EPS breach of GDPR

[FTMDave]

OK.

 

Please bear with us for a little while with it being nearly Christmas.

 

I have to work quite hard this week but I'll have loads of time free over the festivities and promise to dig out the other thread I mentioned and get back to you.

 

IIRC GDPR breaches have to be dealt with promptly but with the holidays intervening, the start of January ought to be fine.

[FTMDave]

The work week is over and finally there is time free to have a look at this.

 

I've split the GDPR part off as a new thread as it will be a separate court claim.

 

When you have time read posts 10-24 at  https://www.consumeractiongroup.co.uk/topic/450568-highview-parking-breach-of-gdpr/#comment-5173842  The steps to start a claim for breach of GDPR are explained. 

 

(This is the thread I've previously mentioned where a motorist wanted to sue for breach of GDPR but at a certain point they disappeared, quite possibly because a mistake had been made about which company to pursue and they may have got fed up.)

 

The initial action would be to follow post 12 and contact the DVLA to find out who has been accessing your data.

 

Note FruitSalad's post 15.  This doesn't mean you have to give up your Christmas to deal with this!  But it will need to be done at the start of January.  If you could get the DVLA mail off sharpish that would be good, the template is there and it should only take a minute.

 

Obviously Christmas is upon us but please come on when you are able to work on this.

 

And although we haven't much GDPR breach history on CAG, there is plenty on the web, victory is perfectly possible.  Have a good chuckle at these three short threads:

 

https://parking-prankster.blogspot.com/2017/08/cp-plus-lose-data-protection-claim.html

 

https://parking-prankster.blogspot.com/2017/07/parking-awareness-services-to-pay-400.html

 

https://parking-prankster.blogspot.com/2017/05/motorist-awarded-900-for-data.html

[FTMDave]

Yes, spot on. 

 

Find out from the DVLA who has accessed your data.  Of course we know it is EPS.  However, best to get all your ducks in a row.  For example, in the other CAG case I mentioned, the PPC had used a third party to access data so there were two entitles to pursue.

 

Yes, SAR EPS.  Given the postal strikes, this can be speeded up by e-mail.  I've seen on their site - General Data Protection Regulation gives you the right to access information held about you. You can access personal data we hold of you by sending an email to dpo@europarkingservices.com

 

(We normally say not to use e-mail when dealing with PPCs but here you are after them, and in any case e-mail contact can be stopped later down the line).

 

The complaint to the DVLA is a secondary matter and can wait.

 

If you can, get both these off today and get the ball rolling.

[FTMDave]

Someone on another thread today had a mail to the DVLA address bounce back.  Has this not happened to you?

[FTMDave]

It's damn confusing, isn't it?

 

Yes, my reading of it is like yours.  Send to that address too and see what happens.

[FTMDave]

You're right!

 

1.  I've just been through the process.  After ages I got to  https://contact.dvla.gov.uk/vehicle/capture_personal_information?locale=en

 

2.  I chose "Request information or a form from us, check your details or report an untaxed/abandoned vehicle" then "Requesting information from DVLA vehicle records" then "Advice on the release of information from DVLA records ".

 

3.  They then sent me a standard e-mail about all the great work they do with drivers' personal information.  The last few lines of the stupid mail are

 

Do not reply to this email. If you wish to contact us again about this response then please use our reply form link or copy and paste the following URL in to your browser:

https://contact.dvla.gov.uk/response?response_type=vehicle&email_case_id=QG4PfoUBj1TYATYkqd3_

 

Best Regards

 

4.  I clicked on their "reply form link" and could finally write to them.

 

What a palaver.

 

Good luck!

Edited January 4, 2023 by FTMDave
Typo

[FTMDave]

So the DVLA treated the request as a SAR - even though you specifically told them it wasn't a SAR.

 

Could you please post up the e-mail address they replied to you with?  We have someone else in the same position as you and it would be very useful for the site.

 

I agree with LFI.  Surely the DVLA must have made a mistake.  That's unless you've had previous run-ins with EPS.

 

Actually it would be good if EPS didn't reply to the SAR - then you can sue them for that too!

