Good afternoon,
Thank you for your email to the Data Protection Office at APCOA Parking (UK).
In line with GDPR, we require identification as we need to be satisfied that we know the identity of the requester before supplying any personal information.
Within guidance provided by the Information Commissioner's Office (ICO) under 'what to expect after making a Subject Access request' it states "ID checks are sometimes needed to check you are the person asking for the information and to protect your personal information. When asked for ID, you should provide it."
The GDPR legislation also states that “The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.”
As advised previously, once your identity has been verified, any identification sent is then securely deleted from our system, the documentation is not retained.
Please also be advised that the timescale for responding to a SAR does not begin until we have received the requested information.
For more information on identity verification, please view the ICO guidance by visiting https://ico.org.uk.
Yours sincerely,
Jack Speakman
Subject: Urgent Update: Written Admission by APCOA Confirms Misuse of DVLA Data and Possible Criminal Offence
Dear [MP's Name],
I am writing to follow up on my previous correspondence sent on [insert date], regarding APCOA Parking (UK) Ltd and their misuse of personal data obtained in reliance upon DVLA keeper records. Since that time, APCOA have issued a written response to a formal complaint which makes an admission that is nothing short of damning.
They have confirmed in writing that their so-called “Penalty Notices”, issued under the guise of Railway Byelaws, are in fact civil demands pursued under private contract law, not statutory penalties. Despite this, they continue to design and issue notices that falsely imply criminal liability, threaten prosecution under byelaw 14, and reference statutory offences. Payments are retained by APCOA or the landowner—not the public purse—proving these are not lawful fines.
This is not just misleading; it arguably engages criminal liability under Section 2 of the Fraud Act 2006 – false representation made dishonestly and with intent to cause a gain or loss. It also raises profound concerns about the DVLA’s ongoing role in facilitating these schemes by releasing keeper data under the KADOE contract, with no apparent oversight or sanction when that data is subsequently misused.
The evidence now includes:• APCOA’s own written admission that the notices are civil, not statutory.
• The use of the term “Penalty Notice” to falsely imply criminal liability.
• Threats of prosecution despite no intention or legal mechanism to prosecute.
• Processing of personal data in a manner contrary to the purpose under which it was obtained from the DVLA.
This is a serious matter of public interest, and I respectfully request that you raise it directly with the Secretary of State for Transport or the Minister responsible for DVLA oversight. The issue is not isolated, and unless Parliament intervenes, it will continue to affect thousands of motorists.
I am happy to provide a copy of APCOA’s written admission upon request. Please confirm that this matter will now be taken forward.
Yours sincerely,
[Your Full Name]
[Your Address + Postcode]
[Your Contact Email]
I am submitting a formal complaint against APCOA Parking (UK) Ltd, a BPA AOS member with DVLA KADOE access, for breaching the Private Parking Sector Single Code of Practice (PPSCoP) and misusing personal data obtained in reliance upon DVLA-supplied keeper information.
While APCOA did not obtain my data directly from the DVLA, the entire enforcement process was initiated using DVLA data provided under the KADOE contract to the registered keeper — a lease company. That keeper then passed on my details to APCOA. From that point forward, APCOA used my personal data to pursue what they described as a statutory “Penalty Notice” under railway byelaws, implying criminal liability.
However, in response to a formal complaint, APCOA have now admitted that their “Penalty Notices” are not statutory penalties, but civil claims based on private contract law. They also confirmed that funds collected are retained by themselves or the landowner, not paid to the public purse — proving these are not fines issued by or on behalf of a prosecuting authority.
This is a damning admission. APCOA instigated the process using DVLA data under the false pretence of statutory enforcement, only to later reframe the charge as a civil contractual matter once challenged. This constitutes a clear breach of the KADOE contract and PPSCoP, both of which prohibit misleading representations and require that DVLA data be used for a lawful, clearly defined, and Code-compliant purpose.
The DVLA, as data controller, remains responsible for ensuring that personal data released under KADOE is not subsequently misused — including by downstream parties acting on the back of that disclosure. This complaint concerns not just the initial release of data, but its subsequent use in a manner that may amount to unlawful processing and potentially criminal misrepresentation.
I have attached a supporting statement with evidence and request a full investigation into this matter. Please confirm receipt and provide a reference number for this complaint.
