Good update. A few targeted points to tighten the strategy and maximise prospects if you've not actually sent that to Bank...
This is actionable advice, focused and from your position as the Hirer...
1. Legal basis to rely onBring a claim under the Data Protection Act 2018, relying on UK GDPR Articles 5(1)(a) and 6(1)(f). Their first breach of your GDPR rights started when they first received and used your personal data from the leasing company without reasonable cause, then continued with the NtH and later chasing. Cite the missed SAR deadline as a separate breach of Articles 12(3) and 15. PoFA non-compliance and the fact the driver is unidentified are context showing you were never liable.
2. Tighten the ask and quantumStop offering £70. Demand £210 total now: £10 material loss (hire admin fee) plus £200 distress. Add s.69 County Courts Act interest if you issue. Keep a single figure; do not invite negotiation.
3. What to keep from your draftKeep the chronology, the prepayment fact, the dates of PCN, NtH, “final reminder”, debt letter, the cancellation and apology, and the SAR date and deadline. Keep the point that they sought keeper data when there was no breach to investigate. Keep that their NtH was not PoFA compliant and the driver has not been identified.
4. What to change in your draft (if not too late)Strip all insults. Replace “incompetence” language with “no reasonable cause” and “no lawful basis under UK GDPR”. Insert the legal hook: DPA 2018 s.168 and UK GDPR Articles 5(1)(a), 6(1)(f), plus 12(3) and 15 for the SAR breach. State that settlement will not affect their duty to comply with the SAR. Give a clear 14-day deadline and say you will issue a claim on day 15.
5. Immediate actions (do these now, in parallel)• ICO: lodge a complaint today for missed SAR deadline. Attach the SAR, their 17 Oct apology, and your chronology.
• DVLA: You’re reporting operator (Bank Parking) misuse of DVLA keeper data (no “reasonable cause”) under Reg. 27/KADOE. DVLA can investigate KADOE abuse regardless of who reports it.
Your standing: you’re the affected Hirer. DVLA’s release to the RK triggered downstream processing of your data and a £10 charge. That gives you a legitimate interest to report suspected misuse.
How to frame the complaint. Say: “I’m the hirer affected by PCN [ref] for VRM [VRM]. Bank accessed DVLA keeper data on [date] without reasonable cause because parking was prepaid. They later admitted the PCN was ‘issued in error’ and cancelled.”
Attach: prepayment proof, Bank’s cancellation/apology, the NtH, the hire firm’s £10 invoice, timeline.
Ask DVLA to: audit Bank’s ‘reasonable cause’ for that enquiry and take compliance action under KADOE.
• Erasure/restriction: Send an Article 17/18 notice to Bank requiring erasure/suppression of your personal data for this PCN unless they can evidence a lawful basis to retain; demand confirmation in 14 days.
• Leasing company: optionally ask for a goodwill refund of the £10 due to misdescription (“motoring offences/fines”) and the operator’s admitted error. If they refund, you will reduce the Bank claim to distress only to avoid double recovery.
6. Evidence pack to finalise before issue• Prepayment proof for the VRM and date.
• PCN, NtH, final reminder, debt letter.
• Cancellation email and the apology admitting “issued in error”.
• Hire company invoice for £10 and proof you owe/paid it.
• Your SAR email and one chaser.
When they finally respond to the SAR: DVLA request/response timestamps, payment/VRM logs, internal audit trail, lawful basis record, and the recorded cancellation reason.
7. Anticipate their defence and your replyThey will plead legitimate interests and honest mistake. Your reply: no reasonable cause at the outset because a basic check of their own systems would have confirmed a valid pre-paid session; legitimate interests fails where necessity and proportionality are missing. Continued processing and a debt letter after cancellation aggravate the breach.
8. If no payment in 14 daysIssue a small claim against Bank for £210 plus interest and fee. Keep particulars short: prepaid parking; unlawful DVLA trigger; your personal data obtained from the leasing company; NtH despite no breach; cancellation and apology; missed SAR deadline; damages under DPA 2018 s.168.
That’s it. Keep it clean, legal, quantified, and on a 14-day clock.
