LoC to NCP for failure to supply SAR ***Paid in full***

[MoaningCrusader]

I am starting a new thread now. Thanks for the heads up FTMDave.

 

Also, FYI I have not received any SAR stuff back from NCP for this PCN.The SAR request was sent on 3rd August. Is this normal.

[FTMDave]

No it's not normal, and as long as you have proof of postage you can sue them for not responding to the SAR.

 

There is someone on the site who has sued Virgin, and won, for exactly this.

 

Have a think about whether you want to go down this road.

[MoaningCrusader]

I am very interested. I've had enough of all this, so any compensation for all this hassle over a paltry £5 charge (that had they simply asked me to pay again, I would have).

 

I'll give them until the end of the month and then look to proceed with this process. I have the free proof of postage for the letters sent to both NCP Head Office in London and their PO Box in Manchester.

 

Should this action be successful I can assure you I'll donate some of the amount received to this site.

[FTMDave]

That seems watertight then.

 

Personally I wouldn't wait till the end of the month.  They've had 30 days and obviously can't be bothered to respect their statutory duty.

 

This is particularly disgraceful given they are suing you and couldn't be pestered to get back to you after your phone call where you were trying to sort the whole matter out.  Which of course is why you want a reply to the SAR, to see what they have noted about the phone call.

 

The Virgin thread is here  https://www.consumeractiongroup.co.uk/topic/428408-virgin-mystery-extra-line-2-judgments-for-data-protection-breaches-so-far/#comment-5077084

 

In post 17 there is a drafted Letter of Claim that you could easily adapt.

 

@dx100uk I vaguely remember in another thread that you suggested some sort of belt-and-braces contact with the ICO.  Is this right?

[MoaningCrusader]

I'll got to work on this right away.

 

I'll check the virigin thread out. Any further advice from dx100 will be welcomed.

[FTMDave]

@dx100uk  I vaguely remember in another thread that you suggested some sort of belt-and-braces contact with the ICO.  Is this right?

[dx100uk]

They are the ones that control/rule on data issues/matters.

Sometimes a quick call or report to them that xxx has ignored your sar works wonders.

 

Not so much with regard to private parking i dont think,  but we've seen complaints made about consumer credit matters whereby data appeared within days or at least the perpetrator was on the phone quickly grovelling.

 

Dx

[MoaningCrusader]

I do feel in the mood to sue them for breach of statutory procedures resulting in considerable stress and expense to myself.

 

Would there be any legs in this?

[FTMDave]

I don't see how they could possibly defend.  They haven't replied to your SAR.  You have proof.

 

The steps to take would be easy enough.  1.  Letter of Claim which is nigh-on prepared on the Virgin link.  2.  Start a claim through MCOL, where you are already registered, with a short paragraph as Particulars of Claim and forking out £25 which you will get back if you win.  3.  At that point they will either ignore the court papers and lose by default after a fortnight or run to the parking association's solicitor and desperately try to defend, but I don't see how they can.

 

I suggest, firstly complaining to the ICO as dx suggests.

 

At the same time post a draft of your LoC here.  I know it will be almost identical to the Virgin one, but I'd like to flag it up and have Site Team members more experienced than me have a look.  The vast majority of motorists we get here are just glad to get rid of the ticket, hardly anyone wants to take revenge, even though it would be quite easy, so best we are absolutely sure that the letter is OK.

[FruitSalad1010]

11 hours ago, MoaningCrusader said:

I'll give them until the end of the month and then look to proceed with this process.

 

You should not delay in raising your complaint to the ICO.

 

Any claim you intend to bring would presumably be on the basis that their failure to comply with their statutory duty has caused you distress.

 

If you wait to raise your concerns with the ICO or bring an action this could indicate that, while their failure to respond to your request is a breach of statutory duty, you are not particularly put out by it.

 

I would imagine given that you have been threatened with legal proceedings that you would want to review all of your personal data as soon as possible.

