What is the date of the second alleged contravention and what is the date of issue of the NtK? No need to show the whole thing, just the dates.
Your car was not at the Poole site. CEL’s images do not clearly show your registration and the photographed vehicle’s colour does not match your V5C. There is a plausible ANPR misread due to D versus B. For at least one NtK, CEL also missed the PoFA 14-day deadline so keeper liability cannot arise. You should not discuss any “driver” because it is not your vehicle in their photos.
What to do now1. File a police non-emergency report for suspected plate misread or cloning and obtain an incident number. Notify your insurer.
2. Write to DVLA asking for a cloning/misread marker on your VRM and requesting a review of CEL’s reasonable cause for your data access given the colour mismatch.
3. Send a formal complaint and data rights notice to CEL for both PCNs, stating vehicle-not-present and demanding cancellation, restriction of processing, and disclosure of ANPR evidence and KADOE details. Include your CCTV stills for the relevant time and the police incident number as soon as you have it.
4. If CEL rejects, use POPLA and lead with vehicle-not-present, illegible VRM, colour mismatch, and for the 05/09/2025 event add PoFA 14-day failure.
5. Ask the site’s managing agent or landowner to instruct CEL to cancel. Request CEL whitelist your correct VRM and blacklist the common D/B misread variant to prevent repeats.
6. If further PCNs arrive after you have put CEL on notice with evidence, complain to the BPA. If CEL continue processing your data without reasonable cause, complain to the ICO.
Evidence to keepExport CCTV clips to MP4 with visible date and time and keep originals. Keep any corroboration that places your car elsewhere, for example phone location history, work logs, fuel or parking receipts in Oxford. Keep copies of all letters and screenshots.
Draft to CEL (send for each PCN, adjust dates and refs)
Subject: PCN [reference], VRM [your registration] — Misidentification (vehicle not present), PoFA timing failure, data rights
I am the registered keeper of VRM [your registration]. Your images do not depict my vehicle. The VRM is not legible. You breached the Private Parking Single Code of Practice, section 7.3(d), by failing to conduct adequate pre-KADOE checks: a competent manual review would have rejected this capture as unreadable and therefore incapable of supporting any DVLA data request.
You then compounded the breach post-KADOE: once your DVLA return showed make/colour that do not match the photographed vehicle, you no longer had reasonable cause to continue processing. At that point you should have immediately ceased processing, erased my data, and notified DVLA of an erroneous request.
Your failure also engages UK GDPR (unlawful processing without a lawful basis), and you should have considered reporting to the ICO. I will be pursuing this separately under the DPA 2018/UK GDPR irrespective of your position on the underlying PCN.
Separately, the Notice to Keeper for the event on 05/09/2025 cannot create keeper liability because it was not “given” within 14 days as required by PoFA Schedule 4 paragraph 9(4)(b). The notice is dated 22/09/2025 and is deemed given on 24/09/2025 under paragraph 9(6), which is day 19.
Accordingly, you are required to:
1. Cancel the PCN(s) and confirm erasure of all personal data relating to me and VRM [VRM] from your systems and those of any third parties.
2. Confirm processing is restricted under UK GDPR Article 18 pending written confirmation of cancellation and erasure.
3. Within one month, disclose all of the following:
• All original uncropped and full-frame ANPR images.
• The ANPR OCR read strings and confidence scores.
• Full entry and exit images.
• Device audit and time-synchronisation logs.
• The make and colour data you retrieved from the DVLA.
• The date, time, and lawful basis of each KADOE request relating to my VRM.
• Your internal checks undertaken at both the pre-KADOE and post-KADOE stages for this event.
3. Whitelist VRM [VRM] for this site and blacklist the known D↔B misread variant to prevent further unlawful data grabs.
4. If this site operates a permit or whitelist scheme:
a. State whether a valid permit/whitelist record existed at the material time for VRM [SUSPECT VRM WITH B/D SWAP].
b. Provide an extract of the permit/whitelist table limited to that single VRM showing VRM, permit status, start/end validity, and creation/amendment timestamps (personal identifiers may be redacted).
c. Confirm whether any PCN was issued to that VRM for the same timestamps; if not, explain why your “reasonable cause” test was not failed at the point a valid permit existed for the misread VRM.
d. Provide your decision log showing the pre-KADOE and post-KADOE checks undertaken when a captured VRM is ambiguous but a near-match appears on the permit list.
e. Confirm whether you cross-checked the DVLA return (make/colour) against the photographed vehicle once you obtained my data and, if so, why processing was not immediately ceased and my data erased.
