Contents
On what basis the check is carried out
The employer carries out the check because, as keeper, it must not allow anyone to drive without a driving licence. Processing the data needed for this is therefore necessary. The legal bases most often cited are performance of the employment relationship (Art. 6(1)(b) GDPR) and legal obligations. Which basis applies in an individual case should be determined by your data protection officer.
Because codes in the driving licence can point to health restrictions, for example 01 for corrective lenses, the stricter rules for special categories of data apply to these details (Art. 9 GDPR).
What you should record
- The driver’s name and the date of the check
- The result and who carried out the check
- The categories checked and their expiry dates
- If needed, the driving licence number, to recognise the same document later
A photocopy of the driving licence contains more than the proof needs. Data protection authorities therefore generally regard a permanent copy as impermissible. A live recording that is used only for the check and then deleted is different from a copy in the personnel file.
How long to store it
There is no fixed deadline. The records should be kept for as long as you need to be able to prove the check. Photos, by contrast, should be deleted as early as possible, ideally straight after the decision. Set the periods out in a deletion policy.
Electronic check with a service provider
If you use software on the internet, the provider processes the data on your behalf. This requires a data processing agreement, which includes technical and organisational measures such as encryption, access rights, logging and deletion periods. Also pay attention to where the servers are located.
If your company has a works council, raise the introduction early on. Software that records data about employees may be subject to co-determination.
How FleetCred implements this
- Photos are stored encrypted and deleted after the period you set, if you wish straight after the decision.
- The record contains only the details needed as proof and is sealed.
- The data processing agreement is part of every contract and can be viewed here.
- Drivers are informed before the photo and, via their link, see only their own documents.
- Access by role, every login is logged, with a second factor if you wish.
More on technology and hosting under Security and data protection.
This article gives an overview and is not a substitute for legal advice. For your individual case, please ask your legal department, a specialist lawyer or your trade association.