NO2ID

Was very tempted to post this under the Passport section as the questions being asked were identical with the exception that they related to the Passport office. Some credit agreements record your DVLA drivers number at point of sale, is this just to record the number off the identity used at the point of sale or do DVLA have any relationship/agreement with credit reference agencies where information may be shared in relation to current addresses, name changes etc. The same question was asked about the Passport office and it was stated that they DO have a relationship with Equifax/experian but that checks with them were made only on first applications and not renewals (inc name changes). I am aware that there has been a lot of publicity about the selling of data (namely adresses from car registrations) but is information exchanged in relation to your actual driver number, is this information available to the private sector?

OK, there seems to a lot of 'interest' in the question that I have posed in relation to DVLA and it's relationship with equifax/experian etc. I assume that no one here has the answer to this question although some would like to have. It stands a chance that I may aquire a definative answer to this question in the near future, and I will document it here as and when I have it. However, since I posed this question something else of relevance has 'appeared'. I have just had a request for my drivers licence photo to be renewed (after 10 years) and after coming to terms with the 20 quid that they want and reading the paperwork that came with it, the last sentence went like this:

"In preparing this letter, DVLA has checked the last address you gave us with records held by a commercial partner."

As you may appreciate, many questions can be generated by this statement.

I am very tempted to submit an additional request with my renewal asking them to clarify who this 'commercial partner' is (no prizes btw) and why exactly it was necessary just for a bloody photo update?

Thoughts, anyone?

Yes, it would be worthwhile to write to them and ask. There is a very good portal for sending Freedom of Information requests at http://www.whatdotheyknow.com

Thanks for the advice Geraint. I have sent the following request to DVLA:

sirmyser

18 November 2009
Dear Sir or Madam,

DVLA recently informed me by letter that I needed to update my
driver's photo (after 10 yr s), which I subsequently did. However,
The following statement was made at the bottom of my notification
letter:

"In preparing this letter, DVLA has checked the last address you
gave us with records held by a commercial partner."

As there has been a significant amount of concern recently about
recent 'releases' of information in relation to the DVLA database I
would be grateful clarify the situation for me:

* Who was the 'commercial partner' and why the 'clarification'?

* I know information is released to third parties in relation to
illegally parked vehicles etc, but is information released to third
parties in instances where an actual vehicle is not the subject of
the enquiry? i.e. for the purpose of mailing lists, address
changes, credit and debt collection enquiries?

Or is that the only you will only release information if it's a
related to an actual vehicle, or an employer confirming entitlement
to drive with the subjects permission?

I would be very greatful if you could clarify the above for me, and
the criterion for which you release DVLA database information, to
whom and for what reason.

Obviously I accept that the police etc have access to relation to
such information regardless in criminal matters.

Yours faithfully,

Sirmyser


** Will update as soon I as I get a response

Myser

Well, with all credit due to DVLA, they have responded and pretty much answered my question. They have stated that the third party was in fact Experian, and use them for the purpose of verifying a drivers current address when a 10 year photo renewal is required. I realise that over 800 people have viewed this post, potentially looking for the answers to the same, or similar questions. I have included DVLA's response and realise that there may be other issues raised by the information included in it.

Driver and Vehicle Licensing Agency

1 December 2009
Dear Sir or Madam,

Thank you for your request, this type of question falls outside of The
Freedom of Information Act 2000, and we are responding under routine
business as usual.

Experian was chosen as the Commercial Partner by DVLA following a
vendor selection prior to the introduction of ten year renewal of
photographs on driving licences from July 2008. The first reminders were
sent out in May 2008.

Experian confirm whether the address on the driver record is accurate
and up to date. Where a new address is identified, non personalised
reminders are sent to the address on the record and to the new address.
The driver's record will not, however, be updated without the driver's
consent. Whilst it is the responsibility of the driving licence holder
to update DVLA with change of details, this can sometimes be overlooked
until prompted to do so, leading in some cases, to out of date driver
records. The accuracy of the driver's database is very important to the
Agency and to individual drivers. By using a Commercial Partner DVLA can
ensure that when sending ten year renewal reminders, the information is
being sent to the right driver.

