Playbook, driving school

A pupil who stopped a year ago wants everything gone

Somebody asking a driving school to delete everything is picturing a mailing list. What is actually held started with a licence checked at the kerb before their first lesson and grew into a record of how they drove, written by hand between sessions, and it is not all in the same place or even in the same set of hands.

Why this is not the general answer

The handling pattern for data deletion requests holds across every trade. What follows is the part that does not.

  • The material is split. The school usually holds the enquiry and the payments, the self employed instructor holds the record card and the lesson notes, and a pupil who has written to one has not reached the other.
  • What is held about a pupil begins with an identity document rather than an email address, because licence details are produced and checked before the first lesson, and almost nobody making a deletion request has pictured that part of it.
  • Lesson notes describe how a particular person drove, which is exactly the content people feel awkward about and ask to be removed, and it is also the record an instructor would rely on if anything about a lesson were ever questioned.
  • A pupil who was seventeen when the record was made may be asking about it as an adult, and the parent who booked and paid may be the one asking instead, which are two different requests arriving in the same words.

How it arrives

  • can you delete my details now that ive passed
  • have you still got my licence details from my first lesson
  • i stopped lessons last year please take my details off
  • who do i send a data request to at a driving school
  • can you get rid of my lesson notes
  • my daughter wants her details removed from your records

What has to be indexed for this to work

Material behind this answer
Who holds what, written as two listsWhat the school holds and what the instructor holds, named separately. Without this the assistant will answer for the school and the pupil will assume the instructor's card went with it.
What was recorded at the first lessonWhich licence details are taken, whether anything is copied or only checked, and how long any of it is kept. This is the part nobody expects, and stating it is what makes the rest of the answer credible.
Your published retention positionHow long records are kept, measured from what point, and why. Quote only what you publish. A period with a starting point attached reads as a rule, while a bare number reads as a delaying tactic.
How a request is made and who receives itThe address or form, what to include so a former pupil can be matched to a record, and your response commitment. Send it somewhere a person opens, because the clock starts whether or not it was read.

The reply

A reply worth copying
I can tell you how it works and then pass the request on, because I cannot delete anything myself. Records here sit in two places: the school holds enquiries and payments, and your instructor holds the lesson record, which includes the licence details checked before your first lesson [1]. Our privacy notice sets out what is kept and for how long [2]. Send me your name, an email and roughly when you had lessons and with whom, and it goes to the person who handles these, who will reply within the period in the notice.

It says up front that this is a handover, so nobody reads the explanation as an action. Naming the split is the whole value of the answer, since a request that reaches only the school leaves the card untouched. And it asks for the two facts that let a former pupil be found in a paper record, which is when and with whom rather than an account number.

Where it stops

The trigger. Any request phrased as deletion, removal or erasure, any request to see what is held, and any request made about somebody other than the person writing.

The handover, worded
This is a request rather than a question, so I am passing it on rather than answering it. Leave me your name, an email and when you had lessons, and you will get a reply within the period set out in our privacy notice.

It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.

Never say this here

Out of bounds

  • Never say anything has been deleted or removed, because nothing in this conversation reaches a record card, an inbox or a payment history.
  • Never quote a retention period that is not in the school's own published notice.
  • Never confirm whether a named person was ever a pupil, including to somebody who says they are a parent.
  • Never tell a pupil that a request to the school covers a self employed instructor's own records, unless the published notice says exactly that.

Questions

Our instructors keep their own paper records. Whose problem is a deletion request?
Both, and that is precisely why it has to be written down. If the material does not say who holds what, the assistant will answer for the office, the pupil will believe it is finished, and the card in the folder will still be there.
Can it delete a marketing preference at least?
No, not even that. Every request here becomes a message to the address you nominate. The enquiry is stored as well as emailed, which matters most when a deadline is attached and an email goes astray.
Should we publish a retention period?
Publish the one you actually work to, and only that. A period invented in an answer becomes a commitment made in the school's name, and a data question is the last place to be approximating.

Keep reading

Try it on your own material

Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.