Classic case of "double dip" where their ANPR images have not been manually checked as required by their Code of Practice.
First port of call is Morrisons Customer Service through this link:
https://www.morrisons.com/help/form/contact-us/car-park/car-parking-charges/i-have-a-car-parking-chargeThey are usually pretty good at getting PCNs cancelled.
If that doesn't get it cancelled, then appeal initially, only as the Keeper, on 25th August with the following:
Subject: Appeal against PCN [Insert PCN Reference] – Breach of Code of Practice and Unlawful Data Use
To: Euro Car Parks Ltd
From: Registered Keeper of [Insert Vehicle Registration]
Dear Sir or Madam,
I am the registered keeper of the above vehicle and am writing to formally appeal the Parking Charge Notice issued in relation to an alleged incident at Morrisons Redcar on 20 July 2025.
Your Notice is based on ANPR images purporting to show a single continuous stay from 09:28 19/02/2025 to 10:23 20/07/2025, which is factually incorrect. The vehicle made two separate visits to the site — one in the morning to use the cash machine and another the next morning with a stay of around 45 minutes. Your system failed to record the first exit and second entry, thereby conflating two distinct visits into one — a well-known ANPR failure known as “double dipping”.
Such errors are typically caused by your system's failure to reconcile 'orphan images' — unpaired entries or exits — which should have been identified during the mandatory manual quality control check required by Section 7.3(d) of the Private Parking Single Code of Practice (Version 1.1, 17 February 2025). That section states:
“Photographic evidence must not be used by a parking operator as the basis for issuing a parking charge unless: images generated by ANPR or CCTV have been subject to a manual quality control check, including the accuracy of the timestamp and the risk of keying errors.”
And Note 1 explicitly refers to:
“...issues such as ‘double dipping’, where image camera systems might have failed to accurately record each instance when a vehicle enters and leaves controlled land...”
Your failure to detect this pattern, especially over an alleged stay of 24 hours and 55 minutes, demonstrates that no such check was carried out, and no due diligence was applied. You had no reasonable cause to request my personal data from the DVLA, and you have since continued to process that data unlawfully, in breach of Article 5(1)(a), (b), and (f) of the UK GDPR.
Irrespective of the outcome of this appeal, I am reporting ECP to the DVLA for unlawfully obtaining my keeper data. A further complaint to the Information Commissioner’s Office is being prepared, and I reserve the right to pursue damages under Article 82 UK GDPR for this data misuse.
This appeal is submitted solely by the registered keeper. No information will be provided about the identity of the driver.
You are invited to cancel this PCN immediately.
Yours faithfully,
[Full Name]
Registered Keeper
You make the DVLA complaint as follows (irrespective of the outcome). Here’s how to make a DVLA complaint:
• Go to:
https://contact.dvla.gov.uk/complaints• Select: “Making a complaint or compliment about the
Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Euro Car Parks (ECP), a BPA AOS member with DVLA KADOE access, for unlawfully obtaining and continuing to misuse my personal data in breach of the Private Parking Single Code of Practice (PPSCoP) and the KADOE contract.
The breach occurred at the point of request, as ECP failed to perform the mandatory quality control checks required under Section 7.3(d) of the PPSCoP. Their ANPR system falsely claimed my vehicle remained in the Morrisons – Redcar car park for over 24 hours, from 19 to 20 July 2025.
In reality, the vehicle left shortly after the first visit on 19 July and travelled to Cleethorpes, approximately 130 km away, before returning to Redcar that evening. The driver returned to Morrisons the following morning for a separate, short visit.
ECP failed to identify this “double dipping” error and used that flawed data to unlawfully request my keeper information from the DVLA. The subsequent use of that data to issue and pursue a Parking Charge compounded the breach.
The DVLA, as data controller, is legally responsible for the release and subsequent misuse of this data. I will not accept the usual response claiming “reasonable cause” where there was none. The DVLA must investigate and also report its own unlawful disclosure to the Information Commissioner’s Office.
A full supporting statement has been uploaded with this complaint. Please provide a reference number and full response.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: Euro Car Parks Ltd
Date of PCN issue: 25 July 2025
Date of alleged contravention: 19–20 July 2025
Vehicle registration: [INSERT VRM]
I am submitting this complaint to report that Euro Car Parks (ECP) has unlawfully obtained and used my personal data under the DVLA’s KADOE scheme. This is a serious breach of both the Private Parking Single Code of Practice (PPSCoP v1.1) and the KADOE contract.
On the morning of Saturday 19 July, the vehicle entered the car park at Morrisons – Redcar. The driver used the cashpoint inside the store and departed shortly afterwards.
The driver and vehicle then travelled to Cleethorpes, approximately 130 km away, where they remained for most of the day. That evening, the vehicle returned to Redcar.
On the morning of Sunday 20 July, the driver returned to the Morrisons car park for a separate visit, remaining for around 45 minutes. This second exit was captured by ECP’s ANPR system.
ECP issued a PCN based solely on two ANPR images — entry on 19 July and exit on 20 July — falsely alleging that the vehicle overstayed for 24 hours and 55 minutes. This is a textbook double-dipping error. The system failed to register the first exit and second entry and mistakenly treated two separate visits as a single continuous stay.
Under Section 7.3(d) of the PPSCoP:
Photographic evidence must not be used by a parking operator as the basis for issuing a parking charge unless: images generated by ANPR or CCTV have been subject to a manual quality control check, including the accuracy of the timestamp and the risk of keying errors.
Note 1 warns operators to detect orphan images and double-dipping through those manual checks. ECP clearly failed to comply. As a result, they had no reasonable cause to request my data, and the request itself was unlawful.
ECP then compounded this breach by using my data to pursue a Parking Charge based on evidence that would have been disproven by even a cursory review. This represents a continuing misuse of my personal information.
The DVLA, as the data controller, remains legally responsible for the disclosure of personal data and must take immediate action. I therefore expect:
• Acknowledgement that a breach occurred
• Enforcement action against Euro Car Parks
• Suspension or termination of their KADOE access if appropriate
• DVLA to report its own unlawful disclosure to the Information Commissioner’s Office
• A formal response with a complaint reference number
I am willing to provide further evidence of the vehicle’s location on 19 July if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]
