First Parking PCN at Newborough National Nature Reserve - WON! - ICO complaint

Coupon-mad

Send that first then (without waiting) go and read the CMA's Open Letter to the parking industry (in the national news last week):

https://www.gov.uk/government/news/parking-charges-cma-takes-action-to-drive-improvements-for-motorists

Take the time this week to email the CMA with your summary of issues (and pictures, the map, F1rst's signage and their webpage forcing people to use post for complaints and restricting them to 'within 56 days', etc.) as evidence.

Tell the CMA you a will be raising the ANPR/surveillance & data use concerns with the ICO separately but strongly feel that this is also an appalling example of:

• unfair complaints policy which offends against good faith and open dealing;
• inadequate consideration period. Especially given that the camera records cars and unfairly starts the 'period of parking' 1.2 miles before the car park;
• extremely wordy signs with very small print, with a confusing '70p per 20 minutes' way to have to self-calculate the tariff. So, consumers can't make a decision on whether to accept the parking contract (or just leave without accepting it) until they have either fully downloaded the app and started a parking session, or joined the long queue at the machine. And it's unclear how to calculate extending initial time and drivers are unlikely see the 'afterthought' small print about the £100 PCN risk, which only says a charge "will be issued" which isn't a contractual term (the sign should say: by parking and being afforded a fair opportunity to accept these terms, the driver agrees to pay £TARIFF per hour and/or a parking charge notice of £100 in the following circumstances…"). 
• ambiguous and unfair terms. The signs used to offer 30 minutes free parking, with charges only applying after that. Since the ANPR cameras were added, they are pretending that there isn't "30 mins free parking" any more. The cameras are now starting the clock 10-15 minutes early & calculating total STAY, 1.2 miles back along the road, yet the new signage says that you're charged "for the time you park";
• Disability concerns: it says on the sign: "FREE for Blue Badge Holders (see the accessibility information for more details, but what info, and where?)"
• unjustified use of cameras with (seemingly) no DPIA and no Disability Impact Assessment, yet they now requirie blue badge holders to 'register' as well as display their badge. This means that the parking firm is collecting and processing 'special category' data without the double justification set out in the DUA Act 2025, and is requiring disabled people to take extra steps, purely because First Parking 'want' to run the site remotely with no-one checking blue badges on foot. That isn't a lawful reason to use ANPR and a system that collects identifying data related to health (that is more one for the ICO, but throw it in).

Tell the CMA as well please:

First Parking are a large BPA member who typically operate ANPR at mixed-use, sprawling sites with multiple different parking areas (and very different rules for motorists within each car park) including many UK Universities. These sites include not just pay and display areas but also staff offices, gyms, shops, libraries, lecture theatres, student residences and doctors' surgeries (e.g. the University of Sussex).

F1rst only seem to place cameras & entrance signs on the peripheral approach roads, up to a mile away from the various parking spaces and rules, which cannot be right. Surely, if each different car park area has different rules, these require a separate camera and entrance GDPR rights & terms signage on site, not just on the first road used in fast traffic turning off the public highway.

As such, and not least due to the evidence of a wholly unfair calculation of parking time at this beach car park and the obstructive complaints policy, investigating this firm could be a valuable lesson for the parking industry. You suggest the CMA should now investigate F1rst Parking's set up at nature and leisure destinations like Newborough National Nature Reserve, as well as finding out how they are monitoring Universities and whether the systems are fair for the mixed users.

CMA Contact emails (use both, the first one goes directly to their parking investigation) :

parking@cma.gov.uk

general.enquiries@cma.gov.uk 

piggypower

will do, thanks again for excellent guidance.

I'll keep everyone posted with any development.

piggypower

REPLY FROM NRW;

"

27th July 2026

Dear Mr Annoying

RE: Email dated 9th July 2026
Thank you for your email of 9 July 2026 in which you raise a number of concerns regarding
the operation of the ANPR parking management system at Newborough, including:

• the location of the ANPR camera;
• the transparency and fairness of the processing;
• the adequacy of privacy information and signage;
• the existence of a Data Protection Impact Assessment (DPIA);
• the lawful basis for processing vehicle registration data;
• the consideration of objections to processing;
• the use of any automated decision-making; and
• the respective responsibilities of Natural Resources Wales (NRW) and First
Parking.

We note that your correspondence also contained a number of concerns that fall outside
the scope of data protection legislation. These matters have already been considered by
NRW through our complaints process, and our Complaints Team set out NRW's position in
correspondence dated 17 July 2026. This response addresses only the specific data
protection issues raised in your email, and NRW has no further comments to make
regarding the matters previously addressed through the complaints process.

Having considered the matters you have raised, NRW's position is that it is not the Data
Controller for the ANPR parking enforcement activity which forms the subject of your
complaint.

Under the contractual arrangements in place, First Parking determines the purposes and
means of processing personal data collected through the ANPR parking management
system and acts as the Data Controller for that processing activity.

This arrangement is consistent with First Parking's data sharing arrangements with the
Driver and Vehicle Licensing Agency (DVLA), under which First Parking is responsible for
obtaining and processing vehicle keeper information and for complying with its obligations
under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act
2018. Responsibility for addressing matters relating to:

• the lawful basis for processing;
• transparency and privacy information;
• the location and operation of ANPR equipment;
• the handling of objections to processing;
• any automated decision-making;
• compliance with data protection legislation; and
• any requirement to undertake a Data Protection Impact Assessment,

rests with First Parking as the Data Controller.

