Guidance

Health and safety incident reporting: privacy notice

Updated 12 November 2024

1. About this service or activity

The Driver and Vehicle Standards Agency (DVSA) provides this service to report and manage health and safety incidents. DVSA is an executive agency of the Department for Transport (DfT).

We investigate health and safety incidents arising out of DVSA business activities as part of a statutory function to manage health and safety at work. This service enables DVSA staff to report health and safety incidents and “near misses” so that they can be effectively investigated. Using the data, we can identify immediate and underlying causes, take action, and determine the level of investigation required, depending upon the level of seriousness of the incident.

The data controller for DVSA is DfT – a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992.

2. What data we need

The personal data we collect about you may include:

The DVSA staff member reporting the incident:

• name
• date and time of notification
• staff number
• phone number

People involved in the incident:

• name
• date and time of incident
• staff number
• phone number
• email address
• incident location – DVSA premises or non-DVSA premises
• actual location of incident – road, building, external DVSA area, non-DVSA car park, motorcycle manoeuvring area, vocational manoeuvring area, authorised testing facility or “other” where you can enter free text
• area of DVSA the incident relates to – driving and riding tests, enforcement, vehicle testing, office or administration
• whether an assault took place
• whether any assault was thought to be motivated by any protected characteristics, such as race or sexual identity
• approved driving instructor number
• any CCTV imagery of the incident
• whether the police were informed, and any action taken by them
• description of incident
• cause of incident – candidate, third party, DVSA staff member, equipment or property vehicle fault or “other” where you can enter free text
• injury information including details of injuries and how many and to whom – employee, candidate, contractor, other or employee
• any treatment given – no treatment, self-treatment, first aid or medical (hospital or GP)
• details of vehicle or property damage – no damage, minor or major damage
• main vehicle details – vehicle individual was in, or other vehicles involved
• evidence provided which could be CCTV images, witness statements, photographs or videos

Witnesses to the incident:

• name
• phone number
• who you are – candidate/customer, approved driving instructor, staff member or other
• witness statement
• photos

Police:

• name
• contact phone number
• action taken

DVSA investigator:

• name of manager responsible for investigating the incident
• email address of manager
• phone number of manager

The data will be collected directly from you or via the person completing the incident report.

The lawful basis for processing this data is public task.  We do so within this legislation:

• Health and Safety at Work etc Act 1974
• Reporting of Injuries, Disease and Dangerous Occurrences Regulations 2013 (RIDDOR)

The lawful basis for sharing your data with a Trade Union Health & Safety representative is consent, however, depending on the severity of the incident, as mandated by RIDDOR, your data may need to be shared. You will be asked at the time of the incident being reported, whether you consent to your personal details being given to a Trade Union Health & Safety representative. The representative is a member of DVSA staff who has received training in the investigation of incidents and has legal powers to investigate incidents. Trade Union Health & Safety representatives will only have access to anonymised data, however, if requested they can be provided with a full report only if your consent has been given, or if the severity of the incident requires it.

DVSA staff can withdraw consent at any time by emailing reportanincident@dvsa.gov.uk with their name and the date of the incident. This may take up to 3 working days.

3. Why we need it

We need the personal data to:

• investigate the incident
• take the appropriate action
• notify the Health and Safety Executive (where relevant)
• provide the Health and Safety Committee with incident reports

4. What we do with it

We collect, use, and store the data for the reasons set out in this policy.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We may share your details with:

• the Health and Safety Executive where you’re involved in an incident which meets the criteria for reporting to them – we have a duty to do this under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)
• Occupational Health Referrals team in HR so they can add details of any injuries at work to your employee record
• solicitors in response to a civil or injury claim
• the relevant Traffic Commissioner should they be responsible for assessing the incident or if a licensed vehicle operator is involved in the incident

We will share your data if required to do so by law – for example, by court order, or to prevent fraud or other crime.

5. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We’ll hold your personal data for 4 years from the date of the incident. For staff, HR will hold your personal data until you reach the age of 100.

6. Where it might go

Our IT infrastructure and technology has been checked to make sure it’s safe and secure.

7. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data. Data is stored on servers located in the UK.

8. Automated decision making and profiling

Your data is not subject to automated decision making or profiling as defined in data protection legislation.

9. Changes to this notice

We may change this privacy notice at our discretion at any time.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date.

We encourage you to periodically review this privacy notice to be informed about how your data is protected.

10. How to contact us

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the DVSA data protection manager

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.