 

It is not unimaginable that you may wish to seek the opinion of the ICO first before bringing any action, and in that case I expect you would argue that you delayed your action in order to seek their opinion.

 

However, the response of the ICO will come in stages. First, they will write to the data controller of the company you complained about informing them they have more work to do.

 

The response you receive from the ICO can depend very much on the case officer who responds to your complaint.

 

It may be many months before you are able to secure their opinion that NCP are unlikely to have complied with their data protection obligations.

 

The overall impression the ICO gives out is that they don't really want to deal with your complaints, partly because they expect parties to resolve their disputes without their involvement.

 

The ICO could of course help reduce their own case load by responding more forthrightly to companies that do not adequately respond to the complaints they receive and thus invoke the involvement of the ICO.

 

If you are confident in your position that NCP have failed to respond to your request in accordance with their statutory duty, then while a supporting opinion of the ICO would certainly benefit your claim it, the lack thereof is unlikely to undermine it.

Edited September 8, 2022 by FruitSalad1010

[MoaningCrusader]

Thanks FTMDave & Dx100.

 

I will get the IOC complaint off this morning. Should I wait for a response from them before sending the LoC to NCP/BWLegal?

 

I have redrafted the LoC (see below)

 

Dear Sir/Madam

 

GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST

Parking Charge Notice Number: XXXXX

 

To whom it may concern,

On Wednesday 3^rd August I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply.

You have now breached your statutory duty. It has caused me a great deal of distress not having my data in order to understand the problems you have caused by the failure of your systems and your charging process, together with the necessity to chase after you to get this disclosure..

You have 14 days to respond, after which I shall begin a County Court claim against you.

 

Yours faithfully

 

 

Can I also ask, is there any particular way I should word my complaint to the IOC. I have a copy of the initial SAR letter I sent on 03-08-22 and I have the free PO proof of postage receipts. This letter was in fact sent to NCP & BWLegal offices. BW Legal has also not responded (although to tbf the letter is address to NCP Head Office, will that get them off the hook).

 

 

[MoaningCrusader]

Guys,

 

I am on the IOC website at present. 

 

Is there a case that I have two issues:

 

1. They have failed in their statutory duty to disclose all data they hold on me.

 

2. I am raising concerns on how they have shared my data. As the NTKs were clearly served well out of the time frame laid out in POFA2012. Does this mean they have misused my data?

 

I can only select one option of their two given to describe the nature of my complaint. But I could bring up my 2nd concern while supplying the letter dated 03/08/22 with the proof of postage receipt.

 

Sorry for all the questions.

 

Are we not escalating to LoC a little too quickly?

 

Should I not be sending them a reminder first? 

 

The IOC does ask on their website, 

 

Have you raised the concern with the organisation?

 

Technically, I have not raised my concerns for them not responding to SAR yet.

 

In fact if I send the LoC before doing so, could it not be deemed a little unreasonable by the IOC.

 

I would lean towards arguing the 14days to respond to the LoC is reasonable enough.

 

I assume you guys will too. But I am just checking.

 

 

[honeybee13]

I expect the guys will be along later to help.

 

See what they think, but we know that the ICO don't reply quickly and Fruitsalad gave you a lot of detail on that a couple of days ago. I don't know if a letter before claim would focus NCP's minds.

 

HB

[dx100uk]

ICO will not be interested in pofa etc. Failure to supply data 

 

You could ask 

 

Dx

[FTMDave]

I don't think we're escalating too quickly.  You have already given them two chances to respect their statutory duty and they have ignored you.  The LoC is a third chance, it's not actually the start of court action, it's a warning that court action is imminent, so all they have to do to avoid court is get their act together.

 

Also, what is the context of you wanting this information?  Because NCP have started court action against you.  Time is of the essence, a court case is happening.  The least they can do is provide the information they have on you.  Especially as you bent over backwards by phoning them to try to sort things out.  In fact the whole point of the SAR is to see what they have on record about the phone call.

 

Hang on a little while and let me get the LoC checked by Site Team members who are vastly experienced with these things.

