June 2018 - start of the new PPC and DVLA fightback (GDPR related)

sparkyhx · 14 November 2018 at 10:50PM

dont know if this has been posted but ICO say the PPC's cannot extend the deadline if all they are asking is further proof of ID.

"Can we extend the time for a response?
You can extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual. You must let the individual know within one month of receiving their request and explain why the extension is necessary.

However, it is the ICO's view that it is unlikely to be reasonable to extend the time limit if:

- it is manifestly unfounded or excessive;
- an exemption applies; or
- you are requesting proof of identity before considering the request."

Can we ask an individual for ID?
If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information.

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

Redx · 19 November 2018 at 10:25PM

Excel Data Protection Officer , from their PRIVACY NOTICE page on their website

http://excelparkingservices.co.uk/policies/privacy-notice-manual/

If you would like to know more about our Privacy Notice or wish to know what personal data we hold about you, then you will need to contact the Data Protection Officer as below:

By Email: [EMAIL="dataprotection@excelparking.co.uk"]dataprotection@excelparking.co.uk[/EMAIL]

By Post:

Data Protection Officer
Excel Parking Services Limited
2 Europa Court
Sheffield Business Park
Sheffield
S9 1XE

We may be required to establish your identity before we can release information, but once we have confirmed this we will provide the information within 1 month of your confirmed request.

I would recommend people scan their V5C or similar and add this to any SAR as proof of who is requesting this information and why you have a right to it (same with any Data Rectification Notice)

as for an SAR , the Legal Beagles website has one.

https://legalbeagles.info/library/guides_and_letters/court/subject-access-request/

Terry78 · 19 November 2018 at 10:41PM

Loadsofchildren123 wrote: »

Love this letter. Just a couple of suggestions in case it's linked as a template in the Newbies thread or elsewhere.

I am in need of a SAR to send Excel parking... is there a specific one people use as reading through this thread im a little confused as most seem to be for the DVLA? A pointer to one i can use would be appreciated

Coupon-mad · 19 November 2018 at 10:43PM

See the Legal Beagles one, on that website - Google it.

sparkyhx · 20 November 2018 at 5:08PM

just received a 'proof of ID' request - asking for Driving Licence, Passport (!!!!!!) and V5

Replying with

You seem happy enough to correspond thru this email address and accept that I was keeper of the vehicle, pass my details to solicitors and other 3rd parties, take me to court, , send emails and letters from the court.

If I am not who I say I am then you have already broken GDPR rules. Why the sudden need for further proof of identity?

May I draw your attention to the following GDPR Guidelines.

Basically, if you make it too difficult for the data subjects to exercise their rights, by creating for them unreasonable and disproportionate requirements, you will in fact infringe the very basic rights of the data subjects. This way, you risk the highest administrative fines, that is up to 20,000,000 euros, or in the case of an undertaking, up to 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher.

It is highly recommended that you do not obtain clearly more sensitive or potentially more harmful data, for the purpose of authentication, than the data that is subject to the request. If you actually need some additional information, it should be the minimum amount and only what is relevant in the given context. This is important not only because of the principle of data minimization, but also to ensure purpose limitation and fairness.

Accordingly, the highest administrative fines, as provided by the GDPR, may fall upon you.

What should be specifically avoided?
Asking for a copy of ID document, passport or other official, government-issued document, such as a birth certificate, as a standard way of verifying the identity of data subjects should be definitely avoided.

The obvious reason why is because it is disproportionate and not always relevant. The less obvious reason is that this is not considered a secure and efficient method of authentication, and the level of assurance as to the real identity of a person, in contrast to what some might think, is quite low.

So how should I authenticate data subjects to be compliant?

You should follow a few easy, yet distinct and very important rules, in order to be compliant and to meet the privacy expectation of individuals.

First, consider the context and reasonable expectations of data subjects. Basically, if some method of verifying identify was good enough when you obtained the data in the first place (e.g., you received them by email), it should be good enough when you receive a request (e.g., email request sent from the same email address).

If you persist in this request I will have no option than to report the matter to the ICO.

What do you reckon?