We acknowledge your objection to the processing of your personal data. However, as
NRW is not the Data Controller for this processing activity, any consideration of that
objection must be undertaken by First Parking.

In response to your request for a copy of a DPIA, NRW does not hold a DPIA relating to
this processing activity. Responsibility for determining whether a DPIA is required, and for
completing and maintaining any such assessment, rests with First Parking as the Data
Controller.

As NRW is not the Data Controller for the processing activity in question, we are unable to
provide substantive responses to the specific data protection concerns set out in your
correspondence. These matters should be directed to First Parking.

NRW considers its handling of the complaint complete and has no further information to
provide on the data protection matters raised.

Should you remain dissatisfied following First Parking's response, you have the right to
apply directly to the Information Commissioner for a decision:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
www.ico.org.uk

Yours sincerely,

Eira Owen
Lead Specialist Advisor, Information Management and Security

Croesewir gohebiaeth yn Gymraeg a byddwn yn ymateb yn Gymraeg, heb i hynny arwain
at oedi.Correspondence in Welsh is welcomed, and we will respond in Welsh without it leading to
a delay.

"

Seems to me they are trying to wash their hands of it and pass the buck to F1rst Parking.

Absolutely spineless tbh

GrannyKate

Interested to know what others think but I don't think such wholesale washing their hands of any DP accountability is correct. They refer on websites etc to this new scheme being a partnership with the parking company. NRW collects information on exemptions, blue badges etc, local season tickets through their Hub and presumably passes that to First Parking. There is also the issue of the use of camera data to manage traffic leaving the site at busy times - how is that working? Public service contracts require sections about compliance with DP and other legislation and it should be a matter of concern to NRW if their contractor is not complying with the law. You could ask for the contract and records of how it is being monitored for compliance under FOIA.

piggypower

Reply from F1srt Parking to my letter of complaint;

IN essence, we confirm that we are doing everything to make it as easy and profitable to give out PCNs, and if you dont like it, complain to the ICO.

They also seem to refer to the landowner …. its public land?!

Am I wrong?

Jame4ters

The landowner is NRW

Jame4ters

The First Parking response reads to me like we know we are pushing the boundaries and have probably overstepped but we don’t think that you will take these issues any further so we’ll just continue as it already is

Both NRW and First Parking are paying lip service. One maybe out of being naive the other maybe deliberately

piggypower

going from here.. I am guessing its await CMA reply (none as yet)…

Await F1rst Response to the appeal, already overdue from their time frame they provided…

Complain now to the ICO?

I mean, I sort of knew, but to see how NRW and F1rst Parking just simply don't care and provide paragraphs of word salad to try and get rid of the issue, is diabolical… I am starting to see the bigger picture with PCNs.

Appreciate everyone's input but would love to hear @Coupon-mad thoughts at this stage.

Coupon-mad

You don't get a CMA reply except maybe an auto-receipt. That was about giving them evidence for their possible investigations.

I'm really glad you sent it. These reports need to fly in this Summer.

"Complain now to the ICO?"

Yes, this is a bit different because you will get a response about your case.

Show the ICO that you have exhausted F1rst Parking's complaints procedure and show them the map and evidence that this is unlawful use of ANPR surveillance cameras in completely the wrong place.

Also link them to the CMA's open letter to the parking industry and show them that complaint you made to the CMA (because the ICO might not be up to speed with - or know at all - what the CMA is investigating about unfair consideration periods when ANPR is used) and say this might need a multi-agency investigation, urgently.

The ICO will reply because reporting a company to them for a data concern is something they will look into for individuals.

CMA investigations are broad but with massive clout. They can fine companies.

ICO complaints are case-specific, so they will come back to you.

Try hard to impress the idea that this needs some serious joined-up thinking and a multi-agency investigation into lack of fair 'consideration time' as cars arrive. It's not just at this site; generally the parking sector is using ANPR as a 'first resort' and it is out of control. Clearly this place could (it did) operate with a manned kiosk, so contrary to ICO rules, ANPR here wasn't justified except on mere cost-saving grounds but this operator has created a 'ring of steel' around the forest & beach car parks.

This cannot be legal and the ICO really need to discuss this wider issue with the CMA and MHCLG urgently, as well as scrutinise the issue at this particular site, where the ANPR images are being taken 1.2 miles away, which artificially and inaccurately extends the 'parking period'. PCNs are being issued that would never be the case if the site continued to be manned at a kiosk.

piggypower

https://forums.moneysavingexpert.com/discussion/comment/82089568#Comment_82089568

ok, great info again.

Indeed agreed about the cost saving.

PCNs also would be massively reduced if not irradicated if the carparks were manned or ANPR cameras were at the entrance/exit of each carpark.

I am genuinely shocked how pathetic of a response we got from NRW, considering its not just some public land owner or shopping centre.

Expect more threads/posts about this as on FB group for the area, so many are getting PCNs, getting appeals rejected by POPLA unfortunately, likely because the individuals dont fully know the law.