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: APCOA Parking (UK) Ltd
Date of Penalty Notice issue: [INSERT DATE]
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report a misuse of my personal data by APCOA Parking (UK) Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although my own personal data was not supplied directly by the DVLA, APCOA initiated enforcement based on DVLA data they received for the registered keeper — a lease company. That keeper then passed my details to APCOA, who processed my data in reliance upon the DVLA-supplied information. All subsequent action taken by APCOA, including the issue of a “Penalty Notice” and the pursuit of payment, was conducted under the authority they derive from the KADOE framework. As such, they remain fully bound by the terms of that contract and the Private Parking Sector Single Code of Practice (PPSCoP).
While APCOA may have had reasonable cause to request my data initially, they subsequently used it to issue a document styled as a “Penalty Notice” for an alleged breach of Railway Byelaws. The notice mimicked the form and language of a statutory penalty, implied criminal liability, and threatened escalation under Byelaw 14(1).
However, in a formal written complaint response dated [INSERT DATE], APCOA made the following admissions:• The “Penalty Notice” is not a statutory enforcement measure, but a civil matter based on private contract law.
• Enforcement is pursued under contract law and not through the railway byelaw criminal framework.
• Revenue from the notice is retained by APCOA or the landowner—not remitted to the public purse—confirming it is not a fine issued by a prosecuting authority.
These admissions expose a clear deception: keeper data obtained under the pretext of enforcing statutory railway offences was instead used to pursue what APCOA now claims is a private contractual matter. This amounts to a misuse of personal data, a breach of the Private Parking Sector Single Code of Practice (PPSCoP), and a violation of the terms of the KADOE contract.
More seriously, this conduct raises significant concerns under the Fraud Act 2006, specifically Section 2 – false representation. APCOA knowingly represented a private civil charge as a statutory “Penalty Notice” in order to induce payment from a motorist under threat of criminal consequences. This is not a minor procedural failing or mere miscommunication; it is arguably a criminal offence, and it must be treated as such.
As the Data Controller, the DVLA bears direct responsibility for ensuring that personal data it supplies under KADOE is:• Used lawfully and fairly
• Not processed for misleading or deceptive purposes
• Not used in ways that facilitate or support criminal conduct
These responsibilities cannot be delegated or brushed aside. Where there is evidence that a KADOE recipient has used personal data in a manner that may constitute a criminal offence, the DVLA must act—whether by initiating proceedings under the KADOE contract, reporting the matter to enforcement agencies, or revoking access to its data systems.
I request that the DVLA take the following actions:• Investigate APCOA’s conduct in this case
• Determine whether a breach of the KADOE contract and PPSCoP has occurred
• Refer the matter to the appropriate enforcement authority or police, given the potential criminality under the Fraud Act
• Suspend or terminate APCOA’s KADOE access if warranted
The attached correspondence from APCOA constitutes direct evidence of misrepresentation and unlawful processing. I trust the DVLA will treat this complaint with the seriousness and urgency that such conduct demands.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
Subject: Re: Subject Access Request – Reminder of Legal Obligations
Dear Data Protection Officer,
Thank you for your response dated [INSERT DATE].
While I appreciate the need for identity verification, I must remind you that this request was submitted in my capacity as the Keeper, and I have already corresponded with APCOA on this matter using the same name and address you originally obtained from the DVLA.
As such, you already have sufficient information to verify my identity. If you require confirmation, a copy of that prior correspondence can be provided to satisfy any reasonable verification requirement. However, requesting a V5C document is disproportionate in this context and not justified under Article 12(6) of the UK GDPR.
You are therefore reminded that:• I submitted a valid Subject Access Request on [INSERT DATE].
• The 30-day statutory period began on that date, not from when you receive additional documents you arbitrarily demand.
• Your continued delay in responding may amount to a breach of the UK GDPR.
I expect the SAR to be processed without further obstruction. If no response is provided within the statutory timeframe, I will refer the matter to the Information Commissioner’s Office without further notice.
Yours sincerely,
[Your Name]
I am submitting a formal complaint against APCOA Parking (UK) Ltd, a BPA AOS member with DVLA KADOE access, for breaching the Private Parking Sector Single Code of Practice (PPSCoP) and misusing my personal data obtained from the DVLA.
While APCOA may have had reasonable cause to request my data initially, they subsequently used it to issue a document titled “Penalty Notice” that falsely implied criminal liability and statutory enforcement under railway byelaws. However, in response to a formal complaint, APCOA have now explicitly admitted that their notices are in fact civil in nature, and that they are relying on private contract law to justify enforcement and collection.
