Free Traffic Legal Advice

This situation raises immediate red flags regarding data handling and liability. If the debt recovery letter is addressed to your mother, who is not the registered keeper, this is procedurally suspect. If she was not the driver and not the registered keeper, PCM has no lawful basis to pursue her unless she was explicitly named as driver and accepted liability.

Was your mother ever named in correspondence or online appeal as the driver? Does the letter reference the original PCN number and vehicle registration? Is your mother's name on the V5C (vehicle logbook)?

I would suggest the Keeper complains (preferably by email) to PCM and CC the DPO and yourself with the following:

Quote

Subject: Formal Notice – Unlawful Disclosure of Personal Data and Procedural Misconduct

To: Parking Control Management (UK) Ltd 
Re: PCN Reference [Insert Reference] – Vehicle Registration [Insert VRM]

You are hereby put on notice of a serious data protection breach and procedural irregularity in your handling of the above-referenced PCN.

The initial appeal was submitted by the registered keeper, whose name and address you obtained via DVLA under Regulation 27(1)(e) of the Road Vehicles (Registration and Licensing) Regulations 2002. No IAS appeal was submitted. At no point was any other individual named or identified as the driver.

Despite this, you have now caused a third-party debt recovery agent—TRACE—to send a letter to my wife, who is neither the registered keeper nor the driver. She has no connection to this matter and has never communicated with you. This is a blatant breach of the UK GDPR and a misuse of personal data.

You are required to respond within 14 days with:

1. The lawful basis under Article 6 of UK GDPR for processing and disclosing her personal data.
2. The source of her personal data* including any alleged justification for its use.
3. Confirmation of immediate erasure of her data under Article 17 (Right to Erasure).
4. A full explanation of how this breach occurred, including whether TRACE obtained her details from you or another source.
5. Confirmation that all future correspondence will be directed solely to the registered keeper, unless you can lawfully establish driver liability.

This breach will be reported to the Information Commissioner’s Office (ICO) and may be cited in any future costs application should this matter escalate. You are reminded that as data controller, you are fully liable for the actions of your agents under the accountability principle.

Any attempt to shift blame to TRACE will be treated as an admission of failure to control data processors under Article 28.

Yours sincerely, 

[Full Name of Registered Keeper] 
Registered Keeper of Vehicle [VRM]

I have received a response, however I seem to be unable to attach anything to my post here, any ideas what is going on?