Well, with all credit due to DVLA, they have responded and pretty much answered my question. They have stated that the third party was in fact Experian, and use them for the purpose of verifying a drivers current address when a 10 year photo renewal is required. I realise that over 800 people have viewed this post, potentially looking for the answers to the same, or similar questions. I have included DVLA's response and realise that there may be other issues raised by the information included in it.
Driver and Vehicle Licensing Agency
1 December 2009
Dear Sir or Madam,
Thank you for your request, this type of question falls outside of The
Freedom of Information Act 2000, and we are responding under routine
business as usual.
Experian was chosen as the Commercial Partner by DVLA following a
vendor selection prior to the introduction of ten year renewal of
photographs on driving licences from July 2008. The first reminders were
sent out in May 2008.
Experian confirm whether the address on the driver record is accurate
and up to date. Where a new address is identified, non personalised
reminders are sent to the address on the record and to the new address.
The driver's record will not, however, be updated without the driver's
consent. Whilst it is the responsibility of the driving licence holder
to update DVLA with change of details, this can sometimes be overlooked
until prompted to do so, leading in some cases, to out of date driver
records. The accuracy of the driver's database is very important to the
Agency and to individual drivers. By using a Commercial Partner DVLA can
ensure that when sending ten year renewal reminders, the information is
being sent to the right driver.
In order to explain how DVLA release data it maybe helpful if I first
provide you with background about our processes and obligations under
the Data Protection Act 1998.
DVLA has the statutory function of registering and licensing drivers
and motor vehicles. To carry out this function we maintain two
distinctly separate databases for driver and vehicle data. The driver
database holds information on driver entitlement, including endorsements
and medical information. The vehicle database contains specifics of the
motor vehicle plus the name and address of the registered keepers.
In relation to the driver register, data can be shared with
organisations for purposes directly related to why we hold the data
(i.e. road traffic enforcement and sentencing and driver testing). Other
than this, information held on the database is only released to the data
subject themselves or to a third party (i.e. employer, car hire firm
etc.) with the data subjects consent.
Information held on DVLA’s vehicle register is subject to the
provisions of the Data Protection Act (DPA), and also permits the
release of personal data where the law allows. Provisions contained
within the Road Vehicles (Registration and Licensing) Regulations 2002
provide for the release of information from the vehicle register in a
number of circumstances, including to the Police, Customs Officers and
Local Authorities. The Regulations also allow disclosure to those who
can demonstrate ‘reasonable cause’ for requesting that information.
Whilst the law does not define ‘reasonable cause’, DVLA has taken
the view that disclosure should relate to the vehicle and it’s use, or
the collection of taxation. It is recognised that motorists have an
obligation to comply with road traffic and other regulations when using
a vehicle and to act responsibly and with consideration for other road
users, pedestrians and landowners in doing so.
Some circumstances that have been judged to meet ‘reasonable cause’
include safety recalls by manufacturers, minor hit and run incidents not
warranting a full police investigation, housing associations dealing
with abandoned vehicles and insurance companies dealing with accidents
and investigating fraud. Requests from private car park enforcement
companies also meet the reasonable cause criteria. Landowners would
have great difficulty in enforcing their rights if motorists were able
to park with impunity on private property. This does not infringe the
Data Protection Act and the Information Commissioner is aware that
personal data on the vehicle register can be used in this way. Guidance
on what constitutes ‘reasonable cause’ is published on the Directgov
Freedom of Information