Staff Driving Licence Checks Privacy Notice

This privacy notice explains how we use personal information to check and verify the driving licences of employees who drive on council business, whether in a Council vehicle or using a personal vehicle for which business mileage is claimed. The purpose of these checks is to ensure all staff driving on behalf of us are legally entitled to do so, to manage driving-related risks, and to comply with statutory and insurance requirements.

As part of this process, the Fleet Management Team may also handle related compliance activities, such as verifying driving qualifications, supporting accident investigations, and liaising with internal teams (such as HR and Road Safety) and external agencies (such as the Police, VOSA, and the Traffic Commissioner) where required by law.

Your information will be retained while you remain an employee in a driving role. If you move to a non-driving role, your driving-related information will be deleted, and a non-driver declaration will be retained until you leave employment or return to a driving role.

What information we collect, use, and why

Whenever you engage with the Fleet Management Team regarding driving on council business, we collect certain information to ensure you are legally entitled to drive and to manage driving-related risks. This information helps us identify you, verify your eligibility, and fulfil our statutory and insurance obligations. We categorise the information we collect as follows:

Personal Data

We collect the following personal data to deliver our services:

Name and contact details: To identify you and communicate with you about your driving status and any required actions.
Employee number: To distinguish between individuals with similar names and maintain accurate records.
Line manager’s name and contact details: To escalate issues or notify about driving status changes.
Driving licence number and details (as shown on your licence): To verify your entitlement to drive and check for penalty points or disqualifications.
Mandate form (D906) signature and completion date: To authorise the council to check your driving licence status with the DVLA.
Record of mandate renewal dates: To ensure checks are kept up to date.
Vehicle use status: To record whether you are a driver or have submitted a non-driver declaration.

Special Category Data

We do not routinely collect special category data (such as health, ethnicity, or beliefs) as part of the driving licence check process.

Criminal Data

We collect and process the following criminal data:

Driving licence penalty points and violation codes: To identify driving-related offences and manage risk in line with statutory and insurance requirements.
Disqualification status: To ensure only eligible staff are permitted to drive on council business.

We only collect information that is necessary for the purposes of verifying your entitlement to drive, managing driving-related risks, and complying with our legal and insurance obligations.

Sources of Information

We primarily collect information directly from you when you complete a driving licence mandate form or communicate with the Fleet Management Team. However, in certain circumstances, we may also receive information from other sources to ensure the accuracy and completeness of our records and to fulfil our statutory obligations. These sources include:

Driver and Vehicle Licensing Agency (DVLA): To verify your driving licence status, penalty points, and eligibility to drive.
Line managers and internal Council teams: To confirm your employment status, driving role, and for escalation or risk management purposes.
Central government agencies: Where required for compliance or statutory reporting.
Police and enforcement agencies: In the event of an incident, investigation, or where required by law.
Commissioned partners or contracted service providers (e.g., Licence Link): To facilitate driving licence checks and manage compliance processes.
Members of the public (referrers): In rare cases, if concerns about driving behaviour or eligibility are raised.

We only collect information from these sources where it is relevant, necessary, and lawful to verify your entitlement to drive on council business and to manage associated risks. All information is handled in accordance with data protection legislation and council policies.

What is your personal information used for?

Your personal information is used to:

Verify your entitlement to drive on council business: To ensure you hold a valid driving licence and meet all legal and insurance requirements for driving as part of your employment.
Comply with statutory and regulatory obligations: To fulfil the council’s legal duties under health and safety, road traffic, and insurance legislation.
Monitor and manage driving-related risks: To identify and address issues such as penalty points, disqualifications, or unsafe driving behaviours.
Support accident investigations and insurance claims: To provide accurate information in the event of an accident involving a Council vehicle or while driving on council business.
Detect and prevent crime or fraud: To ensure the integrity of Council operations and protect public resources.
Improve service delivery and driver safety: In certain circumstances, we use personal information to create statistics and reports that help us monitor driver performance, identify trends, and improve overall safety and efficiency.
Respond to queries, requests, or complaints: To handle any questions or concerns you may have about your driving status or the licence check process.
Share information with relevant internal and external parties: Where necessary, to coordinate risk management, compliance, or investigations with HR, Road Safety, Enforcement, the Police, VOSA, or the Traffic Commissioner.

Your information is only used where it is relevant, necessary, and lawful to support safe and compliant driving on behalf of us.

Who Do We Share Your Information With?

We share your information only when necessary or required by law. This includes sharing with the following organisations and teams for the reasons outlined below:

Internal Council Teams:

Line managers and HR: To manage your driving status, address any issues, and support employment processes.
Road Safety and Training Teams: For driver assessment, training, and support with safe driving initiatives.
Enforcement or Management Board: Where required for compliance, risk management, or investigation.

External Agencies and Organisations:

Driver and Vehicle Licensing Agency (DVLA): To verify your driving licence status and eligibility.
Government Agencies (e.g., Traffic Commissioner, VOSA): To comply with statutory and regulatory obligations.
Police and law enforcement: To assist in the prevention and detection of crime, and to support investigations or legal requirements.
Commissioned partners or contracted service providers (e.g., Licence Link): To facilitate driving licence checks and manage compliance processes.
Fuel Card Providers: Where you have a Council fuel card issued in your name, to manage fuel usage and compliance.
Technology Assistance Providers: To support the secure management and processing of your information.

