You have 33 days from the appeal rejection date to use your POPLA code. Here is a suggested draft for your POPLA appeal:
I am the hirer of the vehicle and am appealing against this Parking Charge Notice on the following grounds:
1. The Notice to Hirer does not comply with Schedule 4 of the Protection of Freedoms Act 2012 (PoFA)
2. The allegation of “leaving the premises” is vague, unevidenced, and legally unenforceable
3. The signage is incapable of forming a contract for the alleged contravention
4. The operator is put to strict proof of signage near the vehicle and of any boundary warning signs
5. The operator is put to strict proof of landowner authority and contractual terms permitting PCNs for this alleged breach
1. The Notice to Hirer does not comply with Schedule 4 of the Protection of Freedoms Act 2012 (PoFA)
As the operator is attempting to hold the Hirer liable, they must comply with Paragraphs 13 and 14 of Schedule 4 of PoFA. They have failed to do so. The Notice to Hirer did not include the following mandatory enclosures:
• A copy of the original Notice to Keeper (Paragraph 13(2)(a))
• A copy of the hire agreement (Paragraph 13(2)(b))
• A statement of liability from the hire company (Paragraph 13(2)(c))
Furthermore, the Notice to Hirer did not include the mandatory warning prescribed in Paragraph 14(2), nor the separate liability warning required by Paragraph 14(5). These omissions are fatal to the operator’s attempt to transfer liability to the hirer. They have no lawful basis to pursue the hirer and this appeal must therefore be allowed.
2. The allegation of “leaving the premises” is vague, unevidenced, and legally unenforceable
The operator alleges that “the occupants left McDonald’s premises” but provides no definition, evidence, or legal foundation for this claim. It is unclear whether this alleged restriction applies to:
• The driver only
• One or more passengers
• All occupants of the vehicle, including children
The operator has not defined what constitutes “the premises.” Is it the interior of the restaurant, the entrance, the boundary of the car park, or some other undefined area? There is no indication of what boundary was allegedly crossed or where any contractual tripwire supposedly lies. Without defining this in signage or evidence, the operator cannot assert that a breach occurred.
Moreover, the operator has not provided any evidence to support the claim that any person left the premises. There is no timestamped footage, no log of observations, no details of who supposedly left, when they did so, or what part of the site they entered. It is impossible to determine whether any breach occurred, or who is alleged to have caused it. A contractual term must be communicated clearly and be enforceable. Here, the term is so vague and unworkable that it fails to meet even the basic standards of contractual clarity.
The operator appears to believe it can hold the hirer liable for the movements of unnamed third parties, regardless of whether they are even aware of the terms. This is legally and factually unsustainable.
3. The signage is incapable of forming a contract for the alleged contravention
The signage at the site does not clearly state that all occupants must remain on the premises, nor does it define what the premises are. The signs are addressed to drivers and make no provision for warning passengers or other individuals that they will trigger a breach simply by walking beyond an undefined area. A contract must set out clear and prominent terms that can be understood by all parties. It is unreasonable and unenforceable to rely on obscure or implied conditions which are not communicated with sufficient clarity.
The operator is put to strict proof that the signage clearly stated that all occupants must remain on the premises, that the premises were defined, and that breach of this alleged term would result in a parking charge being issued.
4. The operator is put to strict proof of signage near the vehicle and of any boundary warning signs
The operator is required to provide evidence of the signage near the location where the vehicle was parked. It is not sufficient to provide generic sign images from elsewhere on the site. The operator must show that the vehicle was parked within sight of a sign that:
• Clearly defined the premises
• Made the alleged term about remaining on the premises clear
• Warned the driver that a charge would be issued if any occupant left the premises
If the operator is asserting that a boundary was crossed, they are also required to show that boundary and any sign or marking that warned a person under a contractual obligation that they were about to be in breach by crossing it. Without such signage and markers, no contractual term can be said to have been breached.
4. The operator is put to strict proof of landowner authority and contractual terms permitting PCNs for this alleged breach
The operator must produce a valid, unredacted contract with the landowner that allows them to issue parking charge notices at this site. A simple witness statement or letter is not sufficient. The contract must:
• Be signed by the landowner or authorised agent
• Authorise the operator to take legal action in their own name
• Include express permission to issue PCNs for “leaving the premises”
A general statement of authority does not prove that the operator has permission to issue PCNs for a breach as unusual and specific as an occupant allegedly leaving undefined premises. The burden is on the operator to prove that the landowner has agreed to this condition and has authorised them to enforce it.
Conclusion
For the reasons set out above, the operator has failed to meet the legal requirements of Schedule 4 of PoFA, has failed to provide evidence of a breach, and has failed to prove that the signage is capable of forming a contract for the alleged contravention. They have also failed to evidence any boundary or warning signs and have not shown that they have the necessary landowner authority. I request that POPLA uphold this appeal and require the operator to cancel the parking charge.
Respond to MET with the following:
Subject: Formal Response – PCN AB22730675 (Vehicle: [Reg])
Dear MET Parking Services,
I write further to your letter dated 25th March 2025, and feel compelled to respond, if only to express how profoundly ludicrous your position has become.
Your allegation — that the “vehicle was left in McDonald's car park while the occupants left McDonald's premises” — deserves to be addressed plainly. Are you seriously suggesting that any occupant of a vehicle, regardless of whether they were the driver, is bound to remain hostage on the site under threat of penalty if they dare to step beyond some unmarked, undefined boundary? Is this an exercise in parking enforcement, or Cold War border control?
Even setting aside the fact that you’ve provided no evidence whatsoever to support this allegation (no surveillance footage, no timestamped observation, no indication of who supposedly “left”), the notion itself is unworkable. You offer no definition of what constitutes the “McDonald’s premises.” Is it the restaurant’s interior? The doorway? A few feet beyond the car? The car park perimeter? Where precisely is this invisible tripwire — and more to the point, how is any vehicle occupant meant to be warned about it before crossing it?
