Transport Services - Fleet Compliance Privacy Notice

Dudley Metropolitan Borough Council (DMBC) Employees:

Dudley Council’s Transport Services department use a fleet management system (Fleetwave - which is supplied and maintained by a third party provider) to assist in managing and operating the vehicle fleet. Part of this system incorporates a driving licence management function. The Fleet Compliance section within Transport Services ensure that drivers of Council vehicles hold the correct category of driving licence and are suitably trained to drive and / or operate vehicles and equipment (this includes carrying out driving assessments).
Before any council employee driver can drive a vehicle owned, hired or leased by DMBC, they must hold a permit to drive. Driver permits are issued by the Driver Training Officer in Fleet Compliance. To obtain a permit, drivers must pass a driving assessment and to have an assessment, the potential driver must provide driving licence details.
Driving licence verification and information is provided by - The Driver, Vehicle and Licensing agency (DVLA), through our Fleetwave fleet management system provider - Chevin Fleet Solutions Limited.
The Fleet Compliance section arrange and facilitate Driver Certificate of Professional Competence training for DMBC employees through Junction 17 Defensive Driver Training Limited. The details of attendees on these courses are stored securely on a database accessed only by Fleet Compliance section staff.

Housing Fleet Transport have a duty of care to ensure drivers are authorised to drive on a road in accordance with their driving licence.
Housing Transport will collect driver declarations and driving licence information using Adobe Sign, which produces a legally binding agreement, through this e-signature solution. This requires information to be collected and stored with our third-party cloud-hosted supplier in a safe and secure manner

Non Dudley Metropolitan Borough Council Employees:

The Fleet Compliance section offer driving assessments for drivers who are non-council employees (i.e. Non LEA Schools that do not use Council vehicles or Duke of Edinburgh volunteers, etc.). This is a voluntary scheme for schools or other organisations to ensure their drivers meet a minimum standard.
Driver permit and driving licence details for non-council employees are not stored on Fleetwave, but on a separate database. These driver permits are valid for 3 years.
The Fleet Compliance section arrange and facilitate Driver Certificate of Professional Competence training for non DMBC employees (employees of a neighbouring local authority) through Junction 17 Defensive Driver Training Limited. The details of attendees on these courses are stored securely on a database accessed only by Fleet Compliance section staff.

For the purpose of fleet management for council drivers we collect:

• Drivers’ name, signature and date of birth,
• Address,
• Council department / section / post,
• Contact details of the person requesting the assessment,
• DVLA driving licence number, categories and start / expiry dates,
• Details of eyesight correction (we ask if eyesight correction is required to meet the driving standard, not the actual reason for eyesight correction (i.e. medical condition)),
• Details of whether they are exempt from Driver CPC and Tachograph use,
  Number of points and/or endorsements on their licence (& if they were as a result of driving for work),
• Details as to whether they have informed DVLA of any medical conditions that may affect their driving (We ask this question, but not specifically for any details of the actual condition),
• DVLA driver number, categories and start / expiry dates,
• The reason for the driving assessment,
• Personal driving experience (including roads mainly driven on, automatic or manual vehicles, whether they consider themselves to be confident drivers, any further training undergone since passing the driving test, whether they feel angry when driving, who taught them to drive and if they have any special requirements they may have,
• The summary of their driving abilities and recommendations for training (if necessary).

For the purpose of driving assessments for non-council employees we collect:

• Drivers’ name, signature and date of birth,
• Employer / department / section / post,
• Contact details of the person requesting the assessment,
• DVLA driving licence number, categories and start / expiry dates,
• Details of eyesight correction (We ask if eyesight correction is required to meet the driving standard, not the actual reason for eyesight correction (i.e. medical condition),
• Number of points and / or endorsements on their licence,
• Details as to whether they have informed DVLA of any medical conditions that may affect their driving (We ask this question, but not specifically for any details of the actual condition),
• The summary of their driving abilities and recommendations for training (if necessary).

For the purpose of driver training for non-council employees we collect:

• Drivers’ name,
• Employer,
• Name of the person requesting the training,
• Details of the training course attended.

For the purpose of fleet management for council drivers, the following lawful bases are relied upon:

• The council needs to process this information to ensure that both you and the council meet respective obligations under your employment contract.  For example, to make sure you are properly insured and to make sure that the council is complying with its legal obligations, such as Health & Safety Laws.  For certain positions, it is necessary to carry out relevant checks to ensure that you are permitted to undertake the role in question.
  The council relies on a condition specified in Article 9, 2, (b) of the General Data Protection Regulation for processing special category data.  This is where the processing is necessary for the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

For the purpose of driving assessments for non-council employees:

• When undertaking assessments for non-Dudley employees we are acting as Data Processors on behalf of the commissioning organisation. It is up to the commissioning organisation, in their role as a Data Controller, to identify the lawful basis for providing us with your personal data. This is likely to be; in order for you to comply with your contract of employment with them or, if this is not the case, you have provided your consent to undertake the assessment process.
  The council, as a provider of this service, needs to process this information to ensure that both you, your employer and the council meet respective obligations. For example, to make sure you are properly insured and to make sure that the council is complying with its legal obligations, such as Health and Safety Laws. 

For the purpose of driver training for non-council employees:

• When providing driver training for non-council employees, we are acting as Data Processors for the commissioning organisation, usually your employer. It is up to the commissioning organisation, in their role as Data Controller, to identify the lawful basis for providing us with your personal data. This is likely to be; in order for you to comply with your contract of employment with them or, if this is not the case, you have provided your consent to undertake the assessment process.
  The council needs to process this information to ensure that both you and the council meet respective obligations. For example, to make sure you are accredited with the correct training course details such as training courses title and the number of hours attended.

For the purpose of fleet management for council drivers:

• Fleet Compliance section use this information to ensure drivers hold a current driving licence with the correct categories for the vehicles they drive and to ensure that where necessary, drivers maintain their CPC entitlement. Where appropriate, we also require the driver’s current Driver Certificate of Professional Competence (CPC) status.  This is necessary to ensure that our vehicles are being operated legally.

For the purpose of driving assessments and training for non-council employees:

• Fleet Compliance section use this information to ensure potential drivers hold a current driving licence with the correct categories for the vehicle they will be assessed driving in. This is necessary to ensure that the vehicle is being operated legally.
  Fleet Compliance hold details of Driver CPC training received because the neighbouring Local Authority often request details of courses attended by their drivers.

The council takes the security of your data seriously. The council has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. These internal policies and controls are communicated to staff through our online e-policy and e-training system that includes; Data Protection, Information Security, Email and Internet Policy, Appropriate use of global emails and Document Retention. In addition, the organisation has technical network, server and file store security level controls and measures in place, with each system having the appropriate security profiles/Access levels distinctive to roles and responsibilities. The purpose of security roles are to ensure individuals employed by the council have access at the relevant level and this is regularly reviewed.

Where the organisation engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For the purpose of fleet management for council drivers:

• We have a data retention policy which details how long we keep different types of records. The council will hold your personal data for the duration of your employment.  The periods data is held following the end of your employment are set out in the corporate retention schedule, which is available on request.

For the purpose of driving assessments and training for non-council employees:

• Your personal information relating to driver assessment and training will be kept for 7 years, then securely destroyed.