Good to know that they have said that they cannot provide the evidential photos for the alleged contravention on 19/11/2024.
As this is a single parking event, if the vehicle never moved on 19/11/2024, issuing two PCNs on the same day for the same stationary presence is, in substance, a duplication of the same alleged breach. A private parking charge is a liquidated sum for breach of a single contractual term at a given time/place. Where there is one continuous breach, the correct construction is one cause of action, not multiple rolling causes every time an operative wanders past.
Re-ticketing without any intervening windscreen notice (so the motorist remains unaware) is predatory. Even operators’ own practices and the PPSCoP expect fairness and reasonableness around multiple charges for the same event. Courts regularly view serial ticketing of a single event as unreasonable.
They must have made two DVLA requests for your data and have breached your GDPR and you will be able to sue them for compensation under the Data Protection Act. Never, EVER phone these scammers. EVERYTHING must be in writing, preferably by email.
The first thing you must do immediately is SAR the DVLA. Use this form
MIS1065 'DVLA subject access request (SAR)' and complete sections 1 and 3 and email it to subjectaccess.requests@dvla.gov.uk.
At the same time send the following DVLA complaint to kadoeservice.support@dvla.gov.uk and CC yourself:
I am the registered keeper of VRM [ABC123]. I make a formal complaint that DVLA released my keeper data more than once to UK Car Park Management Ltd (UK-CPM) or its agents in relation to a single continuous parking event at the Barkantine Estate in November 2024.
Background
The vehicle did not move at any time on 19/11/2024. UK-CPM issued two Notices to Keeper for that same continuous stationary presence, using different sub-labels for the same estate: (1) “Topmast Point, Barkantine Estate” timed 07:24; and (2) “The Quarterdeck, Barkantine Estate” timed 15:15. A further PCN was issued for 20/11/2024. When asked for evidential photographs for 19/11/2024, UK-CPM stated they could not provide them. I believe DVLA disclosed my data more than once for the same continuous event.
Basis of complaint
Regulation 27 of the Road Vehicles (Registration and Licensing) Regulations 2002 permits disclosure only where there is reasonable cause. The KADOE contract requires requests to be accurate, necessary and proportionate, prohibits duplicate or speculative enquiries, and limits use of data to the specific incident for which it was requested. Using different sub-labels within the same managed estate (Barkantine Estate) for a single continuous stationary presence does not create a fresh reasonable cause to obtain keeper data again.
Industry Code breach
The Private Parking Single Code of Practice (v1.1, 17 February 2025) at section 8.3 states:
“Parking operators must ensure that they only issue Parking Charges in accordance with their advertised terms on any site. Such terms shall not entitle any operator to issue more than one parking charge in the same calendar day for the same parking event.”
UK-CPM issued two PCNs on 19/11/2024 for the same continuous stationary presence. This is inconsistent with §8.3 and indicates that any second KADOE enquiry relating to that same event lacked reasonable cause.
Remedies sought
1. Please consider this apparent PPSCoP §8.3 breach when assessing reasonable cause and KADOE compliance, and liaise with the relevant AOS (BPA/IPC) as appropriate alongside DVLA’s own KADOE sanctions process.
2. Investigate all KADOE enquiries made for VRM [ABC123] between 01/11/2024 and 31/12/2024. Identify each enquiry that relates to Barkantine Estate on 19/11/2024 and determine whether multiple releases were made for the same continuous stationary presence, irrespective of any different sub-labels used.
3. For each relevant enquiry, provide the date and time, DVLA reference, the requesting entity’s legal name, the reason code and any free-text location or reason supplied (including any mention of “Topmast Point” or “The Quarterdeck”), and the incident date and time cited by the requester.
4. Explain the legal and contractual basis on which DVLA authorised multiple releases for one continuous event, or confirm that the duplicate disclosure(s) were non-compliant with Regulation 27 and KADOE requirements.
5. Confirm what compliance action DVLA will take under the KADOE regime (for example warning, sanction points or suspension) for any non-compliant duplicate enquiry.
6. Direct the operator and any agents or solicitors to erase personal data obtained via any duplicate or unlawful request and require written confirmation of erasure to me.
Please acknowledge receipt and provide a written outcome and complaint reference within 20 working days. I ask that all records relevant to these enquiries and this complaint are preserved pending conclusion.
Yours faithfully,
[Full name]
[Postal address]
[Email address]
[Telephone]
You can attach copies of the NtKs to the email.