This is a damning admission that they accessed DVLA data on the false premise of pursuing a statutory offence, only to repackage the enforcement as a civil matter once challenged. This is a clear breach of the KADOE contract and the PPSCoP, both of which prohibit misleading conduct and misuse of DVLA data.
The DVLA, as data controller, is responsible for ensuring that personal data is not misused following its release under KADOE. This complaint is not about the initial access to my data, but rather the subsequent unlawful use of it once it became clear that the operator had no legal basis to pursue a penalty under the statutory regime.
I have attached a supporting statement and request a full investigation. Please confirm receipt and provide a reference number for this complaint.
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: APCOA Parking (UK) Ltd
Date of Penalty Notice issue: [INSERT DATE]
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report a misuse of my personal data by APCOA Parking (UK) Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
While APCOA may have had reasonable cause to request my data initially, they subsequently used it to issue a document styled as a “Penalty Notice” for an alleged breach of Railway Byelaws. The notice mimicked the form and language of a statutory penalty, implied criminal liability, and threatened escalation under Byelaw 14(1).
However, in a formal written complaint response dated [INSERT DATE], APCOA made the following admissions:• The “Penalty Notice” is not a statutory enforcement measure, but a civil matter based on private contract law.
• Enforcement is pursued under contract law and not through the railway byelaw criminal framework.
• Revenue from the notice is retained by APCOA or the landowner—not remitted to the public purse—confirming it is not a fine issued by a prosecuting authority.
These admissions expose a clear deception: keeper data obtained under the pretext of enforcing statutory railway offences was instead used to pursue what APCOA now claims is a private contractual matter. This amounts to a misuse of personal data, a breach of the Private Parking Sector Single Code of Practice (PPSCoP), and a violation of the terms of the KADOE contract.
More seriously, this conduct raises significant concerns under the Fraud Act 2006, specifically Section 2 – false representation. APCOA knowingly represented a private civil charge as a statutory “Penalty Notice” in order to induce payment from a motorist under threat of criminal consequences. This is not a minor procedural failing or mere miscommunication; it is arguably a criminal offence, and it must be treated as such.
As the Data Controller, the DVLA bears direct responsibility for ensuring that personal data it supplies under KADOE is:• Used lawfully and fairly
• Not processed for misleading or deceptive purposes
• Not used in ways that facilitate or support criminal conduct
These responsibilities cannot be delegated or brushed aside. Where there is evidence that a KADOE recipient has used personal data in a manner that may constitute a criminal offence, the DVLA must act—whether by initiating proceedings under the KADOE contract, reporting the matter to enforcement agencies, or revoking access to its data systems.
I request that the DVLA take the following actions:• Investigate APCOA’s conduct in this case
• Determine whether a breach of the KADOE contract and PPSCoP has occurred
• Refer the matter to the appropriate enforcement authority or police, given the potential criminality under the Fraud Act
• Suspend or terminate APCOA’s KADOE access if warranted
The attached correspondence from APCOA constitutes direct evidence of misrepresentation and unlawful processing. I trust the DVLA will treat this complaint with the seriousness and urgency that such conduct demands.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
Thank you for your patience whilst this has been investigated.
• Why are you, an unregulated private parking company, issuing fake “Penalty Notices” designed to mislead motorists into believing you possess statutory or criminal enforcement powers which you clearly do not?
APCOA operate under and are regulated by the British Parking Association (BPA) and agree to adhere to the sector single code of practice.
We can confirm that this Penalty Notice is issued as a civil matter. The penalty notice system is an established mechanism designed to address breaches of the railway byelaws in a way that is proportionate and fair. These notices are not intended to suggest criminal intent or prosecution at the outset but to offer the opportunity to resolve matters without escalation. Should the recipient fail to engage or resolve the matter, criminal enforcement under Byelaw 14(1) may be pursued.
• Why are you attempting to rely on Railway Byelaws to justify civil enforcement of minor parking indiscretions, despite knowing full well that such matters do not fall within the scope of criminal prosecution under Byelaw 24(1)?
•Additionally, your use of the term “Penalty Notice”, coupled with the implied criminal consequences, is highly misleading. You are not a prosecuting authority, and your notice cannot be lawfully construed as anything more than a speculative civil invoice. Its presentation—suggesting legal obligation and criminal liability—appears to constitute a breach of Section 2 of the Fraud Act 2006, namely:
“False representation made dishonestly and with intent to make a gain or cause loss.”
