Taking PPC to court

[steveod]

any advise welcome.

 

I received a PCN from a PPC.

I appealed to them and got standard "get lost" template response In this appeal

 

I told the PPC to stop processing my private data as they had obtained it unlawfully from the DVLA due to the non compliance of POFA, BPA CoP and DVLA contract.

 

I appealed on fact that PCN not PoFA compliant, not BPA CoP compliant and single sign with t&cs was not visible.

 

then Appealed to POPLA on above points and many others such as no contract, etc, etc

 

POPLA upheld my appeal without addressing any of the points except the first one of not PoFa compliant.

 

wrote to PPC and told them again to stop processing my data and confirm within 21 days removed from their systems.

no response from them.

 

I have now issued small claims for the damages I suffered

- petrol to go visit the site to photograph the sign and layout,

stamps,

envelopes,

parking to post,

electricity usage on computer, etc

in amount to £400.

plus £400 damages for distress under DPA.

 

They are defending saying they had "reasonable cause" to obtain my private data and that Section 35(1) of the DPA applies which allows the DVLA and the PPC to process the data due to the Road Vehicles Regulations Act 2002 27(1)(e).

 

Besides the fact that I think that the definition of reasonable cause by the DVLA is arbitary as they change the definition whenever they see fit and its not defined in legislation and therefore does not meet the requirements of the EU Charter of Fundamental Rights(another whole story ongoing with the ICO for 4 months now!), I believe the PPC is not allowed to process my private data under the Section 35(1) exemption of the DPA,

 

in my opinion, taking the Supreme Court case in The Christian Institute and others (Appellants) v The Lord Advocate (Respondent) (Scotland) into account:

http://www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKSC/2016/51.html&query=("section+35")

Paragraphs 56 and 57 are the most relevant.

 

the reasonable cause provision under Road Vehicles Regulations Act 2002 27(1)(e) is not a statutory obligation and so does not meet the DPA Schedule 2 requirements.(para 57)

 

And paras 3 and 5 of Schedule 2 of the DPA also do not allow the release of private data to the PPC due to the fact that the PPC is not processing the data as a function of a statutory duty. This is also subject of a complaint with the ICO.

 

(para 56)

 

any other thoughts or points I can use to ensure judgement goes my way?

[BankFodder]

I don't have much time for detail here – but two quick observations: –

 

£400 for distress seems pretty excessive to me and you are unlikely to get it unless you can really particularise your suffering.

 

I'm not at all sure that "reasonable cause" is grounds for accessing or processing your personal data. I would say that the requirement is much stricter than that and would have to amount to "lawful authority" which would include authorisation by you as a result of some contract.

 

I would urge you strenuously not to ruin the chances of a very nice satisfying little victory against these people for the sake of becoming overambitious (read – greedy) about the level of damages.

[steveod]

Hi Bankfodder

 

I understand perfectly what you say - and you are probably correct.

 

But, I have read many cases(read over 30), both UK and EU data protection related and in the majority where 1000s have been claimed,

 

I have seen numerous where eventual judgement of +-£750 has been ruled as reasonable even though the distress would be similar to mine. therefore, I feel £400 for the PPC total lack of regard for the distress I have had to incur in their threats of legal action and demanding money they were not entitled to all because they unlawfully obtained and processed my data.

 

I dont have to provide a breakdown of the distress I have suffered, it is sufficient I have suffered distress. Even if the court awards a slightly smaller sum at least it will go some way to rectify this. Is it not too late now to reduce the amount I want to claim anyway as I have listed it on the PoC?

 

"I'm not at all sure that "reasonable cause" is grounds for accessing or processing your personal data."

 

this is not what the PPC and the ICO have told me

- they state reasonable cause( Reg 27(1)(e) is an exemption under the DPA Section 35.

 

 

I have numerous correspondence with ICO in regards this matter and I am busy preparing case for the GPR to take the ICO to as I believe the ICO are not interpreting the DPA correctly and seem to have the belief that the DVLA are always correct and can do what they want with RK details.

 

"and would have to amount to "lawful authority" which would include authorisation by you as a result of some contract."

 

as simply the RK I did not agree to any contract and so did not give any lawful authority and it is not within the drivers lawful authority to allow someone else access to my private data.

[ericsbrother]

can you produce a schedule of loss that adds up to £400? If not you will lose.

5 hours time at LiP rates would be about the best you could hope for.

 

 

As for damages for distress

- have you quantified that by any method such as the Vento scale?

 

 

Do you already suffer from a disorder that has been exacerbated by their actions?

The bar is necessarily set very high for a cause for action in harassment cases,

even criminality may not reach this threshold so carefully look at what you are claiming for and be prepared to properly justify it with case law reference.

 

The DVLA has its own rules for computer access via KADOE so they wont have honestly applied for your details,

the bit quoted is for paper access

(where anyone can write in and get the details if they have a reason to do so)

go after them for making untrue statements if they have used the electronic system and POFA as claiming keeper liability.

 

The IPC/IAS always say they arent using POFA but their clients still tick a box saying they have casue under that law to access KEEPER details and they havent been disbarred for making untrue statements as i doubt if enough people have complained and followed it up properly to make the DVLA investigate.

 

 

That will involve the ICO and they like to give stock responses as well because it is all too embarrassing becuase although probably unlwful, it is seen as the will of parliament.

