EPS breach of GDPR

[FTMDave]

So the DVLA treated the request as a SAR - even though you specifically told them it wasn't a SAR.

 

Could you please post up the e-mail address they replied to you with?  We have someone else in the same position as you and it would be very useful for the site.

 

I agree with LFI.  Surely the DVLA must have made a mistake.  That's unless you've had previous run-ins with EPS.

 

Actually it would be good if EPS didn't reply to the SAR - then you can sue them for that too!

[kfdh1962]

correct , even though i specifically stated it was not an SAR they treated it as an SAR. 

 

I have not had any previous dealings with EPS, so that wouldn't explain the response and suggests an error of some kind. i will check out the e mail address and post 

 

 

[FTMDave]

If you look at the last page of mrk1's thread there is an attachment like the one the DVLA should have sent you  https://www.consumeractiongroup.co.uk/topic/454610-ukpcdcbl-5-pcns-now-loc-parkhorse-shopping-centre-huddersfield-hd1-2rt/page/6/#comment-5196780

 

If you can post the e-mail address up it would be very useful for others in a similar boat.

[FTMDave]

Got the address:  [email protected]

 

Given the DVLA have been pretty decent in replying quickly, I would write back and ask are they absolutely sure a private parking company didn't ask for details of vehicle XXXXX in February or March 2021 given one such company sent their PCN and subsequently started a court case against you.

[kfdh1962]

The e mail came back from [email protected]

 

There was a link to an encrypted attachment which was a letter stating there have been no request for data for the vehicle . 
I will redact and post that up. 

will read through there post link you shared also 
 

 

[kfdh1962]

i have replied to the e mail for [email protected] for which my AR response came asking that they review their response stating that there has been no access to my data on the basis that a private parking firm contacted me in February 2021 stating specifically that they had obtained my details from DVLA so a response from DVLA stating that their had been no access request for my data doesn't not seem plausible 

[Nicky Boy]

OOPS!

Can someone redact the upload please guys?

(Reg no showing)...

[FTMDave]

Am I right in thinking that you requested a SAR from EPS on 4 January and they haven't replied?

[brassnecked]

Are options to tolchok them if they are out of time for SAR.

 

[kfdh1962]

that's correct , i sent the SAR by post to EPS on jan 4th after the various e mails bounced back. Unless anything came today , i have had nothing back from EPS so and was aware they were coming up to being out of time

 

I also e mailed the DVLA asking them to re-look at the information they sent  saying that there had been no requests to access my data yet a private parking company had obtained my data claiming that they had received my details form the dvla , but they have not responded to that e ,mail as i had .

 

In respect to the SAR non compliance from EPS , what are the next steps,  ? 

[FTMDave]

Well you started off this thread wanting to hold the fleecers to account.

 

Well the good news is that you can now hold them to account - twice!  Both for GDPR and for the SAR!  In fact the SAR is easier and extremely straightforward.  There can be no defence if they haven't respected their statutory duty.

 

Have a read of these two threads by Caggers who have recently won SAR cases -

 

https://www.consumeractiongroup.co.uk/topic/452147-loc-to-ncp-for-failure-to-supply-sar-paid-in-full/#comment-5180862

 

https://www.consumeractiongroup.co.uk/topic/454456-loc-now-court-claim-to-spring-parking-for-failure-to-supply-sar-paid-in-full/#comment-5188824

 

The next step is to draft two Letters of Claim.  Examples for the SAR one are on the threads.  Post up two drafts when you get the time.     

[kfdh1962]

thanks FTMD , i will take a read through those 2 threads 

[kfdh1962]

apologies for the delays , work and dealing with my fathers estate have been taking up all my time. I read through the threads FTMD shared which were helpful, Letter before action drafted as below based on those threads

 

LETTER BEFORE CLAIM

 

General Data Protection Regulations - Subject Access Request

 

Parking Charge Notice Number: XXXXX

 

To whom it may concern,

On Wednesday 4^TH January 2023 I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply with that request and you have now breached your statutory duty.

 

This has caused me a great deal of distress not having my data in order to understand who is sharing my data and what data you hold on me, together with the necessity to chase after you to get this disclosure.

You have 14 days to respond, after which I shall begin a County Court claim against you.

[FTMDave]

Good work.  Send that off today.  Get a free Certificate of Posting from the post office.

[FTMDave]

Given what @FruitSalad1010said about the necessity of starting GDPR claims promptly, I think you need to send the GDPR letter of claim.

 

Obviously this hasn't been done because you were hanging on to see the SAR documentation first, but EPS are refusing to answer.

 

Fortunately the early stages of bringing a court claim - the Letter of Claim and then starting the case with Particulars of Claim - are very simple & straightforward.  It's only later on that there is serious work to do. 

 

From your other thread I see EPS admit on their PCN they got your data from the DVLA (see attachment), so that's fine.

 

How about something like -

 

 

Dear EPS,

 

Re: PCN no.XXXXX, County Court Claim no.XXXXX, Breach of General Data Protection Regulations (GDPR)

 

I refer to your obtaining my details from the Driver and Vehicle Licensing Agency in the above matter. 

