To ask the Secretary of State for Transport, what risk assessment his Department has made of third party access to the Driver and Vehicle Licensing Agency's registered keeper database in cases where the third party (a) uses that information themselves and (b) provides that information to another company.

The Driver and Vehicle Licensing Agency (DVLA) has robust measures in place to protect the data it holds. The release of DVLA’s data is subject to a formal assessment to ensure that there are adequate policies, procedures and technical controls in place to protect it. Data Protection Impact Assessments are completed to identify and address any privacy risks and ensure that personal data is only processed in compliance with the law.

Recipients of vehicle keeper information must handle the data in accordance with clear terms and conditions. Where recipients pass the information onto another company, there must be a formal contract in place to provide assurance over the use and security of the data. The original recipient retains overall responsibility for the use of the data by its sub-contractors.

The DVLA carries out its own comprehensive audits, involving both remote and on-site audits in conjunction with the Government Internal Audit Agency. This helps to ensure that information provided by the DVLA is used only in accordance with its terms and conditions. Failure to comply can result in denied access to the information.