Info from here https://iapp.org/news/a/how-to-verify-identity-of-data-subjects-for-dsars-under-the-gdpr/

Coupon-mad · 21 November 2018 at 2:23AM

Nice one, I like that!

Computersaysno · 21 November 2018 at 9:44AM

sparkyhx...that is a great find.....

It really sums up the issues with the scumcos...they ask for fifteen proofs of id to try to stop you asking yet are happy to sell your data to low-life debt chasing scumbags and take you to court on the basis of a numberplate or emnail address...

The_Deep · 21 November 2018 at 10:16AM

I get his all the time. My cable supplier, utilities provider, insurance company, phone me up, no doubt trying to sell me something then ask me to prove that I am not an imposter. I reply you contacted me, if yo think that I am not the person you wish to speak to please terminate the call.

abedegno · 23 November 2018 at 2:50PM

Ok - so an update from the ICO on my complaint regarding parking eye - some encouraging news:

Dear Abedegno

We write to acknowledge receipt of your email and to provide an update. Thank you for your email, please accept my apologies for the delay in responding to you.

In relation to the concerns you have raised about ParkingEye’s retention periods, please note, ParkingEye has requested an extension to respond on this matter. We now expect to hear from the company by next Friday.
In relation to your ongoing concerns about ParkingEye and automated decision making, this is not a matter which we will be taking further with ParkingEye at this time. This is because we do not feel we have sufficient information to suggest there is a wider data protection concern in relation to this issue at this time, and you do not appear to have experienced a potential infringement of your information rights in relation to this aspect of your concern.

We will however continue to monitor complaints received about the organisation. Part of this monitoring includes identifying whether there are wider issues of inaccurate personal data (such as obviously erroneous PCNs) in the complaints we receive about an organisation. Where we do identify a pattern of such inaccuracies, we will consider taking further action.

Although we appreciate this may not be the outcome you were hoping for in relation to this aspect of your concern, we do hope the above information sets out how we intend to continue to monitor ParkingEye’s information rights practices going forward.

Once we have received sufficient information to provide our view on ParkingEye’s retention policy, we will write to you again.

Should you wish to discuss any of the above further please do not hesitate to contact me.

The issue on data retention is still being investigated, and ParkingEye has requested an extension and now have until next Friday to respond to the ICO.

They are not going to take further action on whether ParkingEye are undertaking automated decision making due to insufficient information, BUT the ICO advised they will be monitoring complaints received about them and consider taking further action if there appears to be a pattern of concern.

So..my call to action
Please - if ParkingEye appears to have breached your data protection rights, such as issuing a clearly invalid parking charge notice (e.g. double dipping, incorrectly matched license plate) or any other error, especially where it SHOULD have been picked up on during the "alleged" extensive manual reviewing process for each PCN please:

Complain to ParkingEye first (ICO won't take action unless you contact the company first) by emailing [URL="mailto:Privacy@parkingeye.co.uk"]Privacy@parkingeye.co.uk[/URL]
Make a complaint to the ICO using one of the forms here: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/personal-information-concerns/personal-information-concerns-report/

Thanks

Abe

Coupon-mad · 25 November 2018 at 1:54AM

BUT the ICO advised they will be monitoring complaints received about them and consider taking further action if there appears to be a pattern of concern.

So..my call to action
Please - if ParkingEye appears to have breached your data protection rights, such as issuing a clearly invalid parking charge notice (e.g. double dipping, incorrectly matched license plate) or any other error, especially where it SHOULD have been picked up on during the "alleged" extensive manual reviewing process for each PCN please:
Complain to ParkingEye first (ICO won't take action unless you contact the company first) by emailing Privacy@parkingeye.co.uk
Make a complaint to the ICO using one of the forms here: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/personal-information-concerns/personal-information-concerns-report/

Seconded!

If everyone who received a double dip PCN reported the ANPR scammers to the ICO, the ICO can in fact stop the company from using ANPR until they can put their house in order.

June 2018 - start of the new PPC and DVLA fightback (GDPR related)

Comments

Categories

Get our FREE Weekly email full of deals & guides - and it’s spam-free