Free Traffic Legal Advice

It would he,p if we could see the back of the NtK. However, if that is the original one sent under para 8 of PoFA, it couldn’t be compliant because:

NtD given: 31/01/2025 → “day after” is 01/02/2025.
PoFA Sch 4 para 8 requires the NtK to be given not earlier than 28 days and not later than 56 days after that day, i.e.:

An NtK issued on 06/04/2025 falls outside that window (and “given” would be even later once postal service is applied), so it is not within the relevant period and keeper liability under PoFA cannot arise.

If CPP hold more than one possible addresses for you, you need to email their DPO and instruct them to update their records with your current address for service and to erase any other addresses they may hold. The highlighted words are there for a reason, so use them.

Also, you should send the following formal complaint CPP:

Re: Formal complaint, recall from debt recovery, and data-protection notice

PCN: [reference] · Location: St George’s Hospital (Grosvenor Wing)
Notice to Driver: 31/01/2025 · Notice to Keeper (dated): 06/04/2025

Dear Sir/Madam,

I raise a formal complaint regarding your Notice to Keeper (NtK) dated 06/04/2025 and your subsequent referral to a debt recovery agency.

No keeper liability under PoFA
An NtD was given on 31/01/2025, so the “day after” is 01/02/2025. Under Schedule 4 paragraph 8(4)–(5) Protection of Freedoms Act 2012, any NtK had to be delivered between 01/03/2025 and 29/03/2025. An NtK dated 06/04/2025 could not have been delivered within that period; keeper liability cannot arise.

Breach of the PPSCoP and KADOE
Despite the above, your NtK asserts that PoFA requirements have been satisfied and that you may recover the charge from me as keeper. That wording is prohibited by the Private Parking Single Code of Practice v1.1, clause 8.1.1(d), which requires operators not to state the keeper is liable under PoFA where they cannot be held liable. This is non-conformant conduct and places you in breach of your DVLA KADOE obligations, which require adherence to the ATA Code and prohibit misleading representations about legal rights.

Unlawful onward disclosure / data protection
You have passed my keeper data to a debt recovery company for “enforcement” when you have no lawful route to hold the keeper liable. That onward disclosure is not necessary or proportionate and lacks a valid lawful basis under UK GDPR Article 6(1). It is contrary to the principles of lawfulness, fairness and transparency (Art 5(1)(a)) and accountability (Art 5(2)). Whether your agent acts as a processor or as an independent controller, you remain responsible for ensuring compliance.

Required actions (within 14 days):

A. Cancel the PCN and confirm you will not pursue the keeper or rely on PoFA in this case.
B. Immediately recall the matter from debt recovery and instruct the third party to cease all processing and erase my personal data obtained from you; confirm completion in writing.
C. Treat this letter as a notice under UK GDPR Article 21 (objection) to any further processing for enforcement purposes. Processing must stop, save for retaining a minimal suppression record. In the alternative, I require restriction of processing under Article 18 pending determination of my complaints.
D. Confirm what steps you will take to remedy your PoFA/PPSCoP non-compliance (including template and staff retraining) and to prevent recurrence.

If you fail to comply, I will:

• Report the matter to the DVLA for KADOE breach and to your ATA (BPA) for Code non-conformance; and

• Refer the misuse of my personal data to the ICO, reserving all rights under the UK GDPR and the Data Protection Act 2018, including a claim for distress.

Please address all correspondence to me in writing only. Any further contact from debt recovery about this PCN will be treated as harassment and as unlawful processing.

Yours faithfully,

[Name]
[Postal address]
[Email]