Guidance

Operator compliance risk score (OCRS): privacy notice

Updated 1 May 2024

1. About this activity

The Driver and Vehicle Standards Agency (DVSA) uses an operator compliance risk score (OCRS) system to decide which vehicles to inspect.

DVSA is an executive agency of the Department for Transport (DfT).

We calculate the risk of an operator not following the rules on roadworthiness (the condition of its vehicles) and traffic, for example drivers’ hours or weighing checks, to decide which vehicles to inspect.

The OCRS risk scores are:

• green - low risk operator
• amber - medium risk operator
• red - high risk operator
• grey - unknown operator
• blue - earned recognition operator

The data controller for DVSA is DfT - a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992.

2. What data we need

The personal data we collect from you will include:

• name

• vehicle registration mark

• driver and operator prosecutions

• operator name

• operator number

• encounters

• prohibitions

The personal data we collect from suspected and convicted offenders will include:

• name

• vehicle details

• details of actual operator and driver prosecutions

We use data from the following sources to help us work out your OCRS score:

• mobile compliance

• vehicle testing services

• Vehicle Operator Licence

• Prosecution Legal Services

You can check your OCRS score, test history and roadside check reports online. You can see the following data in these reports:

• operator name associated with the licence number

• type of OCRS score - indicates if the summary line or event relates to the roadworthiness OCRS score category, the traffic OCRS score category or the combined score category

• number of OCRS events - the total number of events recorded in OCRS for the calculation period, by score type

• total event points - the total number of OCRS points allocated for offences or defects over the calculation period, by score type

• total prosecution points - the total number of extra OCRS points allocated for operator and driver prosecution cases

• event points plus prosecution points - the final OCRS points total (defect/offence and prosecution points) over the calculation period, by score type

• calculated base score - the OCRS base score, calculated by dividing the final OCRS points total by the number of OCRS events for each score type

• calculated OCRS band - the base OCRS band, calculated by comparing the base score to the amber and red threshold bands for each score type

• final OCRS band - indicates the final OCRS band, by score type, taking the combined score into account

• number of operator cases - the number of successful prosecution cases relating to an operator during the calculation period

• number of driver cases - the number of successful prosecution cases relating to a driver during the calculation period

• points per operator case - the number of extra OCRS points allocated for each operator prosecution case

• points per driver case - the number of extra OCRS points allocated for each driver prosecution case

• amber threshold value - the amber threshold band at the time that the score was calculated, by score type

• red threshold value - the red threshold band at the time that the score was calculated, by score type

• source of data - the type of event that occurred (for example, a roadside enforcement or traffic check, a test or a prosecution)

• date of event - the date that the event in question took place

• location - the location that the event took place or the location of the court (for prosecutions)

• vehicle registration mark for the vehicle involved in the event

• name of the driver who was driving at the time of the event (where recorded)

• defect or offence ID - the defect or offence number relating to a defect or offence that was found during the event

• defect description - a description of the defect or offence that was found

• prohibition category or offence band - the severity band of the defect or offence that was found (defect category 1-4 or 1S-4S for S mark defects, offence band 0-5 or driver or operator prosecution offence)

• OCRS points value - the points allocated to that defect or offence band within OCRS

• weighting value to be applied - the time weighting to be applied to those points based on the elapsed time since the defect or offence occurred

• weighted points - the final OCRS points to be applied (the OCRS points multiplied by the weighting value)

• type of events - this indicates if the event was positive (no defects/offences were recorded) or negative (offences/defects were recorded)

• score date - this shows the date that the OCRS score was calculated (this will be the day before the score becomes active)

• roadworthiness band - this shows the roadworthiness OCRS band at the time of the score calculation

• traffic band - this shows the traffic OCRS band at the time of the score calculation

• history table - this allows you to track changes to your OCRS score over the last 90 days. The date shown is the date on which a change occurred that impacted on your score

The lawful basis for processing this data is legal obligation.

Article 9 (risk rating system) of Directive 2006/22/EC requires DVSA to have a risk rating system with those who present the highest risk being inspected more closely.

3. Why we need it

We need the personal data we collect from you to:

• create and provide operator details and risk rating

• contact you based on your OCRS score

• decide which vehicles to inspect

• carry out analysis of the data and identify trends

• arrange for a desk or fleet assessment of your vehicles

OCRS is primarily used as an operational targeting tool. The score and the data within it that identifies road safety risks, may be used for other road safety interventions – potentially by correspondence – where necessary.

4. What we do with it

We collect, use, and store the data you give us for the reasons set out in this policy.

We will not:

• sell or rent your data to third parties

• share your data with third parties for marketing purposes

We share data with:

• The Freight Compliance Unit comprising:
  • Transport for London
  • The Metropolitan Police where they request data and receive details of the operator’s banding
  • City of London Police
  • Surrey Police
  • Essex Police
• The Environment Agency
• Office of the Traffic Commissioner
• Transport Regulation Unit (Northern Ireland)
• Driver and Vehicle Agency (Northern Ireland)

We will share your data if required to do so by law - for example, by court order, or to prevent fraud or other crime.

5. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We will hold your personal data for up to 7 years.

6. Where it might go

Our IT infrastructure and technology has been checked to make sure it’s safe and secure. Our servers are managed by Amazon Web Services and are located in Ireland.

7. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data.

8. Automated decision making and profiling

Your data is not subject to profiling as defined in data protection legislation.

Your data is used, however, to determine your OCRS rating. This is a points-based system with your score determined by a series of rules. Those rules are based on events, such as positive and negative events. These positive and negative events are classed as personal data when associated with an individual, and are logged on our systems to enable the automated decision making process.

The result of this automated decision making process will produce your OCRS rating - red, amber, green, grey or blue. The rating produced will determine if your vehicles need to be inspected or if a desk or fleet assessment of your vehicles needs to be arranged.

The risk level of an operator is taken from their base score. The ‘base score’ decides which OCRS band they fall into.

The ‘base score’ is worked out over a 3-year rolling period by dividing the total number of negative event points by the total number of all events. A weighting is applied to each year’s score with older events attracting a lower points value.

Operators get more points for more serious defects or infringements.

You can request a manual review of the automated decision by emailing dataprotection@dvsa.gov.uk. If you request this, the data entered on our systems, including positive and negative events, will be used to manually recalculate your rating.

9. Changes to this notice

We may change this privacy notice at our discretion at any time.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date.

We encourage you to periodically review this privacy notice to be informed about how your data is protected.

10. How to contact us

If you have any questions about anything in this document, or if you consider that your personal data has been misused or mishandled, you can contact the DVSA data protection manager.

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.