Take this as notice of intended claim under the Data Protection Act 2018 and UK GDPR for unlawful obtaining and processing of my personal data without reasonable cause, including damages for distress. Complaints will also be lodged with DVLA, the BPA and the ICO. This is independent of any outcome you now reach on the PCN(s). If you do not confirm cancellation and compliance within 14 days, I will escalate without further notice.
Yours faithfully,
[Full name]
Registered Keeper
[Postal address]
Enclosures: CCTV stills with timestamps [and police incident number if available]
Send the following formal complaint to the DVLA:
Subject: Unlawful disclosure and processing of my personal data via KADOE in absence of reasonable cause – VRM [YOUR VRM] – Civil Enforcement Ltd (CEL) – [SITE], Poole – dates [list DATES]
I am the registered keeper of VRM [YOUR VRM]. I have received PCNs from Civil Enforcement Ltd (CEL) alleging visits to [SITE], Poole, on [DATES]. My vehicle was not present. CEL’s images show an unreadable/ambiguous VRM and a vehicle colour that does not match my V5C (mine is black; their images depict a different colour). There is no reasonable cause for any KADOE request in these circumstances.
Operator failings (pre- and post-KADOE):
1. Pre-KADOE: PPSCoP 7.3(d) requires a competent manual quality-control check of ANPR captures before any data request. The VRM in CEL’s images is not legible to the required standard. A competent pre-KADOE review should have rejected the capture outright. Any KADOE request on that basis lacks reasonable cause.
2. Post-KADOE: Having obtained my keeper data, CEL should have reconciled the DVLA return (make/colour) with the photographed vehicle. On discovering the mismatch, CEL should have immediately ceased processing, erased my data, and notified DVLA of an erroneous request. Instead, they continued to process, compounding the breach.
DVLA’s role and obligations:
DVLA is the data controller for my personal data and disclosed it to CEL via KADOE without reasonable cause having been established. That appears to be an unlawful disclosure contrary to UK GDPR Article 5(1)(a) (lawfulness) and 6(1) (no valid lawful basis), and potentially Article 5(1)(d) (accuracy) and 5(2) (accountability). Now that DVLA is on notice, you must investigate whether this constitutes a personal data breach and take appropriate remedial action. If a personal data breach is confirmed, DVLA must assess notification to the ICO and to me in line with Articles 33 and 34, and take steps to prevent recurrence.
Required DVLA actions:
A. Immediately place a cloning/misread/misidentification marker on VRM [YOUR VRM] and circulate an AOS advisory that any future requests linked to [SITE], Poole require strict manual verification against make/colour before disclosure.
B. Open a formal investigation into CEL’s KADOE access for these events, including their pre-KADOE QC and post-KADOE reconciliation. Confirm whether CEL’s requests met the “reasonable cause” threshold. If not, confirm what sanctions DVLA will apply under the KADOE contract and what remedial steps will be taken.
C. Confirm DVLA’s assessment of whether an unlawful disclosure occurred and, if applicable, that DVLA will self-report to the ICO. Provide me with a written apology for the misuse of my data and confirm the route to seek compensation for distress under UK GDPR and the Data Protection Act 2018.
D. Confirm immediate erasure or restriction of processing of my personal data in DVLA downstream systems relating to these events, save for retention strictly necessary for this complaint/investigation.
E. Provide me with copies of the following within one month:
• Each CEL KADOE request relating to my VRM since [DATE RANGE], including timestamps and reason codes.
• The make/colour and other vehicle attributes returned by DVLA to CEL for each request.
• DVLA’s internal checks and decision records that authorised disclosure in these instances.
• Any notifications from CEL to DVLA acknowledging erroneous requests, and DVLA’s responses.
• Any DVLA audit findings or sanctions applied to CEL relevant to this matter.
Please treat this as: (i) a formal complaint; (ii) a data protection objection and restriction request under Articles 21 and 18; and (iii) notice that I reserve my rights to pursue compensation for unlawful processing. I require a substantive complaint response within 20 working days, and fulfilment of the data disclosure items within one month.
I also expect DVLA to confirm what steps will be taken to prevent future wrongful disclosure of my data in similar “unreadable VRM/colour mismatch” scenarios, including any KADOE contract clarifications and AOS guidance reminders.
Police reference (if held): [REFERENCE]
Evidence available on request: CEL images, my V5C (black), CCTV showing my car elsewhere at the material times.
Yours faithfully,
[FULL NAME]
[POSTAL ADDRESS]
[EMAIL]
[VRM]
[DATE]
Have you had any appeal rejection and a POPLA code yet?[/list]
