Free Traffic Legal Advice

As a starting point, log onto their online portal (as if going to appeal) and see if any good resolution photos are available. You need to establish if this is a case of UK-CPM having misread the plate of someone else's car, or a potential case of your plate having been cloned (as the latter will require you to contact the police).

You say the car pictured is a different model - how different are we talking?

They should be doing a check on the details provided by DVLA vs the images, which apparently hasn't happened here. We can advise on that in due course but in the meantime, have you tried the below?

As a starting point, log onto their online portal (as if going to appeal) and see if any good resolution photos are available. You need to establish if this is a case of UK-CPM having misread the plate of someone else's car, or a potential case of your plate having been cloned (as the latter will require you to contact the police).

OK, so not a cloned plate, just incompetence from UK-CPM, that's a relief at least.

If nobody beats me to it, I can draft something up for you later.

Whilst I appreciate the fact that your vehicle was never at the location, are you saying that the vehicle in the photo is a red Nissan Micra but you are the registered keeper of a red Citroen Berlingo?

If that is the case, you should send the following as a formal complaint, not an appeal, by email to CPMUK at complaints@uk-cpm.com and also CC in yourself:

Subject: Formal Complaint – Misidentification of Vehicle & Unlawful Processing of Personal Data

To: UK CPM Ltd
Complaints Department

Date: [Insert Date]

PCN Reference: [Insert PCN Number]

Dear Sir/Madam,

I am submitting this formal complaint regarding the unlawful issuance of a Parking Charge Notice (PCN) against my vehicle. Your CCTV evidence clearly shows a vehicle with the VRM [Incorrect VRM], whereas my registered vehicle’s VRM is [Correct VRM]. Furthermore, the vehicle in your footage is a Nissan Micra, whereas my vehicle is a Citroen Berlingo—a completely different make, model, and body type.

Your operatives have misread the vehicle registration mark (number) (VRM), resulting in the unlawful request and processing of my personal data from the DVLA. This demonstrates a complete failure to follow the mandatory quality control procedures set out in the BPA/IPC Private Parking Single Code of Practice (PPSCoP), specifically section 7.3(d).

Failure to Conduct the Required Manual Quality Control Check

As this PCN was issued based on CCTV footage, your staff were required to manually review and verify the accuracy of the VRM before processing the charge. However, section 7.3(d) of the PPSCoP explicitly states:

“Photographic evidence must not be used by a parking operator as the basis for issuing a parking charge unless:
d) images generated by ANPR or CCTV have been subject to a manual quality control check, including the accuracy of the timestamp and the risk of keying errors.”

This requirement exists to prevent the very kind of error that has occurred in this case. Your operatives failed to carry out even the most basic verification checks, resulting in an entirely unjustified PCN. This failure proves that:

1. Your manual review process is either non-existent or entirely inadequate; or
2. Your operatives are incompetent in carrying out basic quality control checks.

Had your staff properly checked the footage before issuing this PCN, they would have immediately noticed that:

• The registration number captured ([Incorrect VRM]) differs from mine ([Correct VRM]) by a single digit.
• The vehicle make and model do not match my registered vehicle details.

This constitutes clear evidence of a breach of the PPSCoP and a fundamental failure of your internal processes.

Unlawful Processing of My Personal Data – UK GDPR Breach

Since the vehicle in question was not mine, your request for my data from the DVLA was made without lawful cause. This means my personal data was unlawfully accessed and processed, in direct violation of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. Your actions violate:

• UK GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency
Personal data must be processed lawfully and fairly. Your unlawful request for my DVLA data breaches this requirement.

• UK GDPR Article 6(1)(f) – Legitimate Interest
There was no legitimate interest in obtaining my personal data, as no contravention involving my vehicle occurred.

• UK GDPR Article 17(1)(d) – Right to Erasure
I now invoke my Right to Erasure and require you to delete all personal data related to this PCN.

• Data Protection Act 2018, Section 170 – Unlawful obtaining of personal data
Your request for my personal data, knowing that no contravention involving my vehicle had occurred, constitutes a breach of data protection law.

Formal Complaint to the DVLA

Regardless of your response to this complaint, I am submitting a formal complaint to the DVLA regarding your unlawful request for my data in breach of your Keeper at Date of Event (KADOE) contract. I will be requesting that the DVLA investigates:

1. Why you were able to obtain my personal data despite the clear mismatch between the VRM and vehicle make/model.
2. Whether this is part of a wider pattern of systemic failures in your data request procedures.

Required Actions

To resolve this complaint, I require the following actions:

1. Immediate Cancellation – The PCN must be cancelled immediately, and written confirmation must be sent to me.
2. Full Data Erasure – Under UK GDPR Article 17, you must erase all personal data you have unlawfully obtained and processed in relation to this PCN and provide written confirmation within 7 days.
3. Review of Internal Processes – You must confirm in writing what steps you will take to ensure that this failure does not happen again.

