Good update. A few targeted points to tighten the strategy and maximise prospects if you've not actually sent that to Bank...
This is actionable advice, focused and from your position as the Hirer...
1. Legal basis to rely on
Bring a claim under the Data Protection Act 2018, relying on UK GDPR Articles 5(1)(a) and 6(1)(f). Their first breach of your GDPR rights started when they first received and used your personal data from the leasing company without reasonable cause, then continued with the NtH and later chasing. Cite the missed SAR deadline as a separate breach of Articles 12(3) and 15. PoFA non-compliance and the fact the driver is unidentified are context showing you were never liable.
2. Tighten the ask and quantum
Stop offering £70. Demand £210 total now: £10 material loss (hire admin fee) plus £200 distress. Add s.69 County Courts Act interest if you issue. Keep a single figure; do not invite negotiation.
3. What to keep from your draft
Keep the chronology, the prepayment fact, the dates of PCN, NtH, “final reminder”, debt letter, the cancellation and apology, and the SAR date and deadline. Keep the point that they sought keeper data when there was no breach to investigate. Keep that their NtH was not PoFA compliant and the driver has not been identified.
4. What to change in your draft (if not too late)
Strip all insults. Replace “incompetence” language with “no reasonable cause” and “no lawful basis under UK GDPR”. Insert the legal hook: DPA 2018 s.168 and UK GDPR Articles 5(1)(a), 6(1)(f), plus 12(3) and 15 for the SAR breach. State that settlement will not affect their duty to comply with the SAR. Give a clear 14-day deadline and say you will issue a claim on day 15.
5. Immediate actions (do these now, in parallel)
• ICO: lodge a complaint today for missed SAR deadline. Attach the SAR, their 17 Oct apology, and your chronology.
• DVLA: You’re reporting operator (Bank Parking) misuse of DVLA keeper data (no “reasonable cause”) under Reg. 27/KADOE. DVLA can investigate KADOE abuse regardless of who reports it.
Your standing: you’re the affected Hirer. DVLA’s release to the RK triggered downstream processing of your data and a £10 charge. That gives you a legitimate interest to report suspected misuse.
How to frame the complaint. Say: “I’m the hirer affected by PCN [ref] for VRM [VRM]. Bank accessed DVLA keeper data on [date] without reasonable cause because parking was prepaid. They later admitted the PCN was ‘issued in error’ and cancelled.”
Attach: prepayment proof, Bank’s cancellation/apology, the NtH, the hire firm’s £10 invoice, timeline.
Ask DVLA to: audit Bank’s ‘reasonable cause’ for that enquiry and take compliance action under KADOE.
• Erasure/restriction: Send an Article 17/18 notice to Bank requiring erasure/suppression of your personal data for this PCN unless they can evidence a lawful basis to retain; demand confirmation in 14 days.
• Leasing company: optionally ask for a goodwill refund of the £10 due to misdescription (“motoring offences/fines”) and the operator’s admitted error. If they refund, you will reduce the Bank claim to distress only to avoid double recovery.
6. Evidence pack to finalise before issue
• Prepayment proof for the VRM and date.
• PCN, NtH, final reminder, debt letter.
• Cancellation email and the apology admitting “issued in error”.
• Hire company invoice for £10 and proof you owe/paid it.
• Your SAR email and one chaser.
When they finally respond to the SAR: DVLA request/response timestamps, payment/VRM logs, internal audit trail, lawful basis record, and the recorded cancellation reason.
7. Anticipate their defence and your reply
They will plead legitimate interests and honest mistake. Your reply: no reasonable cause at the outset because a basic check of their own systems would have confirmed a valid pre-paid session; legitimate interests fails where necessity and proportionality are missing. Continued processing and a debt letter after cancellation aggravate the breach.
8. If no payment in 14 days
Issue a small claim against Bank for £210 plus interest and fee. Keep particulars short: prepaid parking; unlawful DVLA trigger; your personal data obtained from the leasing company; NtH despite no breach; cancellation and apology; missed SAR deadline; damages under DPA 2018 s.168.
That’s it. Keep it clean, legal, quantified, and on a 14-day clock.
All good advice so far. Here is my assessment of the clause you have shown us:
The wording is deliberately broad. It covers “fines (including speeding, parking and congestion charge fines) or other sums or liabilities” and allows an admin fee “for each referral”. That will usually catch a private parking charge, because (a) it is an “other sum or liability”, and (b) all they’ve done is refer your details to the operator.
