ProFleet2 & Privacy
The ProFleet2 service is provided to ALD Automotive by Airmax Remote. The standard data held on Airmax's hosted service consists of mileage and journey logs transmitted by the telematics unit in the car. This information is anonymous. Upon registration by the driver the service will hold personal data submitted by the driver, such as the driver's name, address and contact details.
Additional vehicle data such as speed, acceleration and braking is only available where the driver's employer has opted for an upgrade to the ProFleet2 service as part of their commitment to complying with health and safety legislation. Should your employer opt for an upgrade with these additional services you would be notified in advance but such data would still only be available to an employer where a driver's consent had been granted.
Access to data held on Airmax's hosted service is initially restricted to the driver only and access to this data is controlled by the driver of the vehicle exclusively. Therefore, if the driver does not grant access to anyone, the information cannot be viewed by anyone else. Likewise, if the driver does not activate / register his or her account, no-one has access to the journey data and neither ALD nor Airmax can use the data for any purpose. Note that this is subject to the exceptions listed in this policy, e.g. disclosures to police.
Having received the registration number, mileage, date of registration and the driver's contact details, ALD will contact the driver to book the driver's vehicle in for servicing. ALD encourages drivers to fill in the online registration form with their personal details, even though they might not activate their account. This will allow ALD to contact the drivers directly for the purpose of booking a service or in the event of a manufacturer's recall notice. The driver can log on to the system at any time to check or amend his or her personal details.
ALD has no facility to allow employers to have access to drivers' records and journeys without the consent of the driver. If the employer requires a view of drivers' records and journeys they must seek each driver's consent which can be provided via the ProFleet2 web interface.
This information would assist employers in meeting their health and safety obligations e.g. ensuring that their company vehicles are road-worthy and that drivers are not driving for excessive periods of time without a break.
ALD Automotive and Airmax Remote can be contacted at the following addresses:
Bristol BS16 3JA
Airmax Group Ltd
31, Black Moor Rd
Ebblake Industrial Estate
Dorset BS16 7LB
ProFleet2 is installed into company vehicles supplied by ALD Automotive as part of a joint commitment being made by our respective businesses into managing key health and safety issues. We have explained these responsibilities in more detail below but should you have any query regarding any point please do not hesitate to contact your main fleet contact.
Under the Health & Safety at Work Act 1974 employers need to "ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees".
This is achieved through "the provision and maintenance of plant and systems of work that are, so far as is reasonably practicable, safe and without risks to health" and "the provision and maintenance of a working environment for employees that is, so far as is reasonably practicable, safe, without risks to health, and adequate as regards facilities and arrangements for their welfare at work".
To comply with the Workplace (Health, Safety and Welfare) Regulations 1992 a vehicle used for work purposes - whether it is a supplied by the company or is owned by an employee and used for regular or occasional work journeys - constitutes a 'workplace' while used for work purposes and must provide the driver with a safe place of work.
To the extent that the journey data recorded by the ProFleet2 device constitutes a driver's personal data, it is subject to the provisions of the Data Protection Act 1998. This data is only available to the driver using a username and password, and is not available to the driver's employer, unless the driver authorises the disclosure of this information. Where a driver’s terms and conditions of employment are such that vehicles are provided for business use only, consent may not be required from the driver as part of those terms and journey data may be provided directly to your employer.
The Health and Safety Executive (HSE) states that "health and safety law applies to on-the-road work activities as to all work activities, and the risk should be effectively managed within a health and safety management system" and recommends that employers need to comply with duty of care by implementing policies with procedures to ensure occupational drivers are not exposed to unnecessary risk e.g. through a documented occupational driving policy with evidence that it is being performed.
The Department for Transport also commissioned a report into occupational driving and recommended that "companies and stakeholders should consider aspects of safety culture when addressing work-related road safety issues, in particular, training, procedures, planning, incident management/feedback, management/supervision and safety communications".
Enforcement action can be taken against employers who fail to comply with their duty of care, or who fail to monitor driver behaviour. In serious cases, corporate manslaughter cannot be excluded, particularly as new laws on corporate manslaughter will improve prosecution success rates.
In order to achieve compliance, it is necessary for employers to demonstrate not only that they have implemented a policy, but also that they monitor the performance of work related road safety at regular and frequent intervals e.g. recording whether drivers are driving for more than 2.5 hours without a break, driving more than 6 hours in any day, driving at times where fatigue-related accidents are more common or driving more than 3000 miles per month, etc.
If an employer fails to implement a system of monitoring and acting in respect of "at risk" drivers, they are likely to suffer enforcement action by the Health and Safety Executive where police identify serious management failures have been a significant contributory factor following a road traffic accident" (extract taken from HSE Guidance on Work Related Safety).
Driver Consent & Data Protection
ProFleet2 uses the personal data of the driver such as name, email address, home address and employee ID number. ProFleet2 transmits the car's mileage and journey logs.
Unless a vehicle is provided for business use only, where an employer wishes to have access to the journey data of their employees, driver consent is required *. The employer must inform the driver of the uses which will be made of the data and by whom e.g. to help it comply with its health and safety obligations, monitoring of business journeys, adherence to road traffic law speed limits, etc. If ProFleet2 data was to be made available in a disciplinary investigation this would have to be made known to the driver at the point of obtaining consent.
However, irrespective of whether a driver has provided his/her consent, ProFleet2 data may be disclosed:
- to the police or other body as required by law;
- to insurers in respect of accidents or damage;
- to the employer, debt recovery and vehicle tracing agents to recover the vehicle;
- for use in an anonymised form for data analytics;
- to VOSA along with ALL vehicle data in respect of road traffic accidents in which a fatality occurs;
- in connection with any legal proceedings (including prospective legal proceedings);
- for the purpose of obtaining legal advice; or
- as otherwise necessary for establishing, exercising or defending legal rights.
The employer will commit an offence under data protection legislation if information is not used and stored in accordance with the Data Protection Act 1998. The extent of the penalty depends on the breach and may include fines and the destruction of data can also be ordered. Directors may be liable and "punished accordingly" for their consent, connivance or neglect in breaching the provisions of the Data Protection Act 1998.