Escalation if Unresolved

If you fail to provide a satisfactory response within 14 days, I will escalate this complaint by:

• Submitting a complaint to the Information Commissioner’s Office (ICO) regarding your unlawful processing of my personal data.
• Initiate legal action under UK GDPR Article 82 and Section 168 of the Data Protection Act 2018, in a Letter of Claim seeking compensation for the distress caused by your misuse of my data.

I expect your written confirmation of PCN cancellation and data erasure within 7 days and a full response to this complaint within 14 days. Failure to comply will result in further escalation.

Yours sincerely,

[Your Full Name]

[Your Address]
[Your Email]

You should also make a forma complaint to the DVLA about this because the operator has breached their KADOE contract and obtained and used your DVLA data unlawfully. The DVLA are bound to investigate these breaches of the KADOE contract and if necessary, withdraw the operators right to access DVLA data in future

Wow, that's brilliant. Thank you again. I'll sort this out first thing and let you know how it goes.

Many, many thanks for your concise help.

There are several quality assurance (QA) steps in the process, this includes a check of the whole contravention prior to sending the contravention to the DVLA, QA checking of these operatives’ checks, internal checks when DVLA data is received (Invalid VRM/Vehicle Make) and checking of the images and issue reasons on the letter prior to sending it to our mailing house. This is in addition to the technical checks conducted by our Technical Department who regularly review cameras and their accuracy rates.

Can you smell the male bovine excrement?

If you believe we have mishandled your personal data we would remind you of your right to make a complaint to the Information Commissioner’s Office (ICO), this can be done at the following link: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/

They have mishandled your data, first by requesting it from the DVLA and then by sending you a PCN. You must report them to the ICO and you have their admission.

You also have the right to take judicial action in relation to this matter and should you choose to take this route, we suggest you seek advice from a suitably qualified law firm. 

No need for a lawyer but if you do want to use one, I suggest you contact Jackson Yamba at Contestor Legal.

Article 5(1)(d) of the UK GDPR requires data controllers to ensure that personal data is accurate and, where necessary, kept up to date. If a data controller, such as a private parking company, unlawfully obtains a vehicle keeper’s data from the DVLA and processes it inaccurately—such as issuing an invoice based on incorrect information about a breach of an alleged contract with the landowner (or their agent)—this constitutes a breach of the UK GDPR. Such processing is both inaccurate and unlawful under Articles 5(1)(d) and 5(1)(a).

In this case, the parking company has admitted liability for unlawfully processing your data. This admission removes any factual dispute as to whether a breach occurred. Accordingly, you are now entitled to seek compensation for the distress and inconvenience caused by the unlawful and unjustified processing of your personal information.

Precedents for claiming damages for breaches of data protection law can be found in Halliday v Creation Consumer Finance Ltd [2013] EWCA Civ 333, where the Court of Appeal upheld an award of damages for distress caused by inaccurate data processing under the Data Protection Act 1998. Although this case predates the UK GDPR, its principles remain applicable under the UK GDPR and Data Protection Act 2018.

Under Article 82 of the UK GDPR and Section 168 of the Data Protection Act 2018, individuals have the right to compensation for both material and non-material damage resulting from a breach of data protection law. Non-material damage includes distress, anxiety, reputational harm, and time spent dealing with the consequences of the breach.

The case of Vidal-Hall v Google Inc [2015] EWCA Civ 311 confirmed that claimants may recover damages for distress alone, even in the absence of financial loss. This principle is now expressly recognised under the UK GDPR. In light of the breach being admitted and its impact on you, a reasonable starting point for a claim may be £300, which is within the bracket of awards commonly seen for minor but impactful breaches, such as in Johnson v Eastlight Community Homes Ltd [2021] EWHC 3069 (QB).

The case of Tetragon Financial Group Limited v Revenue and Customs Commissioners [2020] UKUT 0305 (TCC) also underscores the importance of accurate data handling by public bodies such as the DVLA. Where a parking company obtains your keeper data from the DVLA and uses it unlawfully—particularly after the DVLA supplied that data under the assumption it would be used lawfully—you have strong grounds for a claim.

To pursue compensation for the unlawful processing of your personal data, you should provide a pre-action notice to the data controller of the private parking company. While the standard pre-action protocol typically allows 14 days' notice, providing 21 days demonstrates goodwill.

Your letter should clearly state your intention to claim damages of, say, £300 for distress, citing Article 82 of the UK GDPR and Section 168 of the DPA 2018. Mark this letter as a ‘Letter Before County Court Proceedings’. If they decline or ignore the request, you can then escalate the matter by issuing a County Court claim as a litigant-in-person under the small claims track (Part 27 CPR).

Claims of this type are commonly issued online through the Money Claim Online service (moneyclaimonline.gov.uk). The claim fee for a £300 claim is £35, which is recoverable if your claim succeeds, bringing your total claim to £335.