It's a non-PoFA compliant NtK. So, no admitting who the driver was. An email complaint to the Tesco CEO, ken.murphy@uk.tesco.com is also likely to get it cancelled.
This worked last week with another Horizon/Tesco PCN:
This is an appeal by the registered keeper - No driver details will be given. Please do NOT try the usual trick of asking for driver details in order to get around the fact your NtK does not comply with PoFA. As there is no keeper liability, therefore, liability cannot flow from the driver to the keeper and so, is an automatic win at POPLA. Please cancel the notice or issue a POPLA code at which point you will auto withdraw.
However, as it is a double-dip, they have breached your GDPR and the BPA CoP section 22.2 and therefore breached the KADOE rules. You should also "complain" (not appeal) to Horion about these breaches. A complaint to the DVLA is also warranted.
Depending on how feisty and confident you are you could also turn the tables on Horizon if you are prepared to do the following:
Article 12 of the UK GDPR legally requires data controllers to store and process personal data accurately: clearly, any data controller issuing an invoice to you because it has wrongly recorded that you parked in breach of the alleged contract between you and the landowner (or, as in this case, an agent of the landowner) is processing your personal data unlawfully.
The precedents for claiming damages and compensation for such unlawful processing are the decisions of the Court of Appeal in Zeta Jones & Douglas v Hello! Magazine [2003] EWHC 786 and Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333, both being binding on all County Courts in England and Wales. In the latter claim, Mr Halliday was awarded compensation of £750 at what the Court regarded was the lowest level of award, and although this was a claim under Section 13 of the Data Protection Act 1998, similar provisions - amended to take account of a decision by the EU Grand Chamber that the 1998 Act did not properly implement EU law into UK domestic legislation - replaced the old Section 13 provisions with Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018.
In short, you ought to give 21 days notice (the pre-action protocol only really requires 14 days but hey, you can be charitable!) to the data controller of your intention to seek (say) £300 nominal damages and compensation under Article 12 of the UK GDPR and Section 168 of the Data Protection Act 2018 for their unlawful processing of your personal data. Clearly mark your letter as a "Letter before County Court proceedings".
Anyone who is fairly confident can claim as a litigant-in-person in Part 27 proceedings in the County Court (commonly but wrongly described as "the Small Claims Court"). Each party is responsible for their own legal costs whether they win or lose and the claim for £300 can be issued online for a fee of £35 at moneyclaimonline.gov.uk which also gives useful advice if you want to have a look at what is involved. Your claim will automatically be listed as being for a total of £335, i.e. the successful party gets their Court fees back.
