Write to your MP and show him/her this line of correspondence and the BPAs shirking of their responsibilities. They try to pass themselves of as a pseudo-regulator but manage only to prove that their only interest is in actually protecting their members when it can clearly be shown that they are abusing the process.
Where has anyone mentioned “recorded delivery”. All that is required to prove posting is a free certificate of posting from any post office. Yet more obfuscation. The burden of proof is still on the operator to prove it was posted, not on the recipient to prove it wasn’t posted.
The BPA forwarding your personal complaint—including details of your dispute with ParkingEye—to Euro Car Parks (ECP), a completely unrelated entity, constitutes a clear breach of GDPR under Article 5(1)(f) and Article 6 of the UK GDPR.
Why this is a GDPR Breach:
Unlawful Processing of Personal Data – Your complaint contained personal data (name, case reference, PCN details, etc.), and ECP has no lawful basis to receive this information because they are not involved in your case.
Failure to Ensure Data Security – The BPA, as a data controller for complaints, must take appropriate steps to ensure personal data is only processed by the correct recipients. This careless mishandling suggests a systemic failure in their complaint-handling process.
Breach of Confidentiality – The fact that the BPA is incorrectly sharing personal complaint data with third parties calls into question whether other complaints have also been misdirected, exposing a serious data governance issue.
Consequences of a GDPR Breach:
The BPA is obliged to report a personal data breach to the ICO (Information Commissioner's Office) within 72 hours if the breach is likely to result in a risk to the rights and freedoms of the individual. Given that your personal data was sent to the wrong company without lawful justification, this is a reportable incident.
Send the following response to the BPA:
Subject: BPA’s Failure to Handle My Complaint Properly – GDPR Breach & Continued Non-Compliance
Dear BPA Compliance Team,
I am writing to express my extreme concern over your handling of my formal complaint regarding ParkingEye. Your response is not only entirely inadequate in addressing the core issue but has now escalated into a serious data protection breach under UK GDPR.
1. Serious GDPR Breach – Unlawful Sharing of My Personal Data
It has come to my attention that you have forwarded my complaint to Euro Car Parks (ECP) instead of ParkingEye.This constitutes a clear breach of UK GDPR under:
- Article 5(1)(f) – Failure to ensure security and confidentiality of personal data
- Article 6 – Unlawful processing of personal data without a valid legal basis
Euro Car Parks has no involvement in this case, and there is no lawful basis for you to have transferred my personal data to them. This failure to handle personal data securely calls into question the BPA’s entire complaint-handling process and whether other complainants’ personal data has also been mishandled.
Under UK GDPR, you are now legally required to:
- Inform me of the full extent of the breach – What personal data was sent to ECP? Was this only my complaint, or did it include additional information?
- Confirm whether you have reported this breach to the ICO – Given that my data was shared with an unauthorised third party, this is a reportable incident under GDPR rules.
- Provide me with an immediate Data Breach Notification – You must confirm in writing what steps you are taking to contain the breach and prevent recurrence.
Failure to act transparently on this matter will result in an immediate escalation to the Information Commissioner’s Office (ICO).
As for the rest of your response, it remains wholly inadequate, both in content and in addressing the fundamental regulatory obligations of the BPA as an Accredited Trade Association (ATA). Additionally, the fact that you have incorrectly forwarded my complaint to Euro Car Parks instead of ParkingEye, raises further concerns about the care and accuracy with which complaints are handled.
1. Misrepresentation of “Recorded Delivery” vs. “Proof of Posting”
Your response references "Recorded Delivery", which is entirely irrelevant to this matter. At no point was "Recorded Delivery" suggested or required. This is a service that requires a signature upon receipt and incurs a cost.
What was actually requested—and what is relevant to both PoFA and the PPSCoP—is "Proof of Posting", which is a free service provided by Royal Mail in the form of a Certificate of Posting.
The Interpretation Act 1978 states that where a document is required to be "given" or "served," it is considered delivered two working days after posting if using first class service, but this presumption only applies if proof of posting exists. Without such proof, an operator cannot rely on the presumption of delivery under the Interpretation Act or PoFA.
2. BPA's Failure to Enforce a Fundamental Evidential Requirement
The BPA’s stance that operators are not required to provide Proof of Posting when challenged is deeply flawed. Your response states:
“Operators are not obliged to send letters via recorded delivery. The Code of Practice does not cover this. When an operator can provide a copy of the Parking Charge, we deem this compliant with the Code of Practice.”
This statement is highly concerning for several reasons:
- It misrepresents the actual complaint by falsely framing it as a demand for "Recorded Delivery."
- It fails to acknowledge that providing a copy of a letter is NOT proof that it was ever posted. Anyone can generate a digital or paper copy of a letter—this does not demonstrate it was sent.
- It contradicts the purpose of the PPSCoP 8.1.2(e) Note 2, which explicitly refers to the evidential requirement of proof of posting when questioned.
3. BPA's Position on Enforcing PoFA Compliance
Your response fails to clarify whether the BPA accepts that PoFA compliance requires operators to prove they have issued a Notice to Keeper within the statutory timeframe.
As an ATA, the BPA has an obligation to ensure its members comply with both PoFA and the PPSCoP. Your refusal to require operators to provide proof of posting when challenged undermines the entire legal framework on which private parking enforcement is based.
To clarify: the burden of proof is on the operator to show compliance, not on the motorist to disprove it.
4. BPA’s Selective Quoting of the PPSCoP
Your attempt to justify omitting key parts of PPSCoP 8.1.2(e) Note 2 by referring to Section 1 ("Scope") is misleading. While it is true that some Notes are considered "best practice," this does not mean that they are entirely optional when they clarify an evidential requirement.
- The requirement to issue an NtK so that it is “given” to the recipient within 14 days is mandatory if the operator is relying on PoFA.
- The evidential requirement for proving this issuance (proof of posting) directly relates to whether an operator can meet that mandatory requirement.
By dismissing the necessity of Proof of Posting as merely “best practice,” the BPA is allowing operators to claim PoFA compliance without providing any actual proof. This is not just a failure of oversight—it is an active facilitation of non-compliance.
5. BPA’s Regulatory Obligations – Request for Clarification
Given the above, please provide a clear and unambiguous response to the following:
- Does the BPA acknowledge that Proof of Posting (via a Royal Mail Certificate of Posting) is the standard evidential requirement for an operator to rely on the Interpretation Act 1978’s presumption of delivery? If not, what alternative proof does the BPA require?
- If an operator fails to provide Proof of Posting when challenged, does the BPA accept that this means the operator cannot demonstrate compliance with PoFA?
- What specific regulatory action will the BPA take against ParkingEye if they fail to provide tangible evidence of posting?
- Does the BPA accept that merely providing a copy of an NtK is not proof that it was ever sent?
Conclusion
The BPA’s actions so far have been wholly inadequate and now include a serious data protection failure. I expect immediate action and a full response without further delay.
The BPA’s failure to enforce compliance on this matter is unacceptable. Your current stance appears to be that operators can state they posted a letter without ever being required to prove it, and that if challenged, the burden shifts to the recipient to disprove it. This completely undermines both PoFA and the PPSCoP.
I expect a direct, specific, and transparent response to the above points. If the BPA continues to evade its regulatory responsibility, I will escalate this matter to the DVLA and relevant government authorities regarding your failure to ensure accountability among your ATA members.
Yours sincerely,
[Your Name]
[Your Reference/PCN Number]