The bracketed examples (“speeding, parking and congestion charge fines”) point to statutory penalties, not private invoices. That creates ambiguity: “parking fines” in UK law are issued by councils/authorities, whereas Bank Parking Management Ltd issue contractual invoices. Under contra proferentem/CRA transparency, ambiguity is read against the drafter.
The invoice heading (“Motoring Offences Invoice” / “motoring offences/fines – issued by Bank Parking Management Ltd”) is inaccurate and arguably misleading. A private parking charge is not a motoring offence and not a fine. That misdescription strengthens a fairness/clarity challenge, even if the £10 is modest.
What this means for your prospects to challenge:
• Strict contractual position: they can likely rely on “other sums or liabilities” and “each referral”. On a black-letter reading, £10 for processing is not obviously unlawful.
• Fairness/ambiguity position: you have a credible argument that the clause and their invoice wording mislead consumers into thinking only fines/offences are covered; a private PCN is neither. That supports a complaint and a goodwill refund, and it’s the better hill to stand on if you choose to push.
• Practicality: £10 is recoverable, but litigating purely against the hire firm on clause construction is not cost-effective. Use complaint leverage first.
These are the routes I would advise you consider:
A) Ask the hire/lease company for a goodwill refund
– Grounds: (i) PCN cancelled; (ii) misdescription (“motoring offences/fines”) when the item was a private invoice; (iii) ambiguity around “parking fines” versus private PCNs; (iv) fairness/transparency under the Consumer Rights Act 2015.
– Outcome sought: refund the £10 and correct their billing descriptors so consumers are not misled.
– Escalation: if they are BVRLA members, threaten (and if needed, use) BVRLA conciliation.
B) Ask Bank Parking Management Ltd to reimburse the £10
– Grounds: their erroneous PCN (despite pre-payment) caused foreseeable loss (the admin fee). Keep it to actual, provable loss; courts don’t compensate “time/inconvenience” in small claims unless you run a separate data-protection distress claim.
– If they refuse, a small claim for the £10 plus court fee is straightforward and low risk.
C) Consider a narrow data-protection angle (optional)
– Only if, on disclosure, it appears Bank requested/used DVLA data or processed personal data without first checking their payment/whitelist records. If so, you could claim modest damages (often £50–£200) for distress plus the £10 as loss. To assess, send a SAR to Bank for ANPR hits, payment/VRM match logs, DVLA request/response timestamps, and the internal cancellation reason.
Here are two short templates you can use
1. Hire/lease company (goodwill refund request)
Re: Admin fee for “Motoring Offences Invoice” – Bank Parking Management Ltd
Dear Sirs,
I dispute the £10 admin charge applied for a “motoring offences/fines” referral. The underlying notice was a private parking charge from Bank Parking Management Ltd, not a motoring offence or fine, and it has now been cancelled.
Your invoice description is inaccurate and risks misleading consumers. Clause 9n refers to “fines (including speeding, parking and congestion charge fines)” and this creates ambiguity when contrasted with private parking invoices. Under the Consumer Rights Act 2015, terms and charges must be transparent and fair, and ambiguity is construed against the drafter.
As the notice was cancelled and no liability existed, please refund the £10 within 14 days and confirm you will amend your descriptors to avoid suggesting private invoices are “offences” or “fines”. If you decline, please confirm whether you are a BVRLA member so I may refer the matter to conciliation.
Yours faithfully,
[Your name]
2. Bank Parking Management Ltd (reimbursement of admin fee)
Re: Cancelled PCN Ref: [PCN reference number] – request for reimbursement of consequential loss
Dear Sirs,
You issued a PCN despite pre-paid parking. You have since cancelled the notice.
Your error caused a foreseeable loss: the vehicle hire company charged a £10 administration fee to process your enquiry. Please reimburse £10 within 14 days.
If payment is not received, I will consider a small claim for the fee, court costs and statutory interest under s.69 County Courts Act 1984.
Separately, please treat this as a request for the internal reason for cancellation.
Yours faithfully,
[your name]
Optional: SAR text to Bank (if you wish to explore a data-protection head)
Please supply, for PCN [ref], (i) all ANPR event data; (ii) payment/VRM match logs and whitelist hits; (iii) the internal case notes/audit trail; (iv) the DVLA request and response with timestamps; and (v) the recorded cancellation reason.
My suggestion... start with A (hire company goodwill refund) and B (seek £10 from Bank). If either pays, you stop. If both refuse and you want the point of principle, issue a claim against Bank for the £10; it is simple, proportionate, and they may settle.
Only add the data-protection claim after you’ve reviewed the SAR material that shows they went to DVLA before checking their own payment records.