Free Traffic Legal Advice

I suggest you respond to CPSM with the following:

Quote

Subject: Formal Notice – Misuse of Personal Data and GDPR Breach

Dear CSPM,

I write further to your recent correspondence in which you admitted that my personal data was passed to Debt Recovery Plus before my POPLA appeal had been determined.

By disclosing my data to a third-party debt collector at a time when the charge was formally on hold, you have committed a serious breach of the UK GDPR and the Data Protection Act 2018.

There was no lawful purpose for this disclosure. Article 5(1)(a) UK GDPR requires lawfulness, fairness and transparency in all processing. Passing my data to DRP while appeal rights remained active fails all three.

Article 5(1)(c) UK GDPR requires that data be processed only to the extent necessary. At the appeal stage, no debt exists and no collection activity is permissible under the Private Parking Single Code of Practice (v1.1, 17 February 2025, Section 11.3). This renders your disclosure unlawful and unnecessary.

As a direct result, I received threatening and misleading debt letters which caused unnecessary distress and anxiety. Non-material damage of this type is explicitly recognised as compensable under Article 82 UK GDPR and Section 168 DPA 2018.

You are now formally on notice that:

• You have breached your statutory data protection obligations by unlawfully sharing my data with a third party.
• I will rely upon the Data Protection Act 2018 in holding you accountable. I reserve all rights, including the right to issue proceedings for compensation for the distress and harm caused.

I require your immediate confirmation that:

• My data has been recalled from DRP and permanently erased by them.
• No further unauthorised processing will take place.
• You have reviewed and corrected your internal processes to prevent this unlawful practice from recurring.

Unless I receive a satisfactory written response within 14 days, I will escalate this to the BPA and the Information Commissioner’s Office.

You should treat this as a serious complaint. Your misuse of my data will not be ignored, and any repetition will significantly aggravate the damages I will seek.

Yours faithfully,

[Keeper’s Name]

The operator’s evidence contains multiple contradictions and procedural failures that undermine their claim.

First, the Notice to Keeper states it was issued under paragraph 8(2)(b) of Schedule 4 of the Protection of Freedoms Act 2012, which applies only if a Notice to Driver was issued. However, the operator’s evidence claims they are relying on paragraph 9, which applies when no Notice to Driver is served. These two provisions have different timeframes and requirements. The NtK was issued only 5 days after the alleged contravention, which is only valid under paragraph 9. By citing paragraph 8, the operator has invalidated their own legal basis for keeper liability.

Second, the signage photos provided do not show readable terms and conditions. Several images appear to be taken offsite or in locations not shown on the site plan. If the signs are not present where claimed or cannot be read, then no contract can be formed. The operator’s assertion that signage meets required standards is not supported by the evidence.

Third, the landowner agreement was signed the day before the PCN was issued. This raises serious doubts about whether the operator had lawful authority to issue PCNs on the date in question. There is no evidence that enforcement infrastructure was properly in place or that the contract was active and valid at the time of the alleged contravention.

Finally, the entrance signage fails to comply with the requirements of Section 3.4 of the Private Parking Code of Practice. If new restrictions were introduced, the operator was required to use temporary signage and prominent notices for at least four months. There is no indication that any such measures were taken.

In summary, the operator’s evidence is internally inconsistent, procedurally flawed, and fails to demonstrate compliance with POFA, BPA, and signage standards. Keeper liability cannot be established, and no enforceable contract was formed.

Subject: Data protection complaint – request for evidence and Article 19 confirmations

Dear [Name],

Thank you for your email of 21 August 2025.

I acknowledge that you have recalled the matter from Debt Recovery Plus (DRP), placed the notice on hold pending POPLA, and say you have strengthened internal checks. For the avoidance of doubt, this remains a formal data protection complaint. Characterising the disclosure as an “administrative timing issue” does not cure the underlying unlawfulness where my personal data was disclosed for debt collection while appeal rights were active.

Please provide, by 9 September 2025, the following:

1. Audit trail (with timestamps):

a) Date/time my POPLA appeal was lodged;
b) Date/time CSPM issued/recorded the POPLA code;
c) Date/time CSPM first referred my data to DRP;
d) Date/time CSPM received POPLA notification;
e) Date/time CSPM instructed DRP to cease activity and erase data;
f) Date/time DRP confirmed cessation and erasure.

2. Article 19 UK GDPR notifications: Written confirmation (copies) that DRP has erased my data and ceased all processing, and that DRP has been instructed not to re-acquire it.

3. Lawful basis: The Article 6(1) lawful basis CSPM relied upon for disclosure to DRP while appeal rights were extant, together with your Legitimate Interests Assessment (if you rely on Article 6(1)(f)) and any relevant DPIA/ROPA entries covering third-party debt collection referrals.

4. Recipients: Confirmation of every third party (if any) beyond DRP to whom my data was disclosed in this matter.

5. Controls: A short description of the specific procedural change(s) implemented to prevent a recurrence (e.g. system holds, API checks, queue logic).

For clarity: I do not accept that this complaint is “closed”. I reserve all rights, including the right to seek compensation for distress pursuant to Article 82 UK GDPR and section 168 DPA 2018. If the above is not provided in full by 9 September 2025, I will escalate to the ICO and raise a standards complaint with the BPA.

Yours faithfully,

[Keeper’s name]

[Address]
[VRM / PCN ref.]