In other words, this was an attempt at extortion by deception.
The term “Penalty Notice” is used because the breach of railway byelaws, such as unauthorised parking, constitutes a potential statutory offence. This is entirely different from a private parking charge, as our notices pertain to statutory enforcement of the byelaws, which may involve criminal liability in some cases. The presentation of the notice reflects the legal process in place, and it has been reviewed and approved to ensure compliance with the applicable legal standards.
• Why are you directing recipients to a private appeals process in circumstances where you are claiming a statutory breach? Appeals panels have no jurisdiction over alleged criminal offences.
It is important to clarify that while the alleged breach may indeed involve a potential criminal offence under the railway byelaws, the appeals process we reference is an administrative review mechanism designed to ensure that the matter is properly investigated, and the correct party is held accountable.
In accordance with the enforcement procedures under Byelaw 14 of the Railway Byelaws, the appeals process is a non-judicial review that allows recipients to challenge the validity of the charge based on the circumstances surrounding the alleged breach. This process provides an opportunity for the train operating company or relevant authority to review whether the penalty notice was appropriately issued, and for any mitigating factors to be considered.
It is important to note that this appeals process does not alter or replace the statutory provisions under the byelaws. If the matter proceeds beyond the appeals stage, it may be referred for criminal prosecution if deemed necessary. The appeals process, therefore, acts as a preliminary step in ensuring that no unfair or incorrect penalties are applied, rather than replacing or overstepping the jurisdiction of the criminal justice system.
Any decision made by POPLA is only binding on the car park operator and therefore the use of this independent appeals service benefits the consumer/motorist.
• Why are you asserting that you have a legal basis to infer vehicle ownership from DVLA registered keeper data, when this is explicitly contradicted by the front page of the V5C and by DVLA guidance?
• Why are your communications inconsistent as to who you believe is liable—at times addressing the keeper, at other times the driver or “owner”—with no coherent explanation?
Our access to DVLA data is governed by the Keeper at Date of Event (KADOE) contract, which permits APCOA to request the registered keeper’s details for the purpose of enforcing parking terms and conditions or pursuing relevant offences.
While the V5C document does indicate that being the registered keeper is not proof of ownership in itself, there is a legal presumption that the registered keeper is the owner of the vehicle unless evidence to the contrary is provided. This is reflected in the Vehicle Excise and Registration Act 1994, which defines an “owner” as the person by whom the vehicle is kept. In the case of a registered vehicle, this is presumed to be the person in whose name the vehicle is registered.
Accordingly, when investigating a breach of the railway byelaws, and in the absence of any information suggesting otherwise, it is both reasonable and appropriate for us to correspond with the registered keeper as the presumed owner of the vehicle. Under contract law, only the driver can be liable as they are present when the parking contract is both offered and accepted. However, under the Railway Byelaws, it is made clear that the owner is the liable party.
• Why are your communications inconsistent as to what contravention is even alleged to have taken place?
The Penalty Notice clearly states that the Penalty Notice was issued for the offence of "Use of private car park without making a valid payment". Whilst payment was made for the parking session, the payment is deemed as invalid as the incorrect tariff was paid.
The ANPR systems captured the vehicle entering Bedford Station car park at 07:31:29 meaning that the full one day tariff of £11.30 was due, however, as payment was only made at 13:08:38 the incorrect tariff of £4.60 was paid due to the off peak tariff being activated at 10:00am.
• What failing occurred that allowed your customer service team to ignore straightforward questions from a customer attempting to resolve the matter?
• Why do different members of your staff have conflicting views on what information it is appropriate to disclose to a customer?
The chat transcripts have been reviewed by APCOA management and has been found to be below the high standards that APCOA work to. As a result, an internal investigation has been conducted and a conclusion is that the fails were due to insufficient training of the customer service agents who handled your queries. The agents involved have now been given the required additional training.
Whilst we’re unable to comment on internal processes and their outcomes, rest assured the level of customer service given to all customers, and the conduct of all APCOA staff is a top priority and as such, we are treating this matter extremely seriously.
APCOA would like to take this opportunity to thank you for bringing this to our attention and also offer our sincere apologies for the less than satisfactory level of customer service that you received on this occasion.
