Guidance

DVSA CCTV and body-worn cameras: privacy notice

Updated 2 December 2024

1. About the use of CCTV and body-worn cameras

The Driver and Vehicle Standards Agency (DVSA) takes enforcement action against high-risk vehicle operators, MOT garages, illegal driving instructors and others who fail to comply with the regulatory areas, which DVSA enforces. DVSA is an executive agency of the Department for Transport (DfT).

We use closed-circuit TV (CCTV) and, where necessary, body-worn video:

• as part of our enforcement activities
• for the security of staff, contractors and visitors and the protection of our sites
• for the prevention and detection of crime at our premises

CCTV camera locations are chosen to minimise the capture of images which are not relevant to the legitimate purposes of the monitoring.

The term CCTV takes the same meaning as surveillance camera system as defined in s29(6) Protection of Freedoms Act 2012 and includes use of:

• Automatic Number Plate Recognition (ANPR)
• static cameras
• body-worn video (BWV)
• unmanned aerial systems (UAS)
• other systems that capture information of identifiable individuals or information relating to individuals.

The data controller for DVSA is DfT – a data controller determines why and how personal data is processed. For more information, see DfT’s entry in the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992.

CCTV cameras are installed in theory test centres to prevent and detect crime, and for the safety of customers, visitors and staff. The theory test is run by external companies, called Pearson VUE and Reed in Partnership Limited, on behalf of DVSA.

The data controller for CCTV at theory test centres run by Pearson VUE is Pearson VUE. For more information see the Pearson VUE entry in the ICO Data Protection Public Register. Pearson VUE’s registration number is Z8676101

DVSA and Reed in Partnership Limited are joint data controllers for CCTV at Reed in Partnership run theory test centres. Reed in Partnership Limited’s registration number is Z5877229.

2. What data we need

The personal data we collect from you through the use of CCTV will include:

• still images
• video recording

The personal data we collect from you through the use of activated body-worn video will include:

• video recording
• audio recording

The personal data we collect from you through the use of ANPR will include:

• still images of vehicle registration number
• location and movement data

Where images or recordings show evidence of an offence, it may be combined with other personal data we hold about you. That data may include:

• your name and address
• vehicle registration number
• driving licence number
• any other data deemed necessary

The lawful basis for processing this data is either to comply with our legal obligations under The Health and Safety at Work Act 1974, or our legitimate interests of prevention and detection of crime.

3. Why we need it

We need the personal data collected from you to:

• use as evidence of harassment or abuse against our staff, contractors and visitors
• prevent or detect crime
• use as part of an investigation to take enforcement action in line with the regulatory areas we enforce (where necessary)

The main purpose of CCTV recording is to support staff in their enforcement activities.

However, if an allegation of misconduct is made against a staff member, CCTV images may be used in the investigation to provide a true and fair assessment of events.

4. What we do with it

We collect, use and store the data you give us for the reasons set out in this policy.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We use external companies called Mitie, Marlowe and some sub-contractors to install, maintain and, in some cases, monitor our CCTV.

Where CCTV images show evidence of a crime, we will share this with the police.

Data collected by ANPR is uploaded into the National ANPR Data Centre, where it is stored with data from police forces. Other agencies have access to this data for legitimate law enforcement purposes.

We will share your data if required to do so by law – for example, by court order, or to prevent fraud or other crime.

Where requests for CCTV footage are made by third parties, for example a member of the public, redaction software will be used to protect the identity of staff and other individuals.

We’ll use redaction software to protect the identity of staff and other individuals if the media makes a request for access to recorded material. Before using recorded material, the media must send proof of any editing back to DVSA, either for approval or final consent.

5. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We will hold your personal data for:

• between 12 and 40 days depending on the CCTV solution at our sites that have CCTV
• 30 days for body-worn images and recordings
• up to one month where images are recorded by our enforcement vehicles (some vehicles will not hold footage for this full period)

Where footage is to be used as evidence, it will be held separately and securely and kept until the investigation is concluded.

Where footage is used as part of a disciplinary investigation against DVSA staff it will be held securely for 3 years after the end of the investigation in line with our HR retention policy.

6. Where it might go

Our IT infrastructure and technology has been checked to make sure it’s safe and secure.

Recorded images are only viewed by approved members of staff whose role requires them to have access to such data.

7. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data and the rights you have over your data.

You can request your personal information held by DVSA that’s come from CCTV footage and images from a body-worn camera.

8. Automated decision making and profiling

Your data is not subject to automated decision making or profiling as defined in data protection legislation.

9. Changes to this notice

We may change this privacy notice at our discretion at any time.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of that revision date.

We encourage you to periodically review this privacy notice to stay informed about how your data is protected.

10. How to contact us

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled, you can contact the DVSA data protection manager.

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.