In order to explain how DVLA release data it maybe helpful if I first
provide you with background about our processes and obligations under
the Data Protection Act 1998.

DVLA has the statutory function of registering and licensing drivers
and motor vehicles. To carry out this function we maintain two
distinctly separate databases for driver and vehicle data. The driver
database holds information on driver entitlement, including endorsements
and medical information. The vehicle database contains specifics of the
motor vehicle plus the name and address of the registered keepers.

In relation to the driver register, data can be shared with
organisations for purposes directly related to why we hold the data
(i.e. road traffic enforcement and sentencing and driver testing). Other
than this, information held on the database is only released to the data
subject themselves or to a third party (i.e. employer, car hire firm
etc.) with the data subjects consent.

Information held on DVLA’s vehicle register is subject to the
provisions of the Data Protection Act (DPA), and also permits the
release of personal data where the law allows. Provisions contained
within the Road Vehicles (Registration and Licensing) Regulations 2002
provide for the release of information from the vehicle register in a
number of circumstances, including to the Police, Customs Officers and
Local Authorities. The Regulations also allow disclosure to those who
can demonstrate ‘reasonable cause’ for requesting that information.

Whilst the law does not define ‘reasonable cause’, DVLA has taken
the view that disclosure should relate to the vehicle and it’s use, or
the collection of taxation. It is recognised that motorists have an
obligation to comply with road traffic and other regulations when using
a vehicle and to act responsibly and with consideration for other road
users, pedestrians and landowners in doing so.

Some circumstances that have been judged to meet ‘reasonable cause’
include safety recalls by manufacturers, minor hit and run incidents not
warranting a full police investigation, housing associations dealing
with abandoned vehicles and insurance companies dealing with accidents
and investigating fraud. Requests from private car park enforcement
companies also meet the reasonable cause criteria. Landowners would
have great difficulty in enforcing their rights if motorists were able
to park with impunity on private property. This does not infringe the
Data Protection Act and the Information Commissioner is aware that
personal data on the vehicle register can be used in this way. Guidance
on what constitutes ‘reasonable cause’ is published on the Directgov
web-site.
www.direct.gov.uk/en/Motoring/OwningAVeh...

Yours faithfully,

Freedom of Information
DVLA

This is interesting. Apparently, those obnoxious organisations known as credit reference agencies hold your address history for only six years. If your photo licence comes up for renewal every 10 years there's a good chance that Experian will not be able to match the DVLA records with theirs. Yes, they could try a match on full name and DoB (both organisations hold this information) but an address match could be troublesome. I didn't know DVLA had stooped this low - I know they plumb the depths of iniquity when it comes to handling data concerning your vehicle, but now they're up to it with your driving record as well.

Another point - when you register a vehicle you have the opportunity to enter your DoB on the registration document. It's not compulsory to do so - SO DON'T DO IT. It would enable DVLA to link vehicles to specific drivers very easily.

Perhaps I'm missing something here but surely DVLA is saying that they only release information from the DRIVER register to the testing authority, courts or police in relation to issues relating to the driving licence. They can release the data if you give permission but if they do it without your permission they are breaking the Data Protection Act.

The bit I find reprehensible is that you are committing a criminal offence if you do not change your address - even if you are not using your licence.

That's not true. There are numerous other circumstances where driver information can be passed to other official bodies. And numerous exceptions to the Data Protection Act when data is used for official purposes.

The most important explicit power to do this for NO2ID's purposes, is that the information can be demanded by the IPS (standing in the shoes of the minister) under s9 of the Identity Cards Act 2006 "for the purposes of validating the register". In combination with s2(4) of the same Act, the driver records could be used to populate the Register with past address data, signatures, etc for people who had not applied for an ID card.