• Given I was told that information was disclosed to me which "shouldn’t have been", what assurances can you provide that my personal data—and that of your other customers—is being handled lawfully and securely?
• On what lawful basis under the UK GDPR are you processing and storing my personal data?
We can confirm that your personal data has been redacted from the below cases:
Please see below links to both APCOA's privacy policy and data protection policy which outline how APCOA handles your personal data.
APCOA Privacy Policy - https://www.apcoa.co.uk/privacy-policy/
APCOA Data Protection Policy - https://www.apcoa.co.uk/index.php?id=6296
If you have any concerns or queries relating to how APCOA have handled your details, you can contact our Data Protection Office via email on DPO@apcoa.com
Kind regards,
Complaints Handler
APCOA
Good Afternoon,
Thank you for your email to the Data Protection Office at APCOA Parking (UK).
Please complete the attached form and return in order that we can provide the requested information.
Please be advised that you are not obliged to complete this form to make a request, but it’s helpful for us to know what you’re looking for so we can respond fully and promptly. Although the completion of this form is not a requirement, proof of identification is still required. The timescale for responding to your request will start when we receive this.
Yours Sincerely,
Dear [Name],
We are currently reviewing the points raised in your complaint and a full response will be issued to your complaint in due course.
Thank you for your patience during this time
Kind regards,
[Name]
Complaints Handler
APCOA
Subject: Failure to Respond to Formal Complaint – Final Reminder Prior to Escalation
Dear [Complaints Handler / APCOA Complaints Department],
I am writing to express my deep dissatisfaction with your continued failure to properly address the formal complaint submitted on [insert date]. Your email of 22 March 2025—while acknowledging cancellation of the spurious “Penalty Notice”—did not even attempt to provide a full and substantive response to the serious matters raised.
I remind you once again that your obligations are clear. As per Section 11.4 of the BPA/IPC Private Parking Sector Single Code of Practice (PPSCoP):“A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.”
No such full response has been received, and no justification has been offered for this delay. In the absence of any reasonable explanation, your failure to comply with both your own policy and the industry Code of Practice amounts to a flagrant disregard for accountability and transparency.
To be absolutely clear: this matter is not closed. You are under a continuing obligation to provide a detailed and point-by-point reply to the concerns I raised. Your attempt to offer a generic, dismissive response while hoping the issue would disappear has been noted and will not be accepted.
I will now allow a further 7 days for you to issue a complete and substantive response addressing all of the following:• The basis on which you purport to issue “Penalty Notices” that imply criminal liability, despite being a private contractor with no statutory authority.
• The misuse of Byelaw 14 to pursue civil enforcement outside the scope of prosecution under Byelaw 24(1).
• The misleading reference to criminal sanctions and statutory enforcement powers in your correspondence.
• Your misuse and misinterpretation of DVLA keeper data in an attempt to establish liability.
• The contradictory and inconsistent statements made by your staff regarding the nature of the alleged contravention, the liable party, and the appeals process.
• The failure of your customer service agents to engage with basic queries or offer any clarity to the recipient of your demands.
• The apparent mishandling of personal data, including comments suggesting that information disclosed to me "shouldn’t have been," which raises significant concerns over your internal data governance and staff training.
• The lack of clarity on what alleged contravention occurred, and why no coherent explanation has ever been given.
If a full response is not received within 7 days, I will escalate this matter formally to the British Parking Association, the DVLA, and, where applicable, to the Information Commissioner's Office. I also reserve the right to report the matter to the police on the basis that your use of intimidating and misleading documents may constitute an offence under Section 2 of the Fraud Act 2006.
Let there be no doubt: this is not a matter that will simply be allowed to lapse. You are now on notice to comply with your obligations in full.
Yours sincerely,
[Your Name]
[Your Address]
[Reference number, if applicable]
Dear Sir/Madam,
RE: SUBJECT ACCESS REQUEST
I write to make a formal Subject Access Request in respect of my personal information. I am entitled to make this request under data protection laws. The request is made in accordance with section 45 of the Data Protection Act 2018 and Article 15 of the retained EU General Data Protection Regulation 2016/679 (UK GDPR). You can identify my records using the information which is listed below.
