Tips for GDPR-compliant driving licence checks

Björn Holeschak, Leiter Datenschutz EIKONA Systems GmbH
Hand which car key holds what should stand for DSGVO compliant driver's license control

In many companies it is common practice to provide employees with company cars and pool vehicles, for example to enable them to visit customers. In this case, the employer remains the owner of the vehicles and has corresponding control obligations. Since the driving licence contains personal data, data protection also plays an important role here.

Why do controls need to be carried out?

Before providing a vehicle, the employer as vehicle owner must ensure that the employee has the necessary driving licence. This check must take place regularly. It results from § 21 para. 1 no. 2 StVG, according to which criminal consequences can threaten if the vehicle owner allows someone to drive the vehicle without a driving licence. In addition, in such a case, the insurance company will refuse to pay benefits or will take recourse against the employer if an accident is caused by the driver.

How often do controls have to be carried out?

In order for the employer to fulfil his duty as a keeper, regular checks are necessary. Fortunately, this does not mean that checks must be carried out daily. Rather, it is sufficient to carry out these checks twice a year. In the case of new employees, the existence of a driving licence should in any case be checked before the vehicle is handed over for the first time.

What exactly should be controlled?

This is where data protection comes into the game. After all, driving licence data is also personal data, which may be processed under the principle of data minimisation. Therefore, one should keep a close eye on the purpose of the check. §21 (1) sentence 2 StVG imposes an obligation on the employer to check whether the employee has a valid driving licence. For this purpose, it is sufficient to show the original driving licence. The employer thus knows that a valid driving licence is present. It is therefore not necessary to make a copy of the driving licence, note the driving licence number or process further personal data. The "whether" was checked by showing it. The employer then documents that the employee presented a valid driving licence on date X and signs the document.
In certain cases, it may also make sense to check the driving licence classes. This is relevant for driving lorries, for example. In such a case, it should also be documented that the necessary driving licence class is available.

What are the possibilities for regular control?

Controls can be carried out in various ways. A distinction is made between manual and electronic checks.

Manual control: As already mentioned, manual checks involve showing the driving licence to the employer or the fleet management. There, it is noted with a date that the employee has shown his or her valid driving licence. This process works, but it involves a lot of effort.

Electronic check: The situation is different and, above all, more varied with electronic checks. Here, checks can be carried out using the employee's own smartphone or by means of an NFC chip.
To use the smartphone, the driver only needs a camera and an internet connection. He is then instructed by his browser or an app to scan his driving licence through the camera. How the driving licence is further processed depends on the provider. For example, the app uses an algorithm to check the authenticity of the driving licence, while the browser can send the driving licence to the software behind it. The vehicle owner then checks the validity on his own computer. The advantage of this method is that the driver can be reminded of the check via the smartphone. The alternative is to attach an NFC or RFID tag directly to the driving licence. This tag is issued individually for each driver and is tamper-proof, as it becomes unusable if removed from the driving licence. Control is similar to contactless payment in that the driving licence is presented to a terminal, which can be located at the employer's premises, in the vehicle or decentralised throughout the country. Checking through an app is also possible again.

Both methods sufficiently document the checks so that the employer can prove in case of doubt that it has properly fulfilled its driver liability under § 21 StVG.

What happens if someone loses their driving licence?

If an employee loses his or her driving licence, logically no more checks can be carried out. In this case, the vehicle owner should protect himself contractually by obliging the employees to immediately report the loss of the driving licence to the employer. This obligation to notify and the entire driving licence control naturally only concern those employees who also use a company vehicle.

Björn Holeschak
Björn Holeschak
Team Lead, Data Protection

Drawing on his profound data protection expertise, he tackles data protection challenges with renewed vigor every single day. He understands the dangers and stumbling blocks in intimate detail and gives customers practical advice.

Add a comment

Please add 2 and 4.