Also, you send the following email to the UK-CPM DPO at dpo@uk-cpm.com and CC both complaints@uk-cpm.com and yourself:
Subject: Formal complaint and Letter Before Claim. Ref: PCN 1. [PCN number1] & PCN 2 [PCN number2]
Dear Sirs,
I am the registered keeper of VRM [ABC123]. This is a formal complaint addressed to the Data Protection Officer. It concerns UK Car Park Management Ltd’s processing of my personal data in relation to two PCNs issued on 19/11/2024 for a single continuous parking event at Barkantine Estate. The vehicle did not move at any point on 19/11/2024. Nonetheless, you issued two PCNs for the same stationary presence using different sub-labels within the same managed estate: “Topmast Point, Barkantine Estate” timed 07:24 and “The Quarterdeck, Barkantine Estate” timed 15:15. When asked for evidential photographs for that date, your company stated it could not provide them.
You appear to have obtained or caused the obtaining of my keeper data from DVLA more than once for the same continuous event. Re-accessing or re-processing keeper data for a duplicated charge lacks reasonable cause and is not necessary or proportionate. Your conduct breaches the Private Parking Single Code of Practice section 8.3 (no more than one parking charge in the same calendar day for the same parking event) and infringes UK GDPR and the Data Protection Act 2018, specifically Article 5(1)(a) (lawfulness, fairness, transparency), Article 5(1)(c) (data minimisation/necessity) and Article 6(1) (absence of a lawful basis for duplicate processing for the same event). It also constitutes unfair and excessive processing by onward disclosure to agents.
I require the following remedies and actions:
1. Cancel the duplicate PCN for 19/11/2024. Confirm that both 19/11/2024 notices arose from one continuous parking event and that all enforcement activity relating to any duplicate is ceased.
2. Apply Article 18 UK GDPR restriction to all records linked to the 19/11/2024 duplicate. Segregate that record from active workflows and cease processing and dissemination for the duplicate purpose. Preserve (do not delete) all data and logs for regulatory/litigation duties.
3. Under Article 16, rectify your records to reflect a single continuous event and notify all recipients of the rectification; confirm the duplicate PCN reference has been cancelled.
4. Acknowledge my Article 21 objection to any further processing for the duplicate purpose.
5. Identify each DVLA KADOE enquiry you or your agents made for the 19/11/2024 event (date/time, requester identity, reason code/free-text location, incident date/time) and list all third parties to whom you disclosed my data.
6. Pay compensation for distress caused by duplicate processing and multiple PCNs for one event (Article 82 UK GDPR; s.168 DPA 2018). I reserve quantum to be assessed; invite your proposals.
7. Confirm measures to prevent recurrence, including controls to avoid multiple PCNs for one event and duplicate DVLA requests.
Please acknowledge this complaint within 14 days and provide a full written response within 28 days. Treat this as a letter of claim for the purposes of pre-action protocols applicable to data protection claims. Pending resolution, require your agents including BW Legal and any debt recovery firms to cease processing and to place their files on hold. Preserve all records relevant to this complaint, including DVLA request logs, internal notes, patrol notes, images, site plans, and correspondence. I reserve all rights.
Yours faithfully,
[Full name]
And, for the time being, send the following email to BW Legal at SAR@bwlegal.co.uk and also CC enquiries@bwlegal.co.uk and yourself:
Subject: Data processing objection and restriction – Your ref: [BW Legal reference number]
Dear Sirs,
I am the registered keeper of VRM [ABC123]. There will be no identification of the driver.
Your debt recovery “final warning” dated 28/08/2025 refers to two PCNs dated 19/11/2024. Those two notices concern one continuous stationary presence at Barkantine Estate; the vehicle did not move. You are processing my personal data for both PCNs using data supplied by your client.
Your client had no reasonable cause to obtain or reuse my keeper data more than once for the same event (Regulation 27; KADOE). Duplicate PCNs for the same day/event also breach PPSCoP 8.3. Any onward disclosure to you for the duplicate purpose lacks a lawful basis (Articles 5(1)(a), 5(1)(c), 6(1) UK GDPR). As an independent controller you are jointly and severally liable with your client for unlawful processing and the distress caused (Article 82; s.168 DPA 2018).
Accordingly:
1. Record my Article 21 objection and apply Article 18 restriction to all processing relating to the duplicate 19/11/2024 PCN. Segregate that record from active workflows and cease processing and dissemination for the duplicate purpose. 2. Preserve all data and logs for disclosure.
3. Confirm within 7 days the lawful basis you rely upon for processing in relation to each of the two 19/11/2024 PCNs and identify the precise data source for each.
4. Confirm your file is on hold for the 19/11/2024 event pending resolution of my complaints to your client and the DVLA. All rights reserved.
Yours faithfully,
[Full name]
[Postal address]
[Email]
