Hospital parking FOIA

GrannyKate

I thought I would share the answers I received to a FOIA request made in June to a large NHS Trust - I won't name them as I have no axe to grind with them and they were chosen at random. It did, however, require a section 10 notice from the ICO to get an answer - rather more to do with their appalling response record for FOIAs across the board than my topic.

I was interested in the governance of the parking contract and the impact of engaging with PALS where parking tickets have been issued wrongly or where there are special circumstances as I always recommend this route to posters. I am aware though that for some other Trusts things like PFI contracts seriously hinder their freedom to intervene.

Questions 2&3.

2. Please can you state how many formal and informal complaints (PALS) enquiries you have received relating to parking at any of your sites for the last 2 years
3. Please can you advise how many of the above resulted in the cancellation of PCNs.

They confirmed that in the last 2 years PALS have been contacted in 186 cases and this has resulted in 83 parking tickets being cancelled. This is quite a significant number of cancellations but I don't think we can infer that these were all wrongly issued rather that the Trust took special circumstances into account. It does, however, confirm my view that this should be Plan A for people who feel they should not have been ticketed at an NHS site.

Question 1) A recent response includes the statement - the Trust oversees the contract and receives high‑level assurance information - please can you provide information on the manner in which the contract is overseen and what high level assurance is received. This should at the very least cover evidence of compliance with NHS Car Parking Guidance 2022

The Trust oversees the supplier's contract through a formal governance framework where high-level assurance is provided. This is provided through:

·      Monthly contract review meetings chaired by the Trust, with a structured agenda 

·      Regular supplier management reports including KPI data 

·      Ongoing monitoring and action tracking, ensuring issues are identified, escalated, and

resolved within agreed timescales

·      Oversight of complaints, patient experience, and operational data

·       Reviews of business continuity, information governance, and system performance

The Trust's parking policies set the compliance to NHS Car Parking Guidance for which the contracted services align and support, including alignment to free car parking for those with the greatest needs, the Trust's own arrangements towards concessions and voluntary elements, and contracted-out car parking, where the supplier are members of the British Parking Association (BPA) and Approved Operator Scheme (AOS).

My last question relating to Information Governance and DPIAs got a rather wordy answer and I'm not sure I agree with their reasoning but it is interesting.

Question . A parking contract with an external provider allows a non NHS provider to come onto your site and obtain registration details for vehicles belonging to patients and their families. The KADOE contract with the DVLA then allows the contractor to obtain names and addresses of the legal keepers of the vehicles. This means you are facilitating a third party to obtain highly sensitive data (hospital attendance) over which you apparently have no control. Please can you provide a copy of the mandatory Privacy Impact Assessment that was completed and risk assessed before the latest contract for car parking was agreed. I am particularly interested in any discussion relating for the potential for third parties to be made aware of someone's attendance at a health facility without their consent.

XXX NHS Foundation Trust sites are multifunctioning in the activities taking place on site, this is therefore reflected in those using the car parks. On XXX sites and in addition to patients, car park users include but are not limited to  visitors, Trust employees, non-trust tenants, other Trust's employees and visitors, educational spaces users, training facility users, arts and music event visitors, contractors, and volunteer drivers. Therefore, the collection of Vehicle Registration Numbers alone is not sensitive in relation to translating to hospital attendance, in addition to this there is no cross referencing of the ANPR data with any patient systems or data. 

The Trust maintains copies of Data Protection Impact Assessments where we are the Controller of data. The Trust is not the data controller for the ANPR system as such the Trust does not hold a DPIA for the processing of data by the ANPR system.

 All data held and collected through the ANPR system is done so in accordance with Information Commissioner’s Office guidance and in line with BPA best practice guidance. The supplier is an Approved Operator of the British Parking Association, is fully compliant with the Data Protection Act 2018 (DPA), holds Cyber Essentials Plus trademark and is reviewed through the NHS Data Security and Protection (DSP) Toolkit process having achieved 'Standards met' against Version 8 of the standard in June 2026.