There is a tribunal case where a council obtained the address connected with a vehicle owned by a serving soldier who used her mother's address for convenience and not illegally. The council presented this address to a council tax tribunal in support of its arguments that the mother should not get a 25% discount as the serving soldier lived with her. They has suspected this woman of fraud, it appears on the grounds that she said she was living alone but had put her soldier daughter on the register, again legally.

So the woman did two legal things and ended up suspected of fraud and being investigated by council staff whose hostility and distrust is evident from the transcripts of phone calls that was eventually presented to the tribunal. It seems obvious that having decided the woman was a liar they were just horrible to her and wrote down nasty things about her.

The tribunal decided that the counciil had been 'peverse' and made them record that the woman did in fact live alone and that the soldier did when not abroad on active service live in barracks.

The council claimed that an 'external agency' had told it that the woman did not live alone. It is said this was a credit reference agency. It is a complete myth that these agencies can decide who lives where for council tax purposes. You would think that council staff would know that, and indeed if they bothered to read the product information they are given by Experian they should know this.

Source Valuation in Practice Issue 16 on Valuation Tribunal Website.

I hope this woman sues the council and reports them to the ICO and the LGO.

On the outrage caused by Experian and council misuse of data see

whatdotheyknow.com and search for Preston Council.

Experian and councils involved with this nightmare have disagreed with opinions by the Information Commissioner that the exercise should stop because of the upset caused to people innocent but told they are suspected of fraud and required to eliminate themselves from a fraud investigation they are in on statistical grounds not evidential ones.

Any council which says you have a legal duty to report changes in circumstances which do not affect the discount is either incompetent or lying, or both. And a lot of them do. At least one tells people you can be prosecuted if you are on a 25% discount and you do not inform the council if your oldest child turns 18. This is total nonsense. Unless that child counts for council tax purposes he or she does not affect the discount and there is no need to inform the council. It seems that councils are motivated to mislead people by a desire to get information for the Audit Commission even though the Audit Commission has accepted that it is reasonable for them not to get it. But the Audit Commission still carries out data so=called 'matching' on incomplete and out of date data, whatever it says in its statutory code of data matching.

In effect, the Audit Commission appears to ignore the law it wrote itself and to be now saying, sorry we didn't write it properly, wait a minute until we see if we can get it changed.

If you get a letter from your council saying we have reason to beliee there are other adults at your address, do not phone them up as you may well get hassled and misinformed in an attempt to trick you into sounding guilty and boosting their fraud figures. Just assert in writing your entitlement to a discount under section 11(1) and complain about your human rights. Then complain to the NFI and the ICO.

I am concerned with the legality surrounding the credit agencies right to hold data in the first place. Was a private company not prosecuted a few years back for holding data relating to employees in the building trade and their abilities? That was deemed as unfair to impact an employees chance of finding work due to his records being kept and shared by other companies so what is different about that and credit reference agencies blacklisting people for credit due to their history?

This is from the DPA (summary)

2. Right to prevent processing which causes substantial damage or distress (section 10 of the Act).

There is a right to require processing either to cease, or not to start, if it would cause the data subject, or anyone else, substantial unwarranted damage or distress. A data subject can issue a ‘Data Subject Notice’ to a data controller to prevent processing which he thinks is causing or likely to cause unwarranted damage or distress to the data subject or to another person, unless the data controller has met one of the first four conditions for processing stated in Schedule 2 of the Act (conditions for processing personal data). The data controller must respond within 21 days of receiving the notice, either complying or stating reasons why he is not complying. The data subject can apply to court, which may support the notice and order the data controller to comply.

Well my credit record caused me distress and damage recently when I was turned down for a bank account application with HSBC. Shall I make this thread interesting by writing to a few credit reference agencies to ask that they remove my details from their system?

Chris

They hold your name and address information for ever. Period. And everybody elses. How useful do you think that makes them to the government?
Dying won't get you off the databases. Changing your name won't. You cannot lead a normal life in this country and not end up with Experian and Equifax and the rest knowing all about you.

You are wrong Raj.