR' signs at and within the car park.

I believe they are either missing or poorly placed away from the prominent position they must take at a car park entrance, and you are put to strict proof if you disagree.

Kindly send me timed & dated on-site photos of your extra 'new restriction' signs and a map of where they are, when sending me your DPIA or your explanation as to why you didn't comply with that responsibility when setting up a 24/7 unmanned camera system to process personal data using ADM.

This site and F1rst Parking's conduct will be referred to the CMA without further notice. Now.

The issues for the CMA include the fact that you are obstructing complaints by laughably restricting them to 'within 56 days' and unreasonably making consumers use snail-mail when most people don't have printers.

I do, and as mentioned above, I sent a letter of complaint to the DPO at F1rst Parking dated 5/7/26, posted that day with proof of postage. These are attached. To the surprise of absolutely nobody, F1rst didn't bother to reply to my letter at all and you have only jumped now because I am involving the press and/or the two Regulators.

Do you routinely ignore complaints as well as corralling people to restrictive methods of contact and an unreasonable deadline of 56 days?

When I receive your reply about my data concerns and ADM objection to processing, I will consider that your final word and will make a separate complaint to the ICO. This isn't just about my PCN, it has wider implications, so even cancelling it now will not stop the two complaints to the Regulators.

Yours faithfully,