The car park at Crystal Palace Park is not just any private car park—it’s located on land that falls under statutory control because it’s part of a public park with its own set of byelaws. While the London Borough of Bromley has general byelaws for its parks and open spaces, Crystal Palace Park operates under its own distinct set of byelaws. These unique byelaws were acknowledged in a Freedom of Information request, highlighting that the park has non-standard regulations separate from the borough's general provisions.
That means the Protection of Freedoms Act 2012 (PoFA) does not apply here. Since this land is governed by local byelaws, it is not considered “relevant land” under PoFA. Therefore, CPM cannot rely on PoFA to hold the Keeper liable for the charge. This is important because unless the Keeper was also the driver (and this is proven or admitted), CPM can’t pursue the Keeper in court just based on keeper liability.
Considering the context—managing two small children alone and the car park being half empty—it is a minor overstay that would not be considered unreasonable or disruptive. The fact that the landowner has the power to cancel and has been contacted is good. It would also be worth pointing out to them that CPM should not be issuing PoFA-based charges on land governed by byelaws.
CPM are in breach of the PPSCoP because they have issued an NtK with a PoFA warning. This breaches section 81.1.(d) which states:
"The parking operator must not serve a notice which in its design and/or language: state the keeper is liable under the Protection of Freedoms Act 2012 where they cannot be held liable."
This means that they have also breached the KADOE contract with the DVLA and warrants a formal complaint about them.
First thing to do, if you don't manage to get the landowner to get them to cancel the PCN is to submit an appeal to CPM on Monday 12th May (put this in your diary and don't forget to do this) you send the following as an appeal to CPM:
I am the keeper of the vehicle and I dispute your 'parking charge'. I deny any liability or contractual agreement and will be making a complaint about your predatory conduct to your principal, the Crystal Palace Park Trust.
You are attempting to hold me liable under the Protection of Freedoms Act 2012 (PoFA), yet the car park in question is situated on land governed by statutory control – namely, Crystal Palace Park, which is subject to its own byelaws. This land is therefore not classified as 'relevant land' under Schedule 4 of PoFA 2012, and as such, you cannot invoke keeper liability.
Your Notice to Keeper is therefore fundamentally flawed. As there is no legal basis to hold the keeper liable, there will be no admission as to who was driving, and no assumptions or inferences can be drawn. Your client has no basis for proceeding against a keeper in these circumstances.
Do not insult my intelligence by inviting me to engage with your sham of an Independent Appeals Service (IAS), which is neither independent nor fair. I will not be wasting time with that kangaroo court. If you wish to pursue this matter further, I suggest you issue a claim so the matter can be heard in a real court, where I will seek to recover my costs for unreasonable conduct.
I urge you to do the sensible thing and cancel this charge.
In the meantime, I advise you to also submit a formal complaint about this rogue operator to the DVLA.
Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against UK Car Park Management Ltd (CPM), an IPC AOS member with DVLA KADOE access, for breaching the IPC/BPA Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While CPM may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—by pursuing a parking charge on non-relevant land where Schedule 4 of PoFA 2012 cannot apply—renders their use of my data unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement explaining the nature of the breach and CPM’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: UK Car Park Management Ltd (CPM)
Date of PCN issue: [INSERT DATE]
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report a misuse of my personal data by UK Car Park Management Ltd (CPM), who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although CPM may have had reasonable cause to request my data initially, the way they have used that data afterwards amounts to unlawful processing. This is because they have acted in breach of the IPC/BPA Private Parking Single Code of Practice (PPSCoP), which forms part of the contractual framework allowing access to DVLA keeper data.
In particular, CPM has issued a Parking Charge Notice (PCN) for an alleged overstay at Penge Car Park, 81 Thicket Road, London SE20 8DS, which lies within Crystal Palace Park. This land is subject to statutory control by virtue of specific byelaws that apply to the park. As such, it is not classified as "relevant land" under Schedule 4 of the Protection of Freedoms Act 2012 (PoFA), and CPM cannot invoke keeper liability against me.
Despite this, CPM has continued to pursue the keeper of the vehicle and issued a Notice to Keeper that attempts to imply PoFA compliance. This amounts to a misleading and unlawful use of DVLA data, as the data was obtained on the premise that PoFA could apply. It cannot.
The PPSCoP requires operators to act fairly, transparently, and within the bounds of the law when pursuing charges. CPM has breached this obligation by using DVLA keeper data to pursue a charge that is not lawfully enforceable against the keeper, and doing so in a misleading way.
These are not minor breaches. They demonstrate a disregard for the rules governing the use of DVLA data and undermine public trust in the system. CPM is no longer using the data for a permitted purpose under the KADOE contract.
I therefore request that the DVLA investigates this matter and considers appropriate enforcement action, which may include:
• Confirming that a breach has occurred
• Taking enforcement action against the operator
•Suspending or terminating their KADOE access if warranted
I have attached relevant supporting material with this statement. Please confirm receipt and provide a reference for this complaint. I am also happy to provide further information if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]