Guidance

DVSA court cases: privacy notice

Updated 2 December 2024

1. About court cases

The Driver and Vehicle Standards Agency (DVSA) processes information to prepare for the defence of any appeals, small claims court and personal injury claims. DVSA is an executive agency of the Department for Transport (DfT).

The data controller for DVSA is DfT – a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992

2. What data we need

2.1 Driving test appeals

The personal data we collect from parties to a driving test appeal include:

• name
• address
• driving licence number
• driving test information such as driving licence number, description of candidate, date, time and location of the test, and type of test
• name of the instructor and instructor’s personal reference number (if necessary)

2.2 Small claims court proceeding

The personal data we collect from parties to a small claims court proceeding include:

• name
• address
• driving licence number
• driving test information such as date, time and location of test, category of test
• bank account details to arrange any payment (where necessary)

2.3 Personal injury claim

The personal data we collect from parties to a personal injury claim include:

• name
• address
• date of birth
• health information, such as the mental or physical condition
• driving licence number
• driving test information such as date, time and location of the test, and type of test
• medical test reports containing the nature of the mental or physical condition, treatment and prognosis
• any witness information such as name and address

2.4 Other court proceedings

The personal data we collect from parties to other court proceedings in which DVSA is the defendant include:

• name
• address
• driving licence information
• driving test information such as date, time and location of the test, and type of test
• any data to which the allegation relates to age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, or sexual orientation
• any witness information such as name

2.5 Staff appeals and claims

The personal data we collect from staff about appeals, small claims court and personal injury claims include:

• name
• address
• staff number
• DVSA location in which the staff member is based and/or working from
• experience - length of time employed, time in post, any relevant training undertaken, any relevant supervision or quality assurance checks carried out

2.6 Lawful basis

The lawful basis for processing this data is a legal obligation. Part 32 of the Civil Procedure Rules 1998 sets out the legal requirements.

When a claim goes to court, the law says we have to disclose any relevant documents that we hold. It’s a right in law that someone in regulatory proceedings is allowed to see any documents which might:

• support their case
• tend to undermine our case as the regulator

We would be very likely to contravene the right to a fair hearing under Article 6 of the European Convention on Human Rights and Article 47 of the EU Charter of Fundamental Rights if we did not disclose the documents.

It’s a basic aspect of the right to a fair trial that the parties are allowed to see all relevant evidence, except where public interest immunity applies.

3. Why we need it

We will process your personal data as part of the preparation for the defence of any appeals, small claims court and personal injury claims brought against DVSA.

As part of our defence, we will review data we hold which is relevant to the case and any reports we hold about the alleged incident or test.

These cases are regularly brought against the agency by the complainant or appellant who has already provided their personal information to the courts.

4. What we do with it

We collect, use and store the data you give us for the reasons set out in this policy.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

Personal data collected is shared with the Government Legal Department (GLD) who provide legal advice to DVSA and with external counsel or lawyers who are engaged by GLD to represent the agency.

We will share your data if required to do so by law – for example, by court order, or to prevent fraud or other crime.

5. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We will hold your personal data for no later than 20 years after we close our file. This is normally once the court has made a decision or any settlement awarded has been paid.

6. Where it might go

Paper records are either kept securely within locked cabinets in DVSA offices or are securely stored by our contracted records management provider in the UK.

Electronic records are held on DVSA servers currently hosted in the UK or hosted on the cloud from servers based within the EEA.

Third-party storage suppliers are bound by contracts which detail what they can do with the data they hold and as they are based within the EEA are bound by the same Data Protection legislation.

7. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data.

8. Automated decision making and profiling

Your data is not subject to automated decision making or profiling as defined in data protection legislation.

9. Changes to this notice

We may change this privacy notice at its discretion at any time.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date.

We encourage you to periodically review this privacy notice to be informed about how your data is protected.

10. How to contact us

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the DVSA data protection manager

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.