Free Traffic Legal Advice

Subject: Formal Complaint – Misrouted Complaint and GDPR/KADOE Breach – PCN LU00217221

Dear APCOA UK Customer Complaints Team,

I am writing to escalate a formal complaint regarding your company's appalling handling of a matter concerning Parking Charge Notice LU00217221, issued in relation to Loughborough University.

I initially submitted my complaint on 12 March 2025 to your designated customer complaints address (ukcustomercomplaints@apcoa.com). However, I have since received multiple replies from an entirely unrelated department—complaints.lutondropoff@apcoa.com, which clearly pertains to London Luton Airport. This wholly inappropriate redirection appears to have been triggered by incompetent staff or defective automated systems failing to understand that the “LU” prefix refers to Loughborough University, not Luton Airport.

This degree of operational incompetence is unacceptable.

Despite me clearly quoting the reference LU00217221, exactly as printed on both the NtK and subsequent correspondence from Debt Recovery Plus, your staff then wrongly claimed the reference was “in the incorrect format” and could not be located. Only when I reluctantly provided the vehicle registration, as your misdirected team requested, did the matter appear to be taken any further—though still by the wrong department.

This error has now resulted in my personal data being unnecessarily shared with a department entirely unconnected to the matter at hand, thereby breaching the principles of the UK General Data Protection Regulation (UK GDPR) and misusing DVLA keeper data obtained under the KADOE contract. Please take this as formal notice that I have raised a complaint with the DVLA regarding APCOA’s clear breach of the terms of that agreement, which strictly limits data processing to the specific contravention for which it was obtained.

To summarise:

• The PCN relates solely to Loughborough University, not Luton Airport.
• You have misused the data by forwarding it internally to a department with no relevance or lawful purpose.
• You failed to correctly identify your own reference number, despite it being printed on all official correspondence.
• You have demonstrated a complete lack of data handling safeguards and customer service accountability.
• You have failed to deal with the core PoFA-related issues raised in my original complaint.

I now demand the following:

1. Immediate escalation of this complaint to the correct department responsible for Loughborough University PCNs;
2. A full explanation as to why my personal data was shared with an unrelated team;
3. Confirmation of the corrective steps you are taking to prevent such GDPR and KADOE breaches in future;
4. Written confirmation that the PCN LU00217221 has been cancelled—or alternatively, a formal rejection with a valid POPLA code.

I expect a full response within 14 days.

Sincerely,

[Your Full Name]
[Your Postal Address]
[Your Email Address]
[Vehicle Registration: YG12 BBF]

I am submitting a formal complaint against APCOA Parking (UK) Ltd, a BPA AOS member with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.

While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—through conduct that contravenes the PPSCoP—renders that use unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.

The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.

I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.

Please acknowledge receipt and confirm the reference number for this complaint.

SUPPORTING STATEMENT

Complaint to DVLA – Breach of KADOE Contract and PPSCoP

Operator name: APCOA Parking (UK) Ltd
Date of PCN issue: 24 January 2025 (Notice to Keeper dated)
Vehicle registration: YG12 BBF

I am submitting this complaint to report a misuse of my personal data by APCOA Parking (UK) Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.

Although APCOA may have had reasonable cause to request my data initially, their subsequent use of that data constitutes unlawful processing due to a breach of the Private Parking Single Code of Practice (PPSCoP). Compliance with the PPSCoP is a condition of the KADOE contract, which governs the permitted use of DVLA-supplied keeper data.

The KADOE contract states that personal data must only be used for the lawful pursuit of a parking charge, and only in accordance with the governing Code of Practice. When an operator breaches that Code, their lawful basis to continue processing the data collapses.

In this case, APCOA has breached the PPSCoP and misused DVLA data as follows:

1. Internal misrouting of my personal data to an unrelated business division.

After receiving my formal complaint regarding a PCN issued at Loughborough University, APCOA inexplicably forwarded my email, PCN reference, and vehicle registration to a completely unrelated department—the Luton Airport Drop-Off Complaints team. This appears to have occurred because of the “LU” prefix on the PCN (which refers to Loughborough University), leading APCOA to misclassify the complaint as a Luton Airport matter.

This represents an unlawful internal disclosure of my personal data to an irrelevant team with no lawful basis to process it. Once DVLA data is obtained under KADOE, it must not be disclosed further except as required to pursue the specific PCN. The Luton Airport division had no connection whatsoever to the matter, and therefore no lawful interest or justification for processing my data.

2. Incompetent record-keeping and false claim of an invalid PCN reference.

Despite me quoting the PCN number exactly as printed on the NtK and on a Debt Recovery Plus letter, APCOA claimed the number was “not in the correct format” and could not be found. This not only demonstrates a lack of data integrity and competence but further delayed their response to my complaint. They only acknowledged the case after I provided the vehicle registration, which they should never have needed had their records been accurate.

3. PoFA non-compliance.

In addition, the Notice to Keeper was not received until well outside the 14-day limit imposed by Paragraph 9(5) of Schedule 4 of the Protection of Freedoms Act 2012. This statutory failure means APCOA has no lawful basis to pursue the registered keeper, nor to process their data for this purpose.

These are not minor technicalities but systemic breaches. APCOA has clearly failed to implement proper safeguards to restrict access to DVLA keeper data and has allowed internal cross-contamination between departments. Their actions are in direct contravention of the KADOE contract and UK GDPR Article 5(1)(c) and (f).

The DVLA remains the Data Controller for data it releases under KADOE and is therefore obliged to ensure that the data is used only for permitted purposes and not mishandled internally by private operators.

I respectfully request that the DVLA investigate this matter fully and take appropriate enforcement action, including:

• Confirming that a breach has occurred
• Taking enforcement action against the operator
• Suspending or terminating their KADOE access if warranted

I have attached relevant email correspondence as evidence and am happy to provide additional information if required. Please acknowledge receipt and confirm the reference number for this complaint.

Name: [Insert Your Full Name]
Date: [Insert Date of Submission]

Subject: Failure to Acknowledge Formal Complaint – Breach of PPSCoP para. 11.3 – PCN LU00217221

Dear APCOA Complaints Team,

I am writing to remind you that I submitted a formal complaint by email on 3 April 2025 to ukcustomercomplaints@apcoa.com, copied to complaints.lutondropoff@apcoa.com, concerning PCN LU00217221 issued in respect of Loughborough University.

It is now the end of 18 April 2025, more than 14 calendar days since receipt, and I have received no acknowledgment or response. The Private Parking Single Code of Practice (PPSCoP) at paragraph 11.3 is clear:

“A complaint must be acknowledged by the parking operator within 14 days of its receipt unless exceptional circumstances apply…”

No such exceptional circumstances have been cited, and no update has been provided. Your failure to comply with this basic obligation constitutes a further breach of the PPSCoP, compounding the data misuse and internal misrouting I have already raised with the DVLA.

I now request immediate written acknowledgment of my complaint and confirmation of its referral to the correct internal team. Please treat this as a final opportunity to avoid further regulatory escalation.

Sincerely,

[Your Full Name]
[Your Contact Details]
[Vehicle Registration: YG12 BBF]
[PCN Reference: LU00217221]

You should send it anyway, just so as there is a "paper trail" of the complaints process.