Appeal advice for NTK received pls

Coupon-mad

Here's a section from a defence that I wrote for a friend where the site had no GDPR Privacy Policy sign at the entrance:

1. For an ANPR system to legally function under current Information Commissioner's Office ('ICO') rules, the GDPR sign must satisfy both the CoP and data laws. These require: -(a) clear disclosure that ANPR/CCTV enforcement is in use before the recording field begins -(b) the exact identity of the operator (data controller) and -(c) direct contact details or a URL/QR code to the full privacy notice which details the individual's right to object, request human intervention, or challenge ADM.

2. The Claimant has breached the 'data use' information requirements. Articles 13 & 14 of the UK GDPR defines the right to be informed, which requires organisations to provide clear, concise, and honest privacy information to individuals about how their personal data is collected and used. Before entering the site.

3. Under the ICO's transparency framework, the entrance signage must serve as a Layered Privacy Notice. To meet the ICO’s standard for ANPR-driven automated environments, the signage must deliver specific information before the driver passes the camera.

4. It must be clear at the site threshold, that an automated camera tracking system is in use to calculate parking terms. It is not enough to mention that later, in small print on any signs within. The lack of UKGDPR entrance warning, data use and privacy information is a 'misleading omission' which contravenes the Private Parking Sector Single Code of Practice ('the CoP') as well as consumer protection and data use laws.

5. If the entrance sign fails to direct the motorist to a data controller identity or privacy policy detailing their rights, the data collection fails the core legal principle of being "fair, lawful and transparent".

6. Further, under the ICO's guidelines, if an ANPR system automatically calculates a stay and triggers a PC by mail without meaningful human review, it is Automated Decision-Making ('ADM') with significant and/or legal effects. This invokes high-threshold transparency duties under the UK GDPR (amended by the Data (Use and Access) Act 2025). The intersections between ANPR with ADM and transparency obligations create distinct layers of compliance under ICO surveillance camera rules.

7. Further and in addition, the Competition and Markets Authority ('CMA')  have stated that a lack of transparency and a failure to provide material information breaches s227(2) of the Digital Markets, Competition and Consumers Act 2024.

—————————————————

You can use that wording to send an 'objection to ADM and further data processing' to Euro Car Parks' DPO (and attach the proof of paying at the machine) and insist they:

• cancel the PCN or you will escalate the complaint to the ICO, and will encourage the ICO to note - and liaise with the CMA about - the current consumer protection investigation already opened against ECP, and
• you also require ECP to erase your data forthwith.

You can also throw all that into a separate 'appeal'. They are two different things.

MyMSEName

https://forums.moneysavingexpert.com/discussion/comment/82102445#Comment_82102445

Thank you Cm, that's impressive.

So just to confirm. I am to send the objection, with the suggested add-ons to the ECP DPO email address.

And send the same objection via the ECP appeal process, being the registered keeper.

Coupon-mad

Yes, make 'em sweat!

MyMSEName

https://forums.moneysavingexpert.com/discussion/comment/82102502#Comment_82102502

Haha, hopefully yes.

Many thanks.

MyMSEName

Update:
I emailed ECP's DPO at the weekend, and had 'fun' trying to fit the same info' into the ECP's -I assume- purposely limited, word count, appeals process!

Anyway, I managed to fit in what I thought to be the most salient points, and at least it's done now.

I will provide a further update as soon as I get a response in the next 28 days.

Thanks again for your help.