[steveod]

Schedule 2(2)(a) states:

The processing is necessary—

 

(a)for the performance of a contract to which the data subject is a party, or

 

as above, I did not enter into a contract with the PPC as simply the RK. PoFA does not make the RK a party to any contract, it just holds the keeper liable in the event all of the conditions of PoFA are met and the driver hasn't paid the parking charge. In my opinion the DPA, the Eu Directive on Data Protection and private rights under the HRA & ECHR all take precedence or must be complied with first, before the conditions under PoFA are available.

[ericsbrother]

every bit of EU law has the word except in it. that allows the country to use its own domestic law to slot in the new directives.

[steveod]

can you produce a schedule of loss that adds up to £400? If not you will lose

 

I can including costs of postage, envelopes, petrol travelling to the parking site, electricity usage on computer for the time researching and compiling the letters re the PCN and the DPA compliance, etc

They were not litigating against me, they just sent a PCN so none of the writing or appeals had anything to do with litigation, and POPLA is not even a valid ADR entity. Wouldn't lose anyway but court may award a lesser figure.

 

As for damages for distress- have you quantified that by any method such as the Vento scale? Do you already suffer from a disorder that has been exacerbated by their actions? The bar is necessarily set very high for a cause for action in harassment cases, even criminality may not reach this threshold so carefully look at what you are claiming for and be prepared to properly justify it with case law reference.

Not going for damages for harassment, purely damages under the DPA and their breach thereof. I have a number of cases where it is stated that there is no requirement to provide an assessment of the distress caused, it is for the court to decide the damages based on the breach by the party that unlawfully processed the data.

 

@ericsbrother, yes, that is why I referred to Section 35(1) of the DPA. and the Supreme Court case. And when a court interprets any UK law it must be interpreted in a way that gives effect to the provisions of the EU law.

well for next 2 years anyway lol.

[ericsbrother]

no but you are litigating against them.

You cant just amke things up,

 

 

courts are there to settle matters by putting you back in the position you would have been if they parking co hadnt done you a wrong.

 

 

You cant make a profit from this so that is why I say you need to get this right.

 

 

If you claim for $400 costs is wide of the amrk you will get nothing and may end up with their costs to pay so be realistic and do a proper schedule of loss.

 

 

If you win only a penny in damages they still have to meet your costs of the action itself so again LiP preparation costs can be added.

[steveod]

I agree I am litigating against them now.

but the amount of £400 is for the damages I suffered (which I have a full breakdown of) as a direct result of them unlawfully using my private data prior to the POPLA decision and for procssing my data after the POPLA decision even.

I am not claiming for the time preparing my litigation at all. that I will leave for the court to decide if entitled to LIP costs.

 

As you state, if they hadn't unlawfully obtained my data from the DVLA,

hadn't continued to process my data when i requested them to stop as they had no right to it,

then I wouldnt have had all the expense of the petrol, parking, envelopes, stamps, electricity and my time(which was not time spent in any sort of litigation but in obtaining and providing information to dispute their right to invoice me).

 

maybe I wont get all the £400 but I have a detailed breakdown so even if i get them to settle for half its a result.

[BankFodder]

I've just had a look at section 35 of the DPA and I think that they are probably right

[steveod]

I've just had a look at section 35 of the DPA and I think that they are probably right

 

why? in what sections are they right? did you look at 56 and 57 of the SC case? I don' think they are right. the DVLA can only provide private data to persons that have a statutory right to process the data eg police, council, NHS etc.

 

why? in what sections are they right? did you look at 56 and 57 of the SC case? I don' think they are right. the DVLA can only provide private data to persons that have a statutory right to process the data eg police, council, NHS etc.

 

In 56,

The test imposed by condition 5(b) in Schedule 2 and condition 7(1)(b) in Schedule 3 to the DPA requires that disclosure must be “necessary” for the exercise of statutory functions (which must again refer to the functions of the person to whom the disclosure is made,.....

It does not refer to the statutory function of the dvla but of to whom they release the data. That is where the ico is making the error.

 

In 57, Condition 3 in Schedule 2 is not satisfied, since the disclosure does not have to be necessary for compliance with any legal obligation imposed on the data controller. Condition 5(b) in Schedule 2, and condition 7(1)(b) in Schedule 3, are not satisfied, since the processing does not have to be necessary for the exercise of any of the named person functions

 

Condition 3 - since there is no obligation under the road vehicle regulations for the dvla to release data except in their own interpretation of reasonable cause, then condition 3 is not met.

Condition 5 - processing is not required for any of the statutory functions of the ppc - they don't have any

 

Of course all above only my opinion and I could be wrong. So welcome comments

[steveod]

Well, I have applied the same reasoning to my latest letter to ICO so will wait and see how they respond.

[posiDom]

I was reading this thread with interest (before posting about my own related stuff)... but then it just stops. Any updates?

[BankFodder]

I'm afraid that a lot of people come here for help and then never update ask as to what has happened. It's always very disappointing and of course it doesn't give much of a nod to the people who take interest and try to help out. But that's the way it always has been.

 

Start up your own new thread and tell us all about it we will do our best to help you – and of course it would be nice if you kept us updated

[dx100uk]

the OP champions people all over cag to this day to standup for themselves on GDPR...wonder why this thread has no resolution...