reducing forecourt crime Tackling drive-offs and No means of payment

2. Preface

2.1 This Code was produced by BOSS and approved by the DVLA to record the basis on which DVLA would supply vehicle keeper information to BOSS.

2.2 The Code is designed to protect people from misuse of their information and to provide clear and robust complaint procedures where misuse is alleged, while allowing those who do have reasonable cause to get the data they need. In this Code, ‘keeper data’ means information about the keeper of a vehicle registered with DVLA, Swansea.

2.3 The purpose of the Code is to set guidelines on the use of information provided by the DVLA under Regulations for the purpose. It is intended to address concerns about the release of information for this purpose and to increase public confidence in the arrangements.

2.4 BOSS (British Oil Security Syndicate) is an independent trade “not for profit” organisation and forecourt crime campaigner dedicated to reducing criminal activity on fuel service stations and co-ordinating civil action in respect of non-payment for transactions by motorists. BOSS membership is available to any UK fuel retailer on a membership fee basis and currently represents almost 30% of UK fuel retailers. It also uses contracted agents to manage its data and recover unpaid sums.

2.5 BOSS is registered with Companies House (Registration No. 5424055)

BOSS contact details:

Registered Office: Highdown House, 11 Highdown Road, Leamington Spa CV31 1XT

Head Office: PO Box 2010 Kenilworth CV8 9WS

Tel: 01926 864757

Email: [email protected]

Website: www.bossuk.org

3. BOSS Responsibilities

3.1 Publish on its website, a clear, enforceable Code of Practice governing its conduct and business practices, and those of its contracted agents.

3.2 Demonstrate monitoring arrangements for ensuring contracted agents and members comply with the Code.

3.3 Advise DVLA of any complaints received which relate to the misuse of data supplied by DVLA and maintain records of all related complaints to which they have agreed or for the service of notices and court papers) until a Court judgment has been secured.

3.4 Initiate disciplinary procedures against any contracted agent who fails to comply with the Code following written warnings.

3.5 Notify DVLA within 24 hours, by fax, mail or email, of the suspension or expulsion of a contracted agent or member for failure to comply with the Code.

3.6 Investigate at DVLA’s request any complaints about alleged breach of the Code or inappropriate use of information and provide detailed reports on the outcome.

3.7 Provide a named liaison contact for DVLA

3.8 Co-operate with DVLA and the Information Commissioner’s Office to resolve any issues which may arise in connection with the use of data received from the DVLA.

3.9 Treat vehicle keeper’s personal information as private and confidential, and run secure and reliable systems with appropriate audit trails to track access to keeper data.

3.10 Company titles, documentation and notices issued in respect of non-payment of transactions will not imply that action is being taken on behalf of a public body, without that body’s explicit consent (e.g. police). Company names must comply with the Business Names Act 1985.

3.11 Have written contracts in place with members of the BOSS Scheme who authorise BOSS to obtain keeper data from the DVLA.

3.12 Vehicle keepers must be contacted by letter and should not be approached in their homes in respect of the enforcement of claims (other than in accordance with arrangements to which they have agreed or for the service of notices and court papers) until a Court judgment has been secured.

3.13 Enquiries must include details of the incident giving rise to the claim – date, time and full details of the vehicle used in the incident.

3.14 All requests for the keeper information are made in accordance with agreements between BOSS, including its contracted agents, and DVLA.

3.15 Before contacting vehicle Keepers, checks should be made to ensure that the make and model included in the released vehicle details matched those of the targeted vehicle.

3.16 Any vehicle or personal information supplied by the DVLA that does not correspond with the targeted vehicle or has been requested in error should be destroyed and a log kept for audit purposes.

4. Participating Fuel Stations – Responsibilities

Participating fuel station retailers must be BOSS members. They will not directly contact DVLA under this scheme but will:

4.1 Act fairly, reasonably and responsibly in all dealings with motorists.

4.2 Correct mistakes, handle complaints quickly and sympathetically and tell motorists how to take their complaints forward if they are still not satisfied.

4.3 Co-operate with DVLA and the Information Commissioner’s Office to resolve any issues which may arise in connection with the use of data received from the DVLA.

4.4 Follow any guidance notes that BOSS issues, where relevant to the products and services that the fuel station offers.

4.5 Treat vehicle keepers’ personal information as private and confidential, and run secure and reliable systems with appropriate audit trails to track access to keeper data that comply with the General Data Protection Regulations.

4.6 Train staff to make sure that the procedures they follow reflect the commitments set out in this Code, including compliance with the General Data Protection Regulations.