 

You had no justification for doing so.  The extremely-short stay of my vehicle was allowed under the government Code of Practice, the BPA Code of Practice, the IPC Code of Practice and indeed by your contract with the landowner.

 

This is an extremely serious breach as you used my details to begin a vexatious court claim which caused me considerable distress.

 

I require payment of the sum of £XXXXX within 14 days.  If you fail to effect payment I will start a claim in the county court.

 

Yours,

 

 

However, hang on a couple of days to see what the other regulars think.

 

Question for the others.  How much should the claim be for?  The breach is serious, but on the other hand if the OP claims for a smaller amount there would be less court costs + the fleecers would be more likely to give in + a judge would be more likely to agree.

 

For anyone who doesn't remember, the OP was sued by EPS for staying in a car park for ... 29 seconds!!!!!

 

 

@kfdh1962We know the fleecers involved Gladstones, which is sort-of fine as they are allowed to use solicitors.  Do you know if they passed your details to any debt collectors as well?

CPR Retur n.pdf

Edited February 21, 2023 by FTMDave
Letter tweaked

[FTMDave]

I've tweaked the letter to include that the breach of GDPR caused considerable distress.

 

Anyone help with the amount of the claim?

[AndyOrch]

Quote

How much compensation will the court award me if my claim is successful?

This will be up to the judge hearing the case, who will take into account all the circumstances. This will include how serious the infringement was and its impact on you, particularly when assessing the distress you suffered.

If the organisation refuses or is unable to pay, you should ask the court how you can enforce the judgment.

You should also bear in mind that the court can award costs to you or against you in certain circumstances. For example, if you fail to demonstrate you have suffered damage or distress, the court will not award you compensation and could order you to pay the other party’s costs. Again, we recommend you seek independent legal advice to allow you to consider the risks of bringing a claim.

 

https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/#:~:text=The GDPR gives you a,e.g. you have suffered distress).

 

This type of claim should really be issued using Part 8 type claim as the court will determine the award amount. Issuing on a Part 7 requires a value of the claim which obviously is unknown.

 

Andy

 

[FTMDave]

There is a successful claim here for £500

 

Parking Prankster: Motorist awarded £900 for data protection breach by parking company

PARKING-PRANKSTER.BLOGSPOT.COM

---

D6GM2199 CEL v Mr B, Bury County Court, before DJ Osborne This thread on MSE details the story of a motorist awarded £900 because a parki...

 

[AndyOrch]

Yes, but that was by way of counter claim (Part 20) in response to their claim...so he didn't actually issue a seperate claim.

[FTMDave]

You need to move this on this weekend.  There is a limited time in which to take action.

 

Have you sent the SAR LoC?

 

Do you know if the fleecers also got debt collecting agencies to write to you?

[lookinforinfo]

Just to muddy the waters here is a website on GDPR Breaches. 

https://www.dataguard.co.uk/blog/gdpr-and-data-breach-compensation-in-the-uk#:~:text=information had occurred.-,When are you eligible for data breach compensation%3F,a planned or unintentional breach

[Nicky Boy]

Guys,

 

Do CAG actually have any experts on GDPR breaches?

 

If not, it might be a better idea to find a no win no fee solicitor to take the case on.

 

Even if it means paying out a percentage of any win, isn't the main point here to take the fleecers to task?

 

Unless if the OP is in need of the cash..?

 

Also, looking around, it seems that the 6 year rule also applies to cases like this, so no need for urgency?

Edited February 24, 2023 by Nicky Boy

[honeybee13]

Given the size of the likely payout I'm not sure an NWNF lawyer would take it on.

 

HB

[FTMDave]

We haven't got many GDPR cases, and there aren't many on other forums.  i think generally motorists are just glad to have got rid of the parking invoice and don't want to take it further.

 

However, I don't think this is a very complex case needing a solicitor.  Was there any valid reason for the fleecers to access the OP's details?  Absolutely not as shown by the contract and the CoPs.  Even if there was an initial mistake then they should have picked up on the error at reminder letter stage, not start a vexatious court case.

 

Was the OP distressed?  Clearly yes by a vexatious court case and this coming up in the middle of a house move.

 

In fact I'll get off the fence and suggest £600 as the figure.  The OP could use the persuasive case on the parking prankster's site which was for £500 and add that this is a worse case (a) because in the other case there was at least some evidence the driver had done something wrong, in the OP's there is none, and (b) the distress was worse, the OP was moving home and was extremely worried about missing court dates.

 

£600 is also the figure where High Court bailiffs can be involved.  By, er, coincidence.

 

But the OP needs to be here and dealing with the case.

Edited February 26, 2023 by FTMDave
Typo

[kfdh1962]

good morning , 

just catching up on all the posts from the last few days as i have been out of the country since Wednesday morning only arriving home late yesterday evening.

 

i am in a position now to send of the GDPR claim letter that you have all been discussing.

 

will take another look back through your posts now to draft my letter which i will come back and post up before doing anything