For clarity, this request is directed to APCOA Parking (UK) Ltd and all affiliated companies and data controllers within the APCOA group, including but not limited to:– APCOA Parking (UK) Ltd
– APCOA Parking Holdings (UK) Ltd
– APCOA Facilities Management (UK) Ltd
– APCOA Parking Services Ltd
– APCOA Parking Group GmbH (as the parent company)
– Any other UK or EEA-based subsidiaries, affiliates, or contractors acting as data processors or controllers on behalf of the APCOA group
Requester (data subject) information
(a) Full name:
(b) Address:
(c) Email address:
(d) Telephone number:
(e) PCN number:
(f) VRM:
Requested information(a) Copies of my personal data
I request that I am provided with full copies of all personal data relating to me which is held by the APCOA group as outlined above. I would prefer to receive an electronic copy of the requested information.
(b) Purpose of the processing
Please confirm within your response the purpose(s) for which my personal data was collected and processed by any part of the APCOA group.
(c) Categories of the data
Please confirm which categories of my personal data have been collected or processed by any APCOA group company.
(d) Sharing of the data
Please confirm which recipients (including any third parties) my personal data has been or may be disclosed to. This includes disclosure to debt collection agencies, solicitors, or international entities. Please also confirm whether any data has been transferred outside the UK and, if so, the applicable safeguards in place.
(e) Storage of the data
Please provide the applicable data retention periods, or if no specific period is available, the criteria used to determine such periods.
(f) Source of the data
Please confirm the original source(s) of the data held about me.
(g) Details about automated decision-making
Please advise whether any automated decision-making has taken place using my data and provide full details of the logic involved and potential effects of such decisions.
(h) Existence of my rights
Please confirm my rights in respect of this data, including the rights to rectification, erasure, restriction, and objection to processing.
Responding to my request
The above contains all necessary information in order for you to process my request and any delay by yourselves will not absolve you from providing me with the information within one calendar month of the date above as this is being sent to you as an attachment by email.
I believe that the information which has been requested should be readily available to you.
This request should not therefore fall within the legal definition of an excessive or manifestly unfounded request and should not attract any processing fee.
I would be grateful for your assistance in processing my request within the required one month period of your receipt.
Yours faithfully,
[Your Full Name]
Subject: Formal Complaint – Demand for Full Response Under Code of Practice
Dear [Complaints Handler],
Firstly, thank you for confirming that the final “Penalty Notice” has been rightfully cancelled.
I may be misinterpreting, but the tone of your message somewhat suggests this is intended to serve as your formal response to my complaint. I’m sure I don’t need to remind you, but per Section 11.4 of the BPA/IPC Private Parking Sector Single Code of Practice:“A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.”
To be clear, I wouldn’t expect you to “comment on internal processes and their outcomes”, as stated in your email, but I do expect a full and substantive reply to the serious concerns I raised. To summarise:• Why are you, an unregulated private parking company, issuing fake “Penalty Notices” designed to mislead motorists into believing you possess statutory or criminal enforcement powers which you clearly do not?
• Why are you attempting to rely on Railway Byelaws to justify civil enforcement of minor parking indiscretions, despite knowing full well that such matters do not fall within the scope of criminal prosecution under Byelaw 24(1)?
• Why are you directing recipients to a private appeals process in circumstances where you are claiming a statutory breach? Appeals panels have no jurisdiction over alleged criminal offences.
• Why are you asserting that you have a legal basis to infer vehicle ownership from DVLA registered keeper data, when this is explicitly contradicted by the front page of the V5C and by DVLA guidance?
• Why are your communications inconsistent as to who you believe is liable—at times addressing the keeper, at other times the driver or “owner”—with no coherent explanation?
• Why are your communications inconsistent as to what contravention is even alleged to have taken place?
• What failing occurred that allowed your customer service team to ignore straightforward questions from a customer attempting to resolve the matter?
• Why do different members of your staff have conflicting views on what information it is appropriate to disclose to a customer?
• Given I was told that information was disclosed to me which "shouldn’t have been", what assurances can you provide that my personal data—and that of your other customers—is being handled lawfully and securely?
• On what lawful basis under the UK GDPR are you processing and storing my personal data?
Additionally, your use of the term “Penalty Notice”, coupled with the implied criminal consequences, is highly misleading. You are not a prosecuting authority, and your notice cannot be lawfully construed as anything more than a speculative civil invoice. Its presentation—suggesting legal obligation and criminal liability—appears to constitute a breach of Section 2 of the Fraud Act 2006, namely:“False representation made dishonestly and with intent to make a gain or cause loss.”
