Free Traffic Legal Advice

Hi, thank you for your message.

Sorry for the lengthy reply, I have written below what they sent to me in text form since otherwise I would be anonymising a large file before uploading images, however if it would be more helpful to have the information in the original form I will go ahead and do that).

This is the response I received from CPM (it was sent to me 33 mins after my message requesting the data).

...................................................................................................

"We write in response to a Subject Access Request that we received on 28th August 2025.
 
As per your request, please find enclosed all of the personal data, photographic evidence, and correspondence that we hold on our secure systems.
 
You will also be aware that we have passed all of the information provided within this SAR to our Debt Recovery Agents and solicitors to pursue Parking Charge(s) that remain outstanding. We notify Drivers and Keepers of our intention to share your personal information on both our ‘Notice to Driver’ and ‘Notice to Keeper’ letters.
 
We have shared your data with the below third parties:
 
Trace Debt Recovery Ltd 2. BW Legal Ltd
             PO Box 1448  Enterprise House
             Northampton  1 Apex View
             NN2 1DW   Leeds
LS11 9BH
 
Please note, should you require SAR from the below parties, you must contact them directly to request this.
 
We will hold the enclosed information until any outstanding Parking Charge(s) in relation to the above vehicle have been settled.
 
If you have any further data-related requests or concerns, please contact us by either writing to us or emailing dp@countrywideparking.co.uk. Otherwise, we consider our duties in relation to your SAR to be met and you should now direct any further correspondence in relation to any outstanding Parking Charges to our solicitors, BW Legal Ltd.
 
Yours sincerely"

...................................................................................................

The additional information they added in a zip file was as follows:

"Generated on: 20/08/2025 09:36 AM
Enforcer :Countrywide Parking Management Ltd
PCN: CPM755149
[my name, address, tel no, email]
Type: Driver
Source: Appeal
VRM: [my number plate]
Make/ model/ colour (all correct)
Contravention date: 23/12/2024 16:56 PM
Site: 20-28 Cotland´s Road"

"CONTACT HISTORY
ID [a 6 digit number]
[my name, address]
Type: Keeper
Source: DVLA"

Then there are a series of photos of my vehicle entering the car park, leaving the car park - displaying my number plate.

Then there are a number of attachments, as follows:
1) An image of the ringo sign with location number and the terms and conditions
2) Final notice letter (12/05/2025) addressed to my previous address where I left on 30/04/2025. I submitted my application with my new address on 31/03/2025 for my new licence and V5C owner certificate, and received them both 2 weeks later, well before that letter from CPM was issued - is this something I could use to exploit against them?
3) The rejection reply to the appeal which I submitted, dated 11/02/2025
4) Another Image of the Ringo app location number and the terms and conditions
5) The appeal I submitted on 17/01/2025, which has a note: ´Driver was the elected choice´
6) Original notice to keeper dated 03/01/2025



That is all the information they provided. As far as I can make out then they did not provide the following, which was asked for:
a) ANPR Logs
b) Ringo/ payment look-ups and reconsolidating
c) Call/ portal logs
d) Internal notes
e) DVLA request/ response
f) site plan
g) contract/ policies relating to this site

Thank you in advance

Respond to the DPO with the following email (and CC yourself):

Subject: Incomplete SAR – You omitted BW Legal from the recipient list (PCN [ref], VRM [VRM])

Dear Data Protection Officer,

Your SAR response (received 28 August 2025) is not complete. You’ve failed to list BW Legal as a recipient of my personal data, even though you (and BW Legal) are actively using my data in live pre-action correspondence. That omission is blatant. It renders your disclosure inaccurate and incomplete under UK GDPR Articles 12 and 15.

Fix it. Here’s what you will provide, in full, within the statutory deadline (28 September 2025):

A complete disclosure/recipient log for this PCN showing all recipients — including BW Legal — with:

• identity of recipient;
• categories of personal data disclosed;
• date/time of each disclosure;
• purpose and lawful basis.

DVLA KADOE audit trail for this PCN: date/time of the single DVLA request, the address returned, and any subsequent address-verification/trace records that refer to me, especially before your Final Notice dated 12/05/2025 and before instructing solicitors.

The personal data you withheld despite my request:

• Full ANPR event log for my VRM for the material period (all reads/timestamps/camera IDs/retention entries).
• RingGo/payment look-ups and back-office records referencing my VRM/PCN (matching/mismatch notes for the material window).
• Internal notes, decision records, and portal/web-form audit logs referencing me/this PCN.
• Any data accuracy records explaining why you used my former address after my DVLA update in early April 2025.
• Your retention schedule as applied to my personal data for this PCN.

If you want to claim an exemption, name the specific exemption and explain how it applies to the precise item withheld. Do not fob me off with generic boilerplate.

You’ve already pushed my data to BW Legal, yet pretended otherwise in your SAR pack. That is unacceptable. If you do not correct this and supply the missing data by 28 September 2025, I will file an ICO complaint for failure to comply with Articles 12/15 and for data accuracy breaches (Art. 5(1)(d)). I will include your contradictory disclosures and timeline.

Acknowledge receipt today. Send the corrected SAR output to this email and use my current postal address below for all future correspondence.

[Full name]

[Current postal address]
[Email]
PCN: [ref]
VRM: [VRM]

I will send that letter to BW Legal, thank you once again for your time and effort in providing the framework to combat this.

Regarding the letter to CPM. In their email they did state the following (which I have copied and pasted):


“ We have shared your data with the below third parties:
 
Trace Debt Recovery Ltd 2. BW Legal Ltd
             PO Box 1448  Enterprise House
             Northampton  1 Apex View
             NN2 1DW   Leeds
LS11 9BH ”


Before I send the reply to CPM, it appears however from the extract that they have listed BW Legal as a recipient of my personal data. Am I mistaken?