 

I think with the IOC it's simply option 1.

 

Once your e LoC is okayed and sent, I'll split these posts off into a new thread as there will be two separate claims happening (although ultimately connected of course), NCP v you for the drop-off invoice, and you v NCP for failure to reply to a SAR.

[MoaningCrusader]

Ok guys. Thanks for clarifying.

 

I was pretty certain of your answers anyway. Just checking.

 

Just to clarify from my end, I have only sent 1 SAR letter on 03-08-22 copied to 3 recipients NCP Head Office, NCP PO Box & BWLegal, nothing else. This will be the second letter in regards to SAR, and will be an LoC. Shall I just send it to NCP and not BW Legal as well?

 

I will await final ok for the LoC.

[FruitSalad1010]

You need to change the underlined header from GDPR.. SAR to Letter Before Claim.

 

Keeping the contents as close to the one on the Virgin thread while making minimal adjustments to suit your circumstances is probably best.

 

Do not conflate the two complaints with the ICO.

If you also wish to seek an opinion from the ICO regarding the use of your data by NCP raise it as a completely separate complaint.

 

Using the letter of claim as evidence that you have followed up your request is sufficient, send it before submitting your complaint.

 

Once you have sent your letter of claim then submit your complaint to the ICO.

 

The checklist the ICO website makes you tick through is simply a box ticking exercise, ultimately you don't have to use it and could raise any complaint you wish directly with the ICO in writing or via e-mail.

 

However like all of these "arbiters" they are more focused on reducing their case load using any excuse they can find rather than seeing justice done. Not pigeon holing your complaint to fit their criteria will likely be used by them to delay the whole process or not respond at all.

 

Looking deeper, I think that although the ICO ask you to provide evidence of following up with the organisation, there is nothing stopping you from simply requesting that the ICO provide their opinion on the matter.

 

When pressed there is little stopping the ICO from providing an opinion regardless of what contact you have had with the organisation you are complaining about.

 

Again they are loathe to do this and yet if they did they would likely find by better supporting those that have a legitimate complaint, that over time the number of complaints they receive would decline as organisations get better at complying with their data protection obligations.

 

14 days to respond to a letter before claim is standard practice as laid out in the PRACTICE DIRECTION – PRE-ACTION CONDUCT AND PROTOCOLS for civil claims at paragraph 6 (b).

 

I think it would be a good idea to become familiar with as much as you possibly can or at least refer to the civil procedure rules first where you are unsure. This is not to make your life more difficult but rather it will certainly make you more confident in your position going forward.

 

NCP and BW Legal are two different organisations. If neither have responded to your SAR then they have both breached their statutory duty however I think it was stated before that BW Legal are unlikely to hold a significant amount of your data and where they do it will have been passed to them as an agent of NCP.

You want your data from NCP and personally I would stay focused on them.

Edited September 9, 2022 by FruitSalad1010

[FTMDave]

3 hours ago, MoaningCrusader said:

Shall I just send it to NCP and not BW Legal as well?.

I should think just one copy to NCP's head office will suffice.  FruitSalad is spot on.

 

The best result for you would be if NCP ignore the LoC, then ignore the claim form, and after a fortnight you win by default.  Less hassle that way.

 

That result would not negate NCP's responsibility to supply the SAR documentation.

 

BW Legal, charlatans though they are, are actually solicitors who would be likely to wake up to a LoC, so best to leave them out of the loop.

 

3 hours ago, MoaningCrusader said:

I will await final ok for the LoC.

I've flagged it up to the Site Team, especially to the person dealing with the Virgin case, but the weekend is nearly upon us and people have their own lives, but we'll get there slowly but surely.

[MoaningCrusader]

Good morning. I hope you all had a lovely weekend. Apologies for my radio silence. I have been working and caring for my 5yr old with chicken pox. Finally back to school!

 

FTMDave, just checking really to see if any of the site team have anything to add to the SAR LoC. If not, I am ready to send it. 

