Free Traffic Legal Advice

Those images don't tell us enough. Were the Parking Charge Notices (PCNs) issued originally as Notice to Driver (NtD) on the windscreen or postal Notice to Keep (NtK). If those are NtKs, the show us ALL the wording, not just the detail on the side. Show both sides of the NtK redacting ONLY your personal data, the PCN number and the VRM. Leave everything else visible, especially dates and times.

There is a lot that can be done about this but we first need to see the whole PCN.

PCS are not a BPA or IPC member and any initial appeal will be rejected anyway. However, there is some very interesting conflicting information in their Notices to Keeper. PCS are not members of any AOS. The are acting on behalf of their client Parking Enforcement and Security Services (PESS), the creditor, who are BPA members.

However, they state on the back of the NtK in their Data Protection statement that "This Parking Charge has been issued... giving reasonable cause for Parking Collection Services to apply to the DVLA for the details of the registered keeper." PCS is not an AOS member and cannot legally apply to the DVLA for anyones Keeper data.

The first thing you should do is appeal each PCN individually but with the same appeal points. You email the appeals to enquiries@parkingcsl.co.uk and you CC yourself:

Subject: Formal Appeal – Parking Charge Notice [insert PCN number]

I am the registered keeper of the vehicle referenced in your Notice to Keeper. I am appealing this charge in full.

Firstly, the Notice to Keeper (NtK) fails to comply with the mandatory requirements of Schedule 4 of the Protection of Freedoms Act 2012 (PoFA). In particular, it does not specify the required period of parking as required under paragraph 9(2)(a). Stating that the charge relates to “the period immediately preceding the time of issue” is wholly inadequate and fails to meet the statutory obligation to specify a “period of parking.” Consequently, the conditions for keeper liability have not been met. I was not the driver and I am under no obligation to identify the driver. You are therefore required to cancel this charge.

In addition, your company – Parking Collection Services – is not listed as a member of the BPA’s Approved Operator Scheme (AOS) and has no entitlement to access DVLA keeper data. Yet your NtK falsely claims that PCS applied to the DVLA for my details under a “reasonable cause” request. If that is true, it would constitute a breach of the KADOE contract and a clear violation of UK GDPR and the Data Protection Act 2018. If instead the request was submitted by your client, Parking and Enforcement Security Services (PESS), who is a BPA AOS member, then you are unlawfully issuing notices and processing data under your own company name without being the data controller, again in breach of multiple regulatory standards. Whichever it is, you have a problem.

Your notice also misleadingly claims that you operate in accordance with the BPA Code of Practice. That is quite an achievement, since PCS is not a BPA AOS member and the BPA Code of Practice no longer exists. It was replaced in October 2024 by the joint BPA/IPC Private Parking Single Code of Practice (PPSCoP). Perhaps you missed that update? Or perhaps you’re hoping recipients of your paperwork remain as ignorant as your content team. I suggest you clarify this point quickly, as the display of the BPA logo on your NtK and the misleading reference to a defunct code are now included in the formal complaint already submitted to the DVLA and will be shared with the ICO.

If your company intends to reject this appeal, then you are reminded that only a BPA AOS member can issue a POPLA code. Since PCS is not one, you’ll need to pass this matter to your client, Parking and Enforcement Security Services, so that they may respond and issue a valid POPLA code. If no code is forthcoming, I will consider the matter closed and all further contact from you or your client will be treated as harassment and reported accordingly.

You are required to cancel this charge. No further discussion will be entered into.

[Your full name]
[Your address]

You should also make a formal complaint to the DVLA as your Keeper data has been obtained and used unlawfully.  Here’s how to make a DVLA complaint:


The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.

For the text part of the complaint the webform could use the following:

I am submitting a formal complaint against Parking Collection Services (PCS), a company which is not an AOS member of any Accredited Trade Association, for unlawfully obtaining or using my personal data under the DVLA's KADOE (Keeper At Date Of Event) scheme.

PCS issued three Notices to Keeper under their own name, demanded payment to themselves, and explicitly stated that they had applied to the DVLA for my data under the “reasonable cause” criteria. This is despite PCS having no entitlement to access DVLA data, since they are not a member of the BPA or IPC and have no independent KADOE rights.

