BW Legal’s emails now show not just carelessness but complete procedural disorder. Their data handling is inconsistent, inaccurate and unreliable, which breaches UK GDPR Article 5(1)(d) because personal data must be accurate and kept up to date. They are not in control of their own systems, and the ICO routinely investigates this kind of behaviour because it involves contradictory processing, contradictory outcomes, inaccurate records, separate workflows that do not talk to each other, failure to link correspondence to the correct account, failure to identify which of the two NtKs a message relates to, and false statements that you have not responded. The moment they continue enforcement while relying on inaccurate data, their processing becomes unlawful.
Their claim that you “have not responded for 45 days” is flatly wrong because you emailed them on 14 November. This proves that their data is inaccurate, their workflow is faulty and their system is unable to map incoming messages to the correct file. This alone breaches Article 5(1)(d). It creates a false account history, a false “resolved” status, a false lack of response, and contradictory records about the same matter. This is exactly the sort of failure that the ICO treats as a serious complaint.
Their statement that they have “closed the contact associated with your account” shows exactly what is happening. They have created multiple separate “contacts” or sub-accounts for the same two PCNs and are processing them independently. One workflow says “no further action is required”. Another demands £340 and threatens a Letter of Claim. Neither workflow is aware of the other. This is a textbook example of an unsynchronised CRM system. It is unlawful because any data controller or processor must maintain accurate records, consistent processing, a single truth about liability and correct data for enforcement decisions.
Their repeated phrase “no further action is required at this time” has now appeared several times from different teams on different dates relating to different internal entries. Every time they send this, they undermine their own threats, destroy any argument that their actions are reasonable and create a contradictory audit trail. A judge looking at both “no further action” and “we will escalate to a Letter of Claim” would conclude immediately that BW Legal does not have a coherent processing system.
Their reference to a “contact date” of 12 August 2025 appears to be an internal system timestamp, possibly an earlier message, possibly a mis-indexed entry or an automated marker. It does not match your correspondence dates. This is yet another sign of poor system integrity and inaccurate audit trails and again breaches GDPR accuracy requirements.
The overall position now is that BW Legal cannot identify which NtK is which, cannot track correspondence properly, cannot unify their workflows, and their systems produce contradictory results. They claim you have not responded when you have, they repeatedly ask for details you have already provided, they maintain incorrect data and then use that incorrect data to pursue enforcement. This behaviour breaches multiple data protection principles: accuracy under Article 5(1)(d), lawfulness and fairness under Article 5(1)(a), minimisation under Article 5(1)(c), and storage limitation under Article 5(1)(e). It also likely breaches the lawful basis requirement under Article 6(1) because they have no legitimate interest in pursuing a keeper who is not liable.
This gives you strong grounds for an ICO complaint, a DVLA data misuse complaint, a section 168 Data Protection Act claim for distress, and a powerful set of facts to undermine any future Letter of Claim.
Your response to them should now explain clearly that their competing workflows are producing contradictory outputs, including multiple statements that the matter is resolved, while their collections team continues to make demands. You should state that this inconsistency shows that their processing is inaccurate and unsynchronised and that they are acting on incorrect and incomplete data, which is a breach of Article 5(1)(d). You should also tell them that all of this is being documented for complaints to the ICO and DVLA.
Send this to the "custards" (Jeremy Clarkson's new profanity, combining two into one... I’m sure you can work it out!):
Subject: Your continuing unlawful, inaccurate and contradictory processing
Dear BW Legal,
Your latest email reinforces the same problem that has been evident for months: you are not in control of your own systems, your records are inaccurate, your workflows contradict each other, and you continue to act on data that you know is wrong. This is not reasonable conduct. It is unlawful processing, and it is now being prepared for formal complaints and regulatory escalation.
You have repeatedly claimed that you have “not received a response in 45 days”, despite receiving my email on 14 November. That single error proves your records are inaccurate and unreliable. You have also issued multiple messages stating that the matter has been “resolved” and that “no further action is required”, while simultaneously sending payment demands and threats of escalation. You close “contacts” on your system while your collections team continues to send automated enforcement letters. You consistently ask for information that has already been provided and acknowledged. Your correspondence does not identify which PCN you are referring to, even though there are two separate NtKs that you treat as if they are interchangeable. This is procedural chaos.
This behaviour breaches the UK GDPR. You are failing to comply with Article 5(1)(d) because you are not maintaining accurate data or keeping it up to date. You are breaching Article 5(1)(a) because continuing to pursue the wrong person despite having the driver’s details and despite PoFA defects is not lawful or fair. You are breaching Article 5(1)(c) because you are using personal data that is no longer necessary for enforcement. You are breaching Article 5(1)(e) because you are retaining and acting on data for longer than is justified. Your reliance on Article 6(1) as a lawful basis fails because you have no legitimate interest in pursuing a person who is not liable.
Your insistence that the NtK is PoFA compliant “because it was issued within 14 days” shows a basic misunderstanding of the statute. PoFA requires the notice to be given so that it is deemed delivered within the 14-day period, not merely “issued”. You have ignored the requirements of paragraph 9(4) and 9(6). Your demand for a “signed statement” is equally baseless because PoFA contains no such requirement. This is an invented condition that contradicts the legislation.
You have been given the full name and address for service of the driver. Your client acknowledged this in April. Under paragraph 5(1)(b) PoFA, keeper liability ended at that point. Your refusal to accept this is legally indefensible. Your continuing attempts to pursue me as keeper are now being treated as unlawful enforcement.
I am now preparing the following complaints and actions.
First, a formal complaint to the ICO for unlawful, inaccurate and inconsistent processing of my personal data and for your failure to maintain accurate and coherent records.
Second, a complaint to the SRA outlining your misstatements of law, your invented legal requirements, your contradictory automated communications, your failure to supervise your systems properly, and your continuing reliance on clearly inaccurate personal data.
Third, a complaint to the Competition and Markets Authority under the Digital Markets, Competition and Consumers Act for unfair commercial practices, misleading statements of legal entitlement, and the use of inconsistent automated systems to pressure consumers into payment demands that have no lawful basis.
Fourth, if your unlawful processing continues, I will commence a claim under section 168 of the Data Protection Act 2018 for distress caused by your misuse of my personal data.
You now have one final opportunity to bring your processing into line with the law. Confirm within seven days that your records have been corrected, that the driver’s details have been applied to both NtKs, that all enforcement processing against me has ceased, and that no further correspondence will be directed at me as keeper.
If you fail to do so, every complaint and sanction mentioned above will proceed.
Yours faithfully,
[Your name]