 

I will await further instruction.

 

 

 

 

[FTMDave]

There has been no further feedback - and I know you're anxious to get things moving.

 

I would say to give it another 24 hours.  The LoC is probably fine but just to be absolutely sure I would prefer others to have a look at it.

[FTMDave]

I'm just wondering whether the LoC should include the sum you will sue them for - so they can't say they weren't warned.

 

Dear Sir/Madam

 

LETTER OF CLAIM

 

General Data Protection Regulations - Subject Access Request

Parking Charge Notice Number: XXXXX

 

On Wednesday 3^rd August I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply.

You have now breached your statutory duty. It has caused me a great deal of distress not having my data in order to understand the problems you have caused by the failure of your systems and your charging process, together with the necessity to chase after you to get this disclosure..

You have 14 days to respond, after which I shall begin a County Court claim against you for the sum of £200.
 

Yours faithfully

[FTMDave]

Regarding the SAR LoC. I really don't think you should go above £200, tempting as it is.  The person who is dealing with the Virgin case - and who knows a hell of a lot more than me - was uncertain about whether to sue for £100 or £200.  A judge is much more likely to grant a lower sum.

 

Remember that you will be suing for distress up to the day you issue the claim form.  If they continue to faff around and not respond to the SAR then you can sue them for a second period of distress.  That is what happened in the Virgin case. 

[FTMDave]

I think there's been enough waiting.  I know you want to move things on.

 

Get the LoC sent off tomorrow to NCP's head office by 1st-class post and get a free CoP from the post office.

 

Once that's done we'll divide the thread into the two separate legal actions happening.

[FruitSalad1010]

Personally I wouldn't include a sum in any letter before claim.

 

I appreciate FTM is being mindful of the fact that pre-action protocol provides that you detail what you are claiming.

 

However in this case I think it would be perfectly reasonably to explain later on if required, that you in no way wanted to give the impression you were prepared to give up your statutory rights for an amount of money.

 

What you reasonably expect to happen is that upon receiving your letter before claim the infringing party hold their hands up, provide you with your data as well as an apology and offer you compensation as a result.

 

Instead what regularly happens is they ignore your letter and stubbornly drag the process out wasting the time of the courts and their own costs, often spurred on by a lack lustre response by the ICO to any concurrent complaint.

 

After they deny your claim or more likely ignore it, you are forced to claim for a sum simply because a necessary part of submitting a claim and paying a court fee is that a sum must be claimed.

 

I can imagine if an organisation were to correct their mistake promptly that an amount of compensation may be acceptable.

 

However, if after your letter you are then forced to exercise your statutory rights through the Courts, I don't think it unconscionable that you consider this has caused you additional distress and frustration that could have been reasonably prevented prior to you issuing a claim.

 

Perhaps the most consistent approach, in keeping with not stating a sum in your letter before claim, would be to provide in you particulars a request that the Court assess the damages limited to the maximum sum allowed by your claim fee.

 

Ultimately whatever you decide, provided it is modest is unlikely to be a major hurdle. I expect if it goes as far as a trial that a judge is far more likely to stay focused on the substantial issue of the missing data and breach of statutory duty with far less time given to considering the award.

[MoaningCrusader]

Thanks for your input Fruitsalad.

 

So I think it's probably best to just send the following without any specific amount on it. I can claim an amount once I am force to start the claim process with the courts. And as you say the maximum amount will be £300, as I doubt I'll pay more than the min £35 court fee. As FTM says, further failure from NCP to carry out their statutory duty will simply result in further amounts of compensation.

 

I am going to post the original version below. Are we all agreed?

 

Letter Before Claim

 

To whom it may concern,

On Wednesday 3^rd August I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply.

You have now breached your statutory duty. It has caused me a great deal of distress not having my data in order to understand the problems you have caused by the failure of your systems and your charging process, together with the necessity to chase after you to get this disclosure.

You have 14 days to respond, after which I shall begin a County Court claim against you.

 

Yours faithfully