Your signage — assuming it even mentions this alleged rule at all — is not addressed to “occupants,” nor is it placed in a manner that would notify passengers, children, or any person other than the driver. Yet you appear to be claiming that the moment anyone exits the premises, the driver somehow breaches a contractual term. This is not only absurd, it is legally unsustainable and blatantly unenforceable.
To compound this, your Notice to Hirer is not compliant with Schedule 4 of the Protection of Freedoms Act 2012 (PoFA). It lacks:
• The original Notice to Keeper;
• A copy of the hire agreement;
• A statement of liability from the hire company;
• And the mandatory wording under Paragraph 14(5).
Instead, you leap straight to the stupid conclusion that the hirer is “liable”, a position which has no foundation in law. Your subsequent fishing expedition for the driver’s details is noted, but irrelevant. The hirer has already stated they were not the driver, and they are under no obligation to assist you in filling the gaping evidential holes in your case.
In summary, this Parking Charge is legally and factually hopeless. You may now:
• Cancel it in full, or
• Provide a POPLA code, so your fiction can be dealt with accordingly after you waste your money on the fee.
You are reminded that you will also be required to provide evidence to prove you have complied with PoFA paragraph 14(2). You will also be required to evidence that you have also complied with PoFA paragraph 14(5), which I already know that you haven't.
If you insist on persisting with this farce, given your ongoing misrepresentations of liability and your attempt to enforce a term that would be laughed out of any courtroom, I will be making a formal DVLA complaint about your dismal failures which amount to a breach of the KADOE contract.
You are now on notice.
Yours sincerely,
[Your Name]
You should also make a formal DVLA complaint anyway (even if only warning it in the response). Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against MET Parking Services Ltd, a BPA AOS member with DVLA KADOE access, for breaching the BPA/IPC Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While the Operator may have had reasonable cause to obtain the Registered Keeper’s details from the DVLA, they subsequently misused that data by pursuing me, the Hirer, in a manner that breached the PPSCoP and the conditions of lawful data use. The PPSCoP forms a binding part of the DVLA’s governance framework for third-party access to vehicle data. Continued access is conditional on full adherence.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: MET Parking Services Ltd
Date of of "event": 28th November 2024
Date of NtH issue: 27th February 2025
Vehicle registration: OV73EMF
I am submitting this complaint to report a misuse of my personal data by MET Parking Services Ltd (MET), who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although the parking company may have had reasonable cause to request my data initially, the way they have used that data afterwards amounts to unlawful processing. This is because they have acted in breach of the BPA/IPC Private Parking Single Code of Practice (PPSCoP), which is a mandatory requirement for access to DVLA keeper data. The PPSCoP forms part of the framework that regulates how parking companies must behave once they have received keeper data from the DVLA.
The KADOE contract makes clear that keeper data may only be used to pursue an unpaid parking charge in line with the Code of Practice. If a parking company fails to comply with the PPSCoP after receiving DVLA data, their use of that data becomes unlawful, as they are no longer using it for a permitted purpose.
I am submitting this complaint in my capacity as the Hirer of the above vehicle. The private parking company MET obtained details of the vehicle's Registered Keeper from the DVLA via the KADOE scheme and has used that information to issue a Notice to Hirer to me.
Although the Operator may claim to have had reasonable cause to access the Registered Keeper’s data, this is highly questionable given the absence of any factual basis for the alleged contravention. The claim that “vehicle occupants left the premises” is both unprovable and legally meaningless. Only the driver could ever be liable under contract law or the Protection of Freedoms Act 2012 (PoFA), and the Operator has neither identified the driver nor produced any evidence showing who allegedly left the site, when, or how this breached any visible term. The concept of pursuing a charge based on the movements of unnamed “occupants” — individuals who are not party to any alleged contract — does not amount to reasonable cause. No clear signage defines the premises’ boundary or warns occupants that crossing an invisible line would give rise to liability. In the absence of a genuine contravention or reasonable grounds to suspect one, the Operator’s request for vehicle data under the KADOE scheme was unjustified from the outset.
Furthermore, even if the initial request were valid (which is disputed), the Operator’s subsequent use of the data breached the BPA/IPC Private Parking Single Code of Practice (PPSCoP), which forms part of the mandatory governance framework for data access. As such, their processing of my personal data is unlawful.
The KADOE contract makes it clear that vehicle data may only be used for the fair and lawful pursuit of parking charges, in accordance with the Code. Where an operator breaches that Code, continued use of the data becomes unlawful.
In this case, [INSERT PPC NAME] has breached the Code in the following ways:
– Issued a Notice to Hirer without enclosing copies of the required documents under PoFA Schedule 4 Para 14
– Misrepresented the legal position by falsely asserting liability
– Failed to provide evidence of the alleged contravention
– Pursued a parking charge based on vague or unprovable allegations, such as “occupants leaving the premises”
– Ignored or bypassed the protections afforded to hirers under PoFA
These are not minor or technical breaches. They show a clear disregard for the standards required under the current single Code. As a result, the operator is no longer entitled to use the keeper data they obtained from the DVLA, because the purpose for which it was provided (a fair and lawful pursuit of a charge under the Code) no longer applies.
The DVLA remains the Data Controller for the data it releases under KADOE, and is therefore responsible for ensuring that personal data is not misused by third parties. This includes taking action against AOS operators who breach the conditions under which the data was provided. I am therefore asking the DVLA to investigate this breach and to take appropriate action under the terms of the KADOE contract.
This may include:
• Confirming that a breach has occurred
• Taking enforcement action against the operator
•Suspending or terminating their KADOE access if warranted
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]