We only share your information with these organisations and teams when it is necessary to deliver the service, comply with the law, or protect our interests. All organisations receiving your information are required to handle it securely and in accordance with data protection legislation.

Data Processors

We use data processors to support our activities and ensure efficient service delivery. These data processors act on our instructions and are required to comply with data protection legislation. The main data processors we use for staff driving licence checks and related compliance activities include:

Microsoft (Email, Teams, Excel, internal telephony): To log your contact with us, manage case information, and securely store records.
UNIT 4: To maintain accurate employee records, including contact information, employee number, and email address.
Licence Link: To check your driving licence details with the DVLA and manage the licence checking process.
Logistics UK: To record driver digital tachograph information and ensure compliance with UK regulations.
Zurich Municipal: Our corporate insurance provider, involved in the event of an accident involving a council vehicle.
C-TRACK: Provider of our onboard vehicle telematics system and driver fobs, used to monitor driving behaviour and vehicle usage.
ALLSTAR: Our corporate fuel card provider for employees with fuel cards issued in their own name.

By using these data processors, we aim to enhance our service delivery, ensure the security of your information, and provide you with the best possible support. All data processors are contractually required to handle your information securely and only use it for the purposes specified by us.

Data Controller

We are the Data Controller for this processing.

The Lawful Basis for Processing

We do not rely on consent as a lawful basis for processing your personal data for driving licence checks. We process your personal data under:

UK GDPR Article 6(1)(c) – Legal Obligation:
Processing is necessary for compliance with a legal obligation to which the council is subject. This includes fulfilling statutory duties under the Health and Safety at Work Act 1974, the Road Traffic Act 1988, the Management of Health and Safety at Work Regulations 1999, the Provision and Use of Work Equipment Regulations 1998, and the Corporate Manslaughter and Corporate Homicide Act 2007.

Criminal Offence Data

Where we process information about driving offences (such as penalty points or disqualifications), this is done under the Data Protection Act 2018, Schedule 1, Part 1, Paragraph 1 (employment, social security, and social protection), with an appropriate policy document in place.

Special Category Data

We do not routinely process special category data (such as health or ethnicity) as part of the driving licence check process.

We only process your information where it is necessary to comply with our legal obligations, manage driving-related risks, and ensure the safety and compliance of staff driving on council business.

Legislation we rely on includes (but is not limited to):

Health and Safety at Work Act 1974
Road Traffic Act 1988
Management of Health and Safety at Work Regulations 1999
Provision and Use of Work Equipment Regulations 1998
Corporate Manslaughter and Corporate Homicide Act 2007

International Data Transfers

We do not routinely transfer your personal information outside the United Kingdom as part of the staff driving licence check process. All data is stored and processed within the UK, either on council systems or by contracted providers who are required to comply with UK data protection law.

In the unlikely event that it becomes necessary to transfer your personal information internationally (for example, if a contracted service provider stores data in another country), we will ensure your information is protected by using appropriate safeguards, including:

Adequacy Decisions: Only transferring data to countries with data protection laws recognised as adequate by the UK government.
Appropriate Safeguards: Using Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or International Data Transfer Agreements (IDTAs) where required.
Derogations for Specific Situations: Relying on your explicit consent, performance of a contract, public interest, legal claims, or vital interests, if applicable.
Risk Assessments: Conducting risk assessments to ensure data protection standards are maintained.
Technical and Organisational Measures: Implementing encryption, access controls, and regular audits to protect your data.

These measures ensure your personal information remains secure and your rights are upheld, even if transferred internationally.

Retention Period

We will only use your personal information while you are employed in a role that involves driving on behalf of us, and to deal with any questions or complaints that we receive about this processing. Unless the law requires us to keep it for a longer period, your information will be retained as follows:

Driving licence information, driver/non-driver declarations, and telematics data: Retained for as long as you are employed in a driving role. If you move to a non-driving role or leave employment, your driving-related information will be deleted after 1 year, and a non-driver declaration will be retained until you leave employment or return to a driving role.
Digital tachograph data: Retained for 24 months.
Insurance correspondence: Retained for 7 years from the date of the incident or claim closure.

If we need to use your information for research or reporting purposes, your information will be anonymised. Any notes taken during consultation or investigation sessions will be securely destroyed once no longer needed. Anonymised information may be used in reports or papers and, where of historic interest, may be held in public archives indefinitely.

Your Rights

The UK GDPR provides you with a several rights to control what personal information is used by us and how it is used by us.

Further guidance about these rights can be accessed from the Information Commissioner’s Office (ICO) website

If you are not happy about the way your personal data is being used, or you require further information about how we process your personal data, you can contact our Data Protection Team:-

Online: Contact the DPO
By post: Data Protection Officer, The Portal, Wellington Road, Ellesmere Port, CH65 0BA

You also have the right to complain to the Information Commissioner’s Office using the following details:

Website: Information Commissioner's Office (ICO)
Instant Message: Live Chat
By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113