Thank you once again.

Apologies with the formatting, when I hear a response I shall endeavour to format post in a clearer way.

I have sent the amended email to CPM. Regarding the BW Legal one, should I wait until I have a response from the previous correspondence I sent to them, before sending the one you have posted above, or just send it in addition before hearing back from them. (It’s been 30 days today since I sent the last correspondence to them and have not yet heard back).

Thank you

Good morning.

I tried to send the message to BW legal, however their online portal is not working. I then tried to start a live chat and they send an automatic response saying that they’re having technical difficulty so cannot reply. Therefore the only option is to phone them. I’d prefer not to do that way since it’s not written down as evidence.

Also it’s been now over 30 days since I sent the previous letter to BW legal. I have not had a response from them.

Thanks

Thank you, I have sent the letter as you have advised. I did take screenshots so have also included those. I will post again when I have got a response. Thank you once again.

You have some good leverage there. First, send the following email to Countrywide's DPO and CC yourself:

Subject: Personal data breach & incomplete SAR – PCN [ref], VRM [VRM] – ICO escalation if not rectified in 7 days

Dear Data Protection Officer,

I acknowledge your email of 13 October 2025 and the attached breach letter dated 29 August 2025.

Personal data breach
You admit there was “an incident in which personal data relating to you was inadvertently disclosed to an unauthorised individual” on 28 August 2025, identified 29 August 2025. You did not notify me until 13 October 2025. That is not “without undue delay” as required by UK GDPR Article 34. The breach also indicates failures under Article 5(1)(f) and Article 32 (integrity/confidentiality and security of processing).

You also omitted BW Legal from the recipient list in your SAR output, despite you and BW Legal actively processing my data. That renders the SAR incomplete and inaccurate (Articles 12 and 15(1)(c)) and undermines your claim that you had “disclosed in full”.

Accordingly, within 7 days please provide:

1. ICO breach report evidence: date/time you notified the ICO; ICO case/reference number; and a copy of the report/online submission (or your full narrative if by phone).
2. Breach particulars (Art. 34 content requirements):

• nature of the breach; precise data items disclosed;
• likelihood and severity of risk to me;
• steps taken by you;
• specific advice to me to mitigate adverse effects;
• the identity and contact details of your DPO.

2. Recipient/disclosure log (corrected): a complete log for this PCN showing all recipients (including BW Legal): identity, categories of data shared, and date/time of each disclosure; the log entry for the unauthorised recipient; and evidence of your “return/deletion” request and confirmation.
4. Incomplete SAR – missing personal data:

• Full ANPR event log for my VRM for the material period (all reads/timestamps/camera IDs/retention entries).
• RingGo/payment back-office records that reference my VRM/this PCN, including matching/mismatch notes for the material window.
• Internal notes, decision records, and portal/web-form audit logs referencing me/this PCN.
• DVLA KADOE request/response (single request date/time and address returned) and any address-verification/trace records referencing me, particularly before your Final Notice of 12/05/2025 and before instructing solicitors.
• Any data accuracy records explaining continued use of my former address after my DVLA update in early April 2025.

5. Retention schedule & deletion evidence: You asserted data may have been “lawfully deleted”. Provide your retention policy as it applies to my data for this PCN and deletion logs for any items you say are no longer held.

If you claim any exemption, identify the specific exemption and explain how it applies to the particular item withheld.

Unless the above is supplied within 7 days, I will file a complaint with the ICO for (i) failure to comply with Articles 12/15, (ii) breach notification failures under Article 34, and (iii) integrity/confidentiality/security failures under Articles 5(1)(f)/32. I also reserve my rights to seek compensation under Article 82 UK GDPR and s.168 DPA 2018 for distress arising from this breach and your non-compliance.

Acknowledge receipt today. All future correspondence must use my current postal address below.

Yours faithfully,

[Full name]
[Current postal address]
[Email]
PCN: [ref] | VRM: [VRM]

Second, send the following to BW Legal and CC yourself:

Subject: Your ref [BW ref] – Put on hold – Controller breach & data accuracy; Article 14 info required

Dear Sirs,

I dispute the alleged debt. The matter is not ready for litigation.

On 13 October 2025 Countrywide Parking Management (CPM) disclosed to me that on 28 August 2025 they inadvertently disclosed my personal data to an unauthorised individual during a SAR process and only identified it on 29 August 2025. They failed to notify me until 13 October 2025. Their SAR output also omitted BW Legal as a recipient, despite your active use of my data. I have demanded their corrected recipient/disclosure log (including the dates they disclosed my data to you) and their ICO breach report reference.

Given the controller’s admitted breach and SAR inaccuracies, please:

1. Place the matter on hold for 30 days and confirm you will not process further nor issue proceedings until CPM has completed corrective steps and provided the missing disclosure materials.
2. Provide your Article 14 information for this file:

• source of my data and the date first received from CPM;
• categories of personal data processed;
• purposes and lawful bases;
• recipients or categories of recipients;
• retention period for this file.

3. Confirm that all correspondence and any proceedings will be served only at my current address below.

My outstanding PAPDC requests also remain: signage pack/site plan as at 23/12/2024; proof of landowner authority; RingGo integration/payment reconciliation for the material period (including adjacent sites’ codes and change logs); consideration/grace-period policy; and particulars for any sum beyond the principal (the £70 add-on is denied as unrecoverable).

Yours faithfully,

[Full name]
[Current postal address]
[Email]
PCN: [ref] | VRM: [VRM]

To clarify one point regarding the above, they did not include the dates and times they sent my data to BW Legal in the document bundle they attached via email, they just stated the fact that they did disclosed to BW Legal in the body off their email reply. There was no date or time associated with that statement however