In other words, this was an attempt at extortion by deception.
I therefore repeat: this matter is not closed. You remain under an obligation to respond properly to the complaint raised. If a complete response is not received within the statutory timeframe, I will escalate the matter to the BPA, the DVLA, and reserve the right to report it to the police as a matter of criminal fraud.
Yours sincerely,
[Full Name]
[Address]
Briefing Note: Misleading Use of “Penalty Notices” by Private Parking Companies on Railway Land – Urgent Clarification Required from the Department for Transport
To: [MP's Name]
From: [Your Name / Constituent of [Constituency]]
Date: [Insert Date]
Subject: Misuse of Statutory Language and Questionable Legal Authority by Private Parking Operators at Railway Car Parks
Summary
This briefing seeks your support in raising a Parliamentary Question to the Secretary of State for Transport concerning the apparent misuse of statutory language and implied criminal enforcement powers by private parking companies operating on railway land.
Despite the DfT's tacit acceptance of civil parking enforcement under Byelaw 14, private parking companies continue to issue documents styled as “Penalty Notices”, misleadingly implying they have the authority to impose statutory criminal fines under Byelaw 24(1) — authority which they do not possess. The Department’s own correspondence acknowledges this distinction, yet fails to correct the confusing and legally dubious language being used.
Legal Distinction: Byelaw 14 vs. Byelaw 24(1)
The Railway Byelaws permit two separate and legally distinct enforcement mechanisms:1. Byelaw 14(4)(i): Permits civil, contractual charges for minor parking infractions, such as overstaying or failure to pay. These are essentially Parking Charge Notices (PCNs) issued under a contractual agreement between the motorist and the operator.
2. Byelaw 24(1): Grants power to prosecute offences under the byelaws in the Magistrates’ Court, resulting in criminal penalties. This route is reserved for serious or repeated breaches and must be initiated by the Train Operating Company or a body with explicit statutory delegation.
The Department for Transport has confirmed that it has no issue with operators issuing PCNs under Byelaw 14(1)-(3) as a civil mechanism for handling minor parking matters. However, the Department has not authorised private parking companies to act under Byelaw 24(1), nor has it suggested that such powers have been delegated to them.
Key Concerns1. Misuse of the Term “Penalty”
The DfT’s own correspondence refers to these charges as “penalties” [sic], a term which normally implies statutory or criminal consequences. This introduces serious ambiguity, potentially misleading motorists into believing they are being fined under criminal law. In reality, these are civil charges, and using the word “penalty” is legally and ethically problematic.
2. No Statutory Basis for Criminal Enforcement by Operators
Nowhere in DfT guidance or byelaw structure is there any confirmation that a private operator may issue a Penalty Notice with criminal implications. Any such action would require formal delegation under Byelaw 24(1), which has not occurred. As such, any implication of criminal liability is unfounded and misleading.
3. Potential Breach of Law
Operators issuing these misleading notices are in breach of:• The Fraud Act 2006 – Section 2: false representation made with intent to gain or cause loss
• The Consumer Protection from Unfair Trading Regulations 2008 – Regulation 5: misleading actions likely to cause transactional decisions
• The Companies Act 2006, if corporate identity is used in a way that falsely implies statutory authority
Additionally, the retention of monies paid under such notices in the operator’s private account — rather than remitting to the TOC or public purse — reinforces the view that these are private civil claims masquerading as criminal penalties.
4. Inappropriate Use of Appeals Processes
The DfT encourages operators to provide an independent appeals process (such as POPLA or the IAS), which is appropriate for civil PCNs but has no place in criminal enforcement. Criminal matters are subject to due process through the courts — not private appeals panels.
Conclusion
The DfT has blurred the lines between civil and criminal enforcement, allowing private companies to exploit that ambiguity. While the Department accepts civil charges under Byelaw 14(4)(i), it has failed to intervene where operators unlawfully imply statutory authority and criminal consequences, causing considerable public confusion and potential legal harm.
Proposed Parliamentary Question
I respectfully ask you to table the following question to the Secretary of State for Transport:"To ask the Secretary of State for Transport whether he will clarify the Department's position on the enforcement of railway byelaws in car parks managed by private parking companies; specifically, whether he accepts that Byelaw 14(4)(i) authorises only civil contractual charges and not criminal penalties, and that any implication by private operators that they possess statutory authority to issue 'Penalty Notices' under Byelaw 24(1) without explicit delegation is misleading, unlawful, and potentially a breach of consumer and fraud legislation."
