Fleets are risking General Data Protection Regulation (GDPR) fines by using employee’s National Insurance (NI) numbers for driving licence checking, FleetCheck said this week.
The practice could lead to prosecution if a disgruntled employee chose to make a formal complaint that their personal data – which includes date of birth and home address - was being used in this way, said FleetCheck director Andy Kirby.
There are two compliant routes for fleets to check employee driving licences for penalty points, Kirby said. One is to ask the driver to enter their own NI number on the Driver Vehicle Licencing Authority (DVLA), web site, which generates a code the employer can use to undertake a check. The other is to use a recognised agency or product that carries out authorised checks, such as FleetCheck’s own Licence Assured.
However, FleetCheck said it is aware of several employers who are using each employee’s own NI number and accompanying data to carry out DVLA checks, essentially pretending to be the driver.
Kirby said: “This is a very risky approach, leaving businesses at the risk of an investigation by the Information Commissioner’s Office (COI), which could be disruptive, expensive, and lead to reputational damage.
“All it would take is one unhappy current or former employee to reveal what you are doing. There is perhaps the possibility of mounting a defence on the basis that the employee has freely handed over their NI number and other data, but that is very much open to question.”
The practice is also known to be viewed dimly by the DVLA, Kirby added, although it is something DVLA will find difficult to prove or disprove, without a complaint by someone affected.
“Using NI numbers in this way may remain undetected for an extended period, potentially until the DVLA introduces a more secure portal, as planned for the future.
“Nonetheless, a single driver lodging a complaint could lead to significant complications,” Kirby warned.
Issues over licence checking remained common at many fleets, with fundamental errors often made, he added.
“We encountered one fleet recently that inspects licences by looking at the standard plastic card, which has never shown points.
“Presumably, that fleet manager is impressed that none of his drivers have ever been penalised. These are basic and worrying risk management failures.”