[FTMDave]

If you look at the last page of mrk1's thread there is an attachment like the one the DVLA should have sent you  https://www.consumeractiongroup.co.uk/topic/454610-ukpcdcbl-5-pcns-now-loc-parkhorse-shopping-centre-huddersfield-hd1-2rt/page/6/#comment-5196780

 

If you can post the e-mail address up it would be very useful for others in a similar boat.

[FTMDave]

Got the address:  SubjectAccess.Requests@dvla.gov.uk

 

Given the DVLA have been pretty decent in replying quickly, I would write back and ask are they absolutely sure a private parking company didn't ask for details of vehicle XXXXX in February or March 2021 given one such company sent their PCN and subsequently started a court case against you.

[FTMDave]

Am I right in thinking that you requested a SAR from EPS on 4 January and they haven't replied?

[FTMDave]

Well you started off this thread wanting to hold the fleecers to account.

 

Well the good news is that you can now hold them to account - twice!  Both for GDPR and for the SAR!  In fact the SAR is easier and extremely straightforward.  There can be no defence if they haven't respected their statutory duty.

 

Have a read of these two threads by Caggers who have recently won SAR cases -

 

https://www.consumeractiongroup.co.uk/topic/452147-loc-to-ncp-for-failure-to-supply-sar-paid-in-full/#comment-5180862

 

https://www.consumeractiongroup.co.uk/topic/454456-loc-now-court-claim-to-spring-parking-for-failure-to-supply-sar-paid-in-full/#comment-5188824

 

The next step is to draft two Letters of Claim.  Examples for the SAR one are on the threads.  Post up two drafts when you get the time.     

[FTMDave]

Good work.  Send that off today.  Get a free Certificate of Posting from the post office.

[FTMDave]

Given what @FruitSalad1010said about the necessity of starting GDPR claims promptly, I think you need to send the GDPR letter of claim.

 

Obviously this hasn't been done because you were hanging on to see the SAR documentation first, but EPS are refusing to answer.

 

Fortunately the early stages of bringing a court claim - the Letter of Claim and then starting the case with Particulars of Claim - are very simple & straightforward.  It's only later on that there is serious work to do. 

 

From your other thread I see EPS admit on their PCN they got your data from the DVLA (see attachment), so that's fine.

 

How about something like -

 

 

Dear EPS,

 

Re: PCN no.XXXXX, County Court Claim no.XXXXX, Breach of General Data Protection Regulations (GDPR)

 

I refer to your obtaining my details from the Driver and Vehicle Licensing Agency in the above matter. 

 

You had no justification for doing so.  The extremely-short stay of my vehicle was allowed under the government Code of Practice, the BPA Code of Practice, the IPC Code of Practice and indeed by your contract with the landowner.

 

This is an extremely serious breach as you used my details to begin a vexatious court claim which caused me considerable distress.

 

I require payment of the sum of £XXXXX within 14 days.  If you fail to effect payment I will start a claim in the county court.

 

Yours,

 

 

However, hang on a couple of days to see what the other regulars think.

 

Question for the others.  How much should the claim be for?  The breach is serious, but on the other hand if the OP claims for a smaller amount there would be less court costs + the fleecers would be more likely to give in + a judge would be more likely to agree.

 

For anyone who doesn't remember, the OP was sued by EPS for staying in a car park for ... 29 seconds!!!!!

 

 

@kfdh1962We know the fleecers involved Gladstones, which is sort-of fine as they are allowed to use solicitors.  Do you know if they passed your details to any debt collectors as well?

CPR Retur n.pdf

Edited February 21, 2023 by FTMDave
Letter tweaked

[FTMDave]

I've tweaked the letter to include that the breach of GDPR caused considerable distress.

 

Anyone help with the amount of the claim?

[FTMDave]

There is a successful claim here for £500

 

Parking Prankster: Motorist awarded £900 for data protection breach by parking company

PARKING-PRANKSTER.BLOGSPOT.COM

---

D6GM2199 CEL v Mr B, Bury County Court, before DJ Osborne This thread on MSE details the story of a motorist awarded £900 because a parki...

 

[FTMDave]

You need to move this on this weekend.  There is a limited time in which to take action.

 

Have you sent the SAR LoC?