Alternatively, a follow-up could be:"To ask the Secretary of State for Transport what steps his Department is taking to prevent private parking operators from misrepresenting civil Parking Charge Notices as statutory 'Penalty Notices' when enforcing railway byelaws; and whether he will review the Department’s communications to ensure that the term 'penalty' is not used in a way that conflates civil enforcement under Byelaw 14(4)(i) with criminal prosecution powers under Byelaw 24(1), for which private operators have no statutory authority."
Supporting Documents
Further examples of misleading “Penalty Notices,” as well as correspondence from the DfT acknowledging the contractual nature of Byelaw 14, can be provided upon request.
Thank you for your time and attention to this matter. I hope you will consider taking action to help restore clarity and protect motorists from deceptive practices.
Yours sincerely,
[Your Full Name]
[Your Address & Postcode] (to confirm constituency)
[Your Email / Phone (optional)]
Dear [COMPLAINT HANDLER],
Firstly, thank you for confirming the final ‘Penalty Notice’ has been rightfully cancelled.
I may be misinterpreting, but the tone of your message somewhat suggests this is your formal response to my complaint. I’m sure I don’t need to remind you but per the Private Parking Sector Single Code of Practice 11.4:
A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.
To be clear, I wouldn’t expect you to "comment on internal processes and their outcomes” per your message, but I do expect a full and thorough response to the real concerns raised in my complaint. In summary:
1. Why are you, an unregulated parking company, issuing fake “Penalty Notices” which appear designed to mislead motorists that you have authority that you do not?
2. Why are you even suggesting that Railway Byelaws are remotely relevant in cases of minor parking indiscretions on railway land?
3. Why are you suggesting that a private parking ‘appeals process’ is even vaguely relevant in the case of a breach of Railway Byelaws?
4. Why are you wrongly claiming you have any legal basis to infer the owner of a vehicle based on its registered keeper?
5. Why between your different communications are you unclear on which party you are trying to hold accountable?
6. Why between your different communications are you unclear on what alleged contravention has even occurred?
7. What failing has occurred that your customer service team think it’s acceptable to ignore a customer asking reasonable questions?
8. What failing has occurred that two different members of your customer service team have different views of what information it is okay to share with a customer?
9. Given I was told that information was disclosed to me that shouldn’t have been, what assurances can you offer that my personal information, and that of your other customers is safe?
10. On what lawful basis under GDPR have you been processing and storing my personal data?
Regards,
[G6PRK]
Anyone care to take that bet?QuoteI'll save my losing bets for Cheltenham next week ;D
Very good. Send it.
However, you should also get your MP involved at this point and show him all the advice and copies of all correspondence so far.
You can explain to the "owner", that nothing can ever come this, even if they ignore everything from APCOA.
Okay - thanks.A significant percentage of people just pay up because they’re intimidated or can’t be bothered, APCOA and the rest know this, how much does it cost to send a letter for which they get £100 in return?
If they never follow through on any type notice, it begs the question why does anyone bother paying for parking in the first place! ;D
This is the economics of private car parking.
Some companies actually bother to go further, but there are diminishing returns in this for them.
If you know who does or doesn’t, then - as you say - don’t bother paying. Until they change their policy.
Tell them to show who the “owner” is by referencing the details from the official “Register of UK Vehicle Owners”.
Have a look at the front of any V5C document and tell us what it says very clearly on the front, in bold white, capital letters about ownership.
Okay - thanks.A significant percentage of people just pay up because they’re intimidated or can’t be bothered, APCOA and the rest know this, how much does it cost to send a letter for which they get £100 in return?
If they never follow through on any type notice, it begs the question why does anyone bother paying for parking in the first place! ;D
The issue I have is that they are refusing to transfer 'liability' for one of the noticesThey are claiming that they are pursuing a breach of railway byelaws. Under these byelaws, it is the owner of the vehicle that is liable:
I really can’t be bothered reading all that swill from “Holly”. I don’t know why you are wasting your time.
Just ignore everything. They cannot do anything. If it were a real Penalty Notice, they could only recover it through the magistrates court. As they are pretending (unlawfully) that it is a Penalty Notice, they cannot recover it as a civil contractual matter through the county courts.
Just ignore any further correspondence from them. If they try to issue a claim through the county courts, it would be thrown out.