APCOA are very easy to beat. They do not rely on PoFA to transfer liability from the driver to the keeper. They do not know the identity of the driver and there is no legal obligation for the keeper to identify the driver.
So, as long as you do not dob yourself in the mire by identifying as the driver, they have nowhere to go with this. Always select "Other" when appealing.
They have also breached your GDPR by requesting your DVLA data as they have breached the KADOE rules by not having checked their system for "orphan" images of your car exiting the first time and entering the second time. They are required to have human intervention when checking ANPR images. They have obviously failed to do this.
For now, simply appeal with the following text:
This is an appeal by the registered keeper - No driver details will be given. Please do NOT try the usual trick of asking for driver details in order to get around the fact your NtK does not comply with PoFA. As there is no keeper liability, therefore, liability cannot flow from the driver to the keeper and so, is an automatic win at POPLA. Please cancel the notice or issue a POPLA code at which point you will auto withdraw.
You must also complain (not appeal) to APCOA that they have failed to comply with clause 22.2 of the BPA Code of Practice (CoP) which states:
Quality checks: before you issue a parking charge notice you must carry out a manual quality check of the ANPR images to reduce errors and make sure that it is appropriate to take action.
Dear Sir/Madam,
Please consider this correspondence as an official complaint. You have issued a Parking Charge Notice (PCN) [PCN ref.] to me, the registered keeper of vehicle [VRM].
As I can evidence that the vehicle cannot have been at the car park for the whole duration alleged, it is obvious that no manual check was made of the ANPR data because, if it had been done, a search for the "orphan images" which show that the vehicle exited and then subsequently entered the car park in between the times alleged in your NtK would show that there was no valid reason to issue the PCN in the first place. This is a clear case of a "double dip" occurrence.
You have not only breached section 22.2 of the BPA CoP, you have also breached the Keeper At Date Of Event (KADOE) rules which mean that my data was requested from the DVLA in breach of my GDPR. I will be making a separate complaint to the DVLA about this breach. I expect a written apology and an assurance that this failure to follow the required manual check procedure before issuing an NtK will not happen again.
Depending on your response, I reserve my right to take this matter further due to your breach of Article 12 of the UK GDPR. Further action may include a claim for damages and compensation for breach of my GDPR by processing my personal data unlawfully.
I expect a full response to my complaint within 14 days as required by the BPA CoP section 31.24.
Yours faithfully,
For your information, Article 12 of the UK GDPR legally requires data controllers to store and process personal data accurately: clearly, any data controller issuing an invoice to you because it has wrongly recorded that you parked in breach of the alleged contract between you and the landowner (or, as in this case, an agent of the landowner) is processing your personal data unlawfully.
The precedents for claiming damages and compensation for such unlawful processing are the decisions of the Court of Appeal in Zeta Jones & Douglas v Hello! Magazine [2003] EWHC 786 and Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333, both being binding on all County Courts in England and Wales. In the latter claim, Mr Halliday was awarded compensation of £750 at what the Court regarded was the lowest level of award, and although this was a claim under Section 13 of the Data Protection Act 1998, similar provisions - amended to take account of a decision by the EU Grand Chamber that the 1998 Act did not properly implement EU law into UK domestic legislation - replaced the old Section 13 provisions with Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018.
In short, you ought to give 21 days notice (the pre-action protocol only really requires 14 days but hey, you can be charitable!) to the data controller of your intention to seek (say) £300 nominal damages and compensation under Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018 for their unlawful processing of your personal data: you could say that you will not file your claim with the County Court if they confirm in writing that all references to this alleged debt have been deleted within (say) 14 days. Clearly mark your letter as a "Letter before County Court proceedings".
Anyone who is fairly confident can claim as a litigant-in-person in Part 27 proceedings in the County Court (commonly but wrongly described as "the Small Claims Court"). Each party is responsible for their own legal costs whether they win or lose and the claim for £300 can be issued online for a fee of £35 at moneyclaimonline.gov.uk which also gives useful advice if you want to have a look at what is involved. Your claim will automatically be listed as being for a total of £335, i.e. the successful party gets their Court fees back.