 

Do you know if the fleecers also got debt collecting agencies to write to you?

[FTMDave]

We haven't got many GDPR cases, and there aren't many on other forums.  i think generally motorists are just glad to have got rid of the parking invoice and don't want to take it further.

 

However, I don't think this is a very complex case needing a solicitor.  Was there any valid reason for the fleecers to access the OP's details?  Absolutely not as shown by the contract and the CoPs.  Even if there was an initial mistake then they should have picked up on the error at reminder letter stage, not start a vexatious court case.

 

Was the OP distressed?  Clearly yes by a vexatious court case and this coming up in the middle of a house move.

 

In fact I'll get off the fence and suggest £600 as the figure.  The OP could use the persuasive case on the parking prankster's site which was for £500 and add that this is a worse case (a) because in the other case there was at least some evidence the driver had done something wrong, in the OP's there is none, and (b) the distress was worse, the OP was moving home and was extremely worried about missing court dates.

 

£600 is also the figure where High Court bailiffs can be involved.  By, er, coincidence.

 

But the OP needs to be here and dealing with the case.

Edited February 26, 2023 by FTMDave
Typo

[FTMDave]

I only mentioned debt collectors as that would have worsened their position.

 

Post up a draft of the letter if you want, although I think what is already prepared is good enough, it just needs the £600 figure added. 

 

You know the drill about the free Certificate of Posting from the post office.

[FTMDave]

Apologies for the "moving house" stuff.  I got you mixed up with someone else.

 

I think the letter you've prepared is excellent.  Send it off tomorrow and get a free CoP.  The fleecers will not be happy with demands for £800 over a couple of days

[FTMDave]

I reckon a week has now passed since your SAR LoC letter went off.

 

Northing from the fleecers?

 

If not it's time to draft a Particulars of Claim.  MoaningCrusader's is at post 46 here  https://www.consumeractiongroup.co.uk/topic/452147-loc-to-ncp-for-failure-to-supply-sar-paid-in-full/page/2/#comments  and you could adapt it.

 

[FTMDave]

I would suggest two changes.  The bit about "further correspondence" was specific to Moaning Crusader's case, where the idiots leapt into action after the LoC and replied that they would deal with the SAR "as a matter of urgency".  Moaning Crusader gave them an additional week ... but the imbeciles still couldn't reply to the SAR and so were sued and beaten!

 

How about -

 

 

The claimant submitted a subject access request pursuant to the Data Protection Act 2018 to Euro Parking Services Ltd on January 4^th 2023. 

 

The defendant breached the statutory deadline of 30 days and has failed to make the disclosure. This failure is continuing 1 month later, despite further correspondence with the defendant’s data protection team and reasonable response time given. 

 

The defendant's breach of their statutory duty and the claimant's inability to access their personal data has caused them serious issues and distress, especially as the non-disclosure is occurring during protracted litigation between the parties, which was initiated by the defendant.

 

 

The point is to have something ready to start the claim on day 15 if they ignore you.

 

There is ample time between now and then for the others regulars to have a look and suggest changes.

 

[FTMDave]

The PoCs look fine.

 

IIRC Tuesday is Day 15.  If the fleecers haven't cooperated by then, launch your claim.

[FTMDave]

Well done.

 

Hit them in the pocket.

 

Let's see how they like being the ones on the end of a court claim.

[FTMDave]

So tomorrow is Day 15 for the GDPR claim, right?

 

Time to draft a Particulars of Claim.  A bit from the LoC, and a bit from the SAR PoCs, should do the trick.

 

 

[FTMDave]

I agree with FruitSalad that less is more.

 

I also think the SAR matter is irrelevant here.

 

The PoCs just need to be very short.  How about -

 

 

On XX Month Year the Defendant accessed my personal data held by the Driver and Vehicle Licensing Agency without reasonable cause.

 

The Defendant used their access to my personal data to issue a county court claim against me which was totally without merit and was subsequently discontinued.

The Defendant's breach caused me considerable distress.

 

I seek damages for distress £xxx.xx

 

 

If none of the other regulars disagree, and if you hear nothing from the fleecers, issue the new claim tomorrow.