The test-drive licence: a car dealer's privacy duties when you take a customer's ID
Taking a driver's licence before a test drive is a collection of personal information, so the Privacy Act's handling rules apply to it. The discipline is simple: tell the customer why you are taking it, take only what you actually need, and prefer sighting the licence and recording the details over photographing or photocopying it and keeping the image forever. The most common privacy problem at a dealership is not taking the licence, it is keeping a pile of licence photos nobody ever deletes.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Taking the licence is a collection, so three rules apply
When you take a customer's licence to verify who is driving your vehicle, you are collecting personal information (and a licence image is a rich piece of it: name, address, date of birth, licence number, photo). If your dealership is a covered entity, three Australian Privacy Principles shape how you do it:
- APP 5, notice. At or before the time you take it, make the customer aware of who you are, why you are collecting it (to verify the driver and manage the test-drive risk), and how it will be handled. A short, clear line at the point of the test drive does the job.
- APP 3, collect only what is reasonably necessary. You need to confirm identity and licence validity for the test drive. Ask whether you actually need to keep an image of the licence to do that, or whether sighting it and recording the details you need (name, licence number, expiry) in your test-drive log is enough.
- APP 11, secure it and destroy it. Whatever you keep must be held securely and destroyed or de-identified once you no longer need it. A test-drive licence image is not something to keep indefinitely in a folder or on a salesperson's phone.
Sight and record beats photograph and hoard
The practical rule that keeps a dealership clean: sight the licence, record the details you genuinely need, and avoid keeping the image unless you have a real, stated reason. Photographing every test-driver's licence and letting the images accumulate on phones and in shared drives is over-collection and over-retention at once, and it is exactly the kind of unnecessary sensitive-data pile that turns a minor breach into a serious one. If you do keep an image for a specific reason, store it securely, log why, and set a short retention period after which it is deleted.
Consent versus notice
You do not generally need a signed consent form to sight a licence for a legitimate test-drive purpose, but you do need to notify under APP 5. Notice (telling the customer what you are doing and why) is the baseline; a bundled "I consent to everything" form is not what the Act asks for here. Keep the notice specific and honest. Read: consent to collect a customer's ID at a dealership
Where this fits the bigger picture
The licence is often just the first piece of data a customer hands over. If they go on to enquire about finance, you then collect income and bank details and disclose them to lenders, which is a separate and higher-stakes flow. Read: finance and insurance data at a dealership And the notice you give at the test drive belongs in a proper collection notice covering all your collection points. Read: the collection notice a dealership needs
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Can we photocopy or photograph a customer's licence for a test drive?
You can collect what is reasonably necessary, but ask whether an image is necessary at all, or whether sighting and recording the details is enough. If you do keep an image, notify the customer, store it securely, and delete it on a short timetable. The risk is not the copy itself, it is keeping copies you no longer need.
Do we need the customer's consent?
You need to notify them (APP 5) of who you are and why you are taking the licence. A separate signed consent is not generally required just to sight a licence for a legitimate purpose, though clear notice is. Sensitive information collected later (for example in finance) has its own higher standard.
How long can we keep the licence details?
Only as long as you need them for the purpose. For a test drive that has finished with no sale, that is usually a short period. Destroy or de-identify the details once the purpose has passed. Read: how long should a car dealer keep customer records?
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act applies to your dealership depends on your turnover and how you operate. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.