4.7 Display signs on participating service stations where action for the failure to make payment before leaving the site is to be taken. These should satisfy the criteria that it is ‘reasonable’ for a motorist to be aware of the potential consequences of his/her actions when refuelling the vehicle. It should be clear that action will be taken in respect of any incident where a motorist fails to make payment before leaving the premises and where this is deliberate it will be regarded as a criminal act.

4.8 Have readily available customer information detailing what to do if they have no means to make payment or have driven off without paying. Customers should be made aware that vehicle keeper details may be requested from DVLA.

5. Code of Practice – Compliance

5.1 BOSS and its contracted agents wishing to submit to this Code to receive access to DVLA keeper data will need to ensure that they adhere to its terms. They must ensure that the following arrangements are in place:

5.1.1 Be registered with the Information Commissioner’s Office, a copy of which Registration will be made available on request and must be maintained in order to comply with the General Data Protection Regulations.

5.1.2 Vehicle keepers being contacted, to ascertain who was driving the vehicle at the time of the incident, must be given (if the contact is in writing) or offered (if the contact is by telephone) guidance notes explaining why the details were requested and the procedure by which they can register a complaint with BOSS, the Information Commissioner and DVLA if they believe their date has been used inappropriately.

5.1.3 Written Communications from DVLA or BOSS investigating complaints from keepers must be acknowledged within 5 working days of receipt and responded to within 10 working days.

5.1.4 Where an investigation reveals a genuine error on the part of the member who reported the incident, BOSS or its contracted agents, an apology should be issued to the keeper within 5 working days of completion of the investigation.

6. Terms of Supply

6.1 Information will be disclosed on condition that it relates to, and will be used only in connection with, an enquiry relating to the identification of a vehicle keeper who has failed to make payment for the transactions in question.

6.2 DVLA will use reasonable care and skill in the compilation of records, and that the information is delivered in a timely manner. As data held on DVLA’s records is supplied in circumstances which, in the vast majority of cases are completely outside its control. DVLA does not warrant the accuracy of the records provided. The DVLA does not accept liability for any inaccurate information supplied to it by the vehicle keeper or any other source beyond its control.

NO OTHER USE IS PERMITTED

6.3 The principles of the General Data Protection Regulations 2018 must always be adhered to when such information is disclosed.

6.4 Nothing in this Code shall be construed as being in any way binding by way of a contract or otherwise to supply all or any data to the enquirer. Nonetheless, DVLA will not normally withhold data unless the enquirer fails to comply with the terms of the General Data Protection Regulations.

6.5 The information provided is the property of DVLA and must not be duplicated (except as necessary for BOSS or its contracted agent to act) or held for longer than is necessary.

7. Duration of the Code of Practice

7.1 This Code shall commence upon signature hereto and will continue in force and have effect until such time as the DVLA shall deem appropriate or when this agreement for the supply of data is terminated.

8. Use of Data

8.1 The enquirer or its contracted agents must not disclose any data to a third party other than in respect of the recovery of funds for unpaid transactions or institution of legal proceedings. However, if the enquirer intends to use a third party to process data on their behalf, these Terms will also apply to the third party and the data may only be used for the aforementioned purpose. The enquirer will be held liable for the breach of these Terms by the third party. DVLA will not be held responsible for any problem arising between the enquirer and any such third party.

8.2 Copyright of the data is vested solely in the Crown.

8.3 This Code of Practice should also be read in conjunction with the BOSS Privacy Policy available on its website

9. Security of the Data

9.1 The DVLA shall be permitted access to the enquirer’s operations area to check the methods of processing. The enquirer must agree to make available to the DVLA’s authorised personnel such files and records as may be required for them to be satisfied that the data is being used in the manner agreed and to ensure security of storage and access so as to comply with the requirements of the General Data Protection Regulations 2018.

9.2 The DVLA may carry out audits of the enquirer’s internal control systems – so far as they relate to DVLA enquiries – to ensure that they comply with best practice.

9.3 DVLA is registered under the General Data Protection Regulations 2018. Any misuse of the data or abuse of these conditions by BOSS or its contracted agents will result in withdrawal of the supply of information under the agreed terms.

9.4 It is an offence to unlawfully obtain personal data, contrary to the General Data Protection Regulations 2018. Fines up to 4% of Global turnover exist as penalties in respect of these offences. All instances of suspected abuse that come to DVLA’s attention will be referred to the Information Commissioner for further investigation.

REF: V2 042018