This suggests that PCS either:

(a) submitted KADOE requests directly, in which case they were made unlawfully and constitute a breach of the KADOE contract and UK GDPR, or
(b) the requests were made by their client, Parking and Enforcement Security Services (PESS), who are a BPA AOS member, but PCS have then used that data as if they themselves were the controller, issuing the NtKs in their own name, handling appeals, and collecting payment.

To make matters worse, PCS claims to be a “joint data controller” with the parking company named on the notice, Parking Enforcement and Security Services (PESS), yet fails to explain this arrangement or provide any transparency about respective responsibilities, as required under Article 26 of UK GDPR.

PCS is not entitled to issue or enforce PCNs using DVLA data unless acting strictly under the authority and instruction of a KADOE account holder, and even then must do so as a data processor, not an autonomous data controller. The NtKs and privacy wording strongly indicate otherwise.

This processing appears unlawful, misleading, and lacking transparency.

I am requesting an urgent investigation into:

• Who accessed my data via KADOE (PCS or PESS);
• Whether PCS had any lawful authority to do so;
• Whether a valid joint controller or processor agreement exists;
• Whether PCS has unlawfully issued NtKs and processed personal data in breach of the KADOE contract, the PPSCoP, and UK GDPR.

Please confirm receipt of this complaint and provide a reference number. Supporting evidence will be provided.

Then you could upload the following as a PDF file for the formal complaint itself:

SUPPORTING STATEMENT

Complaint to DVLA – Breach of KADOE Contract and PPSCoP

Operator name: Parking Collection Services (PCS) acting for Parking and Enforcement Security Services (PESS)
Date of PCN issue: [INSERT DATE OF EARLIEST NTK]
Vehicle registration: [INSERT VRM]

I am submitting this complaint to report a misuse of my personal data by Parking Collection Services (PCS), who either unlawfully obtained my keeper details directly from the DVLA, or processed DVLA data passed to them by their client, Parking and Enforcement Security Services (PESS), in breach of the conditions of the KADOE contract and the Private Parking Single Code of Practice (PPSCoP).

The three Notices to Keeper I received were issued entirely in the name of PCS, a company which is not a member of any Accredited Trade Association and therefore has no lawful access to DVLA data. The notice demands payment to PCS, directs all correspondence to PCS, and falsely claims that PCS itself made the DVLA data requests under the “reasonable cause” provision.

If that statement is true, then PCS has unlawfully accessed personal data in breach of the KADOE contract. If the requests were actually submitted by PESS, then the disclosure and subsequent use of that data by PCS appears to exceed what is permitted, as PCS is issuing enforcement notices and collecting payments under its own name without disclosing a lawful basis or providing any compliant processor agreement or controller declaration.

The NtKs also misleadingly state that PCS operates in accordance with the BPA Code of Practice. This is factually incorrect and misleading. The BPA Code of Practice no longer exists, having been superseded by the joint BPA/IPC Private Parking Single Code of Practice (PPSCoP) in October 2024. The misuse of the BPA logo and references to a defunct Code are part of a wider pattern of deceptive conduct.

These are not technicalities. They represent a clear breach of data processing transparency, purpose limitation, and lawful basis under UK GDPR, as well as a misuse of DVLA data for unauthorised enforcement. PCS has no authority to act as a data controller for DVLA-sourced data, and the Notices to Keeper issued to me give no clarity about the source of data or lawful status of PCS in the enforcement chain.

I am therefore asking the DVLA to investigate this breach and take appropriate action under the KADOE framework. This may include:

• Confirming that a breach has occurred
• Taking enforcement action against the operator(s)
• Suspending or terminating access to KADOE data where appropriate
• The DVLA reporting itself to the ICO

I have attached copies of the NtKs and privacy wording as supporting evidence. Please confirm receipt and provide a reference number for this complaint. I am happy to provide further documentation if needed.

Name: [INSERT NAME]
Date: [INSERT DATE]

You need to appeal each PCN individually as advised. You can create a new DVLA complaint for the latest PCN.

Let us know when you receive the appeal rejections with the POPLA codes.