July 27, 2018

GDPR Brings Changes To Licence Checking Rules

GDPR And What It Means For Fleet Driver Licence Checks

You will probably have been living in a cave if you haven’t heard of or received emails about the new European data protection legislation, the General Data Protection Regulation (GDPR) – which came into force on May 25 2018.

One of the consequences of the new legislation, amongst a whole host of new outcomes, is the need for company car drivers to sign new driver licence-checking consent forms.

GDPR requires businesses to comply with new privacy regulations and one of the areas affected is that of driver consent forms. Supplied by the Driver and Vehicle Licensing Agency (DVLA), they permit third-party companies, including employers, rental and licence checking companies, to check the status of individual company car drivers’ driving licences.

Under the provisions of GDPR, the DVLA has now produced a new form – the D906 Fair Processing Declaration – for drivers to sign for consent to be valid.

How many drivers are affected?

Industry estimates suggest that up to two million drivers will have to sign the new form and non-compliance could result in heavy fines.

Requests for driving licence data via the DVLA’s Access to Driver Data and Driver Licence Check services must now be supported by a completed and signed D906 Fair Processing Declaration.

The new forms ensure that drivers understand who is requesting their driving licence data, what the data is, how it is being requested, and for what reason.

They expire three years from the date of the driver’s signature or when the driver stops driving in connection with the company, whichever occurs sooner.

driving licence checking

Three month window

The DVLA has introduced a three-month transitional period, from May 25 to August 25, in which the current consent forms will remain valid, which will allow drivers to sign the new forms.

However, many within the fleet industry fear that employers and fleet managers, who are legally obliged to check a drivers’ entitlement to drive, will be under huge pressure to meet the August deadline.

To be compliant, employers will need to show evidence of a clear process where the driver has agreed and signed off the data processing, with a date and time of the declaration.

Storing data

Storing driver data in a secure but readily accessible environment is one of the key aspects of GDPR and will apply to fleet vehicle and grey fleet documentation, including road tax, MOT and insurance information.

Many experts believe believes that, over time, GDPR will make paper driver records redundant, because of how difficult it will be to categorise, secure and access them, which will almost inevitably require software systems.

Fleet decision-makers will also need to consider what data is passed to suppliers. Partner companies may be required to confirm what processes they have in place for managing data and be able to show secure data treatment.

Contracts should state what data fleets will supply and the frequency and the purpose for which it will be used by suppliers.

Satellite navigation systems and mobile phones contain a wealth of data so it will be vital to ‘delete’ the data or reset to ‘factory setting’ ahead of defleet of a company car or the return of a hire vehicle.

Lack of readiness

A recent poll of fleet managers by telematics supplier, Masternaut, revealed that only 20% of respondents were confident they would be fully compliant with the GDPR by the May deadline – 47% reported that they still had a long way to go or had just started preparing.

At the same time, a poll by industry publication, Fleet News, revealed around a third of respondents were not confident of meeting GDPR obligations to their fleet drivers.

CLM’s advice

CLM is in the process of ensuring that all its drivers are issued with the new the D906 Fair Processing Declaration so that its third party licence checking suppliers can carry out the necessary driving licence checks.

Without a signed consent form, this simply would not be possible under the new data protection regulation, so there is a need for drivers to complete and return these as soon as possible.

The consent is intended to last for three years, and CLM will be carrying out annual checks to ensure that its clients’ drivers continue to be legally entitled to drive their cars and do not have excessive penalty points on their licences for driving misdemeanours.

It is estimated that there are approximately eight million drivers currently driving for work in the UK in approximately 1.7 million companies.

And it remains a key component of meeting duty of care obligations that companies carry out regular and rigorous checks of driver licences, not just to monitor penalty points but also to ensure workers have the correct licence for the vehicles they drive.

So asking drivers to complete the new consent forms and return them as soon as possible is an important requirement towards meeting those duty of care obligations.

If you need any further information on this topic, please don’t hesitate to get in touch.