What matters right now is that you ignore DRP entirely. They are not a party to any contract and have no standing. The data controllers are PESS for the parking operation and PCS for their letters. Your SAR rights are owed by the controllers. An unreadable or wrong-password file does not satisfy a SAR. Under UK GDPR the controller must facilitate access within one month in an intelligible, accessible form. The clock does not stop because they sent a bad password.
They have already admitted an ANPR error on one PCN. That supports a systemic multiple-visit or orphan-image problem. Your Google Timeline and your doorbell footage contradict the remaining PCN’s alleged entry time. The sign shows “30 minutes maximum stay” and contains no “no return within X hours” term, so two separate short visits are not a breach.
Debt-collector letters are noise. Only a Letter of Claim or a County Court claim matters. Harassment claims for debt letters alone are rarely worth pursuing, but their unreasonable conduct can count against them on costs if they sue and then lose or discontinue late.
For now write to the PESS Data Protection Officer and copy the PCS DPO. State that you made a SAR to PESS, that a third party sent an inaccessible password-protected file, and that this does not satisfy PESS’s duty as controller. Require PESS to provide the disclosure directly to you or via a working secure link within 7 days and confirm that the original one-month SAR deadline continues to run. Require them to place enforcement on hold while they comply.
Send a SAR scope and hold request to the PESS DPO (copy PCS). Require full-day ANPR event logs for your VRM for each incident date including all images and camera IDs or locations, the operator’s manual quality-control checks for orphan images or multiple visits, the DVLA reasonable-cause audit trail showing who requested data and when, all correspondence logs including email send logs and metadata for the alleged 14 July rejection, and site-signage images current at the time. Ask them to keep all processing and enforcement on hold for 30 days while they comply.
Send a cancellation demand to PESS complaints (copy PCS and the estate or landowner or managing agent). Say they have admitted one PCN was wrong because it was under 30 minutes, that your evidence shows the remaining ANPR “entry” is wrong, that the sign contains no no-return term so multiple short visits are not prohibited, and that their Code requires manual ANPR checks for orphan images which they appear not to have done, resulting in an unreliable DVLA data use. Ask them to cancel the remaining PCN or, failing that, to re-open ADR and issue a fresh POPLA code in light of their admitted error and your new evidence. Give 14 days.
Prepare your evidence bundle but hold the video unless litigation starts. Export Google Location History for both dates in raw form and a printable view. Export the doorbell clip and keep the original. Note the device clock settings and keep a checksum. Gather any school or nursery timings, receipts, or a brief witness note.
At the same time, complain to DVLA (Step 2) that PESS pursued you using unreliable ANPR without required orphan-image checks, that one PCN has already been admitted as wrong, and ask for an investigation into their reasonable-cause use. If the SAR remains non-compliant or they refuse to correct inaccurate data, complain to the ICO for failure to facilitate access and for processing inaccurate data.
As already mentioned, ignore everything from DRP. Only respond to a Letter of Claim or a court claim. If a Letter of Claim arrives, reply within 30 days with a short evidence summary, demand full ANPR logs and QC records, put them to strict proof on signage terms and ANPR accuracy, and state that you will seek costs for unreasonable conduct and any false debt-recovery add-ons.
Deal only with PESS and PCS. Force proper SAR compliance within 7 days. Demand cancellation using the admitted ANPR failure and the missing no-return term. Copy in the landowner. Prepare for a Letter of Claim.
