Having access to the Motor Vehicle Register is valuable for any business working with motor vehicles, whether you’re a trader, insurer, finance company, or mechanic. With authorised access you can get the information you need to make accurate decisions quickly, making life easier for both you and your customers.

But authorised access comes with risks and responsibilities. The register has extensive information about people who have owned a motor vehicle, both past and present. This includes names, addresses, contact details, and dates of birth.

New Zealand Transport Agency: What is the Motor Vehicle Register? (external link)

Recently we’ve seen a number cases where employees have accessed and used this information inappropriately. We thought that it was good time to remind agencies with authorised access of what they need to do to stop this from happening.

What can go wrong

The information on the register might be less sensitive than, for example, medical information is. But anyone with access to the register has access to enough information to cause trouble. Situations like these can harm a person’s finances, rights, feelings, and even put them in danger.

In one recent case reported to us, the employee of a car dealership used their access to the register to find the name and address of someone who had been involved in damaging a friend’s car. They then posted that person’s information on Facebook.

The inquiry into government agencies’ use of external security consultants found that Thompson & Clark Investigations Limited searched the register thousands of times from 2012 to 2017, and available evidence suggests there were instances of improper access.

State Services Commission: External security consultants’ inquiry findings (external link)

Who is liable

Under the Privacy Act, we treat an employee’s action as the employer’s, whether the employer knew or approved of it or not. However, employers do have a defence if they can prove that they took reasonably practicable steps to stop the employee from taking that action.

Read more: Who’s liable if my employee breaches someone’s privacy?

Businesses also have a responsibility under principle five of the Privacy Act to protect the personal information they hold against loss and misuse. Principle five covers the quality of the security measures in place, not whether a breach has occurred. However, if a breach does occur it may reflect on the quality of these security measures. These measures don’t have to be fool proof, as long as they’re reasonable in the circumstances.

So, it’s important that businesses have robust policies and safeguards in place when it comes to information on the Motor Vehicle Register.

What you can do

Whether your safeguards are reasonable depends on a range of things. It’s not enough to have policies about protecting personal information, you need to take steps to make sure your staff follow them as well.

And you should have systems that can catch or monitor any inappropriate access, not just when employees look up someone with the same last name.

One step you could take is requiring staff to justify their access to the register, either at the time of access or retrospectively. For example, you could regularly check how often staff access the register and follow up on any unusual activity.

You could also conduct random audits comparing a staff member’s access to the register with the customers they’ve worked with in a given timeframe. This would help ensure that staff are following your policies and training.

Whatever systems you have in place, make sure your staff know about them; they won’t access the register inappropriately if they know you’ll catch them.

Read more: What security measures are appropriate?

Image credit: 'Buying a Car' by Pictures of Money, via flickr (external link)

security, IPP5 - storage & security, data