Car dealer - GDPR breach.

eeloe

I have to go to my main dealer tomorrow with a recurring issue, but besides that’s, yesterday I got a personalised video message via WhatsApp from someone in the garage that i’ve never dealt with.

This person stated my name, how much i’m paying currently and how much they can lower my payment to on a brand new car.

Now the recurring issue in my current car is bothersome, and they are going to be hard to deal with to get it sorted.

Is the video they sent me a breach of GDPR? I’ve never spoken to this person before, and to be honest I don’t know why or how he got access to my data? If they give resistance about fixing my car tomorrow, can I use this video as leverage to get my car fixed for once and all?

eeloe

eeloe wrote: »

I have to go to my main dealer... from someone in the garage.. I don’t know why or how he got access to my data

You obviously gave your info to the garage.

troyzer

Did you opt out of any marketing when you gave them your contact details?

mickdw

eeloe wrote: »

I have to go to my main dealer tomorrow with a recurring issue, but besides that’s, yesterday I got a personalised video message via WhatsApp from someone in the garage that i’ve never dealt with.

This person stated my name, how much i’m paying currently and how much they can lower my payment to on a brand new car.

Now the recurring issue in my current car is bothersome, and they are going to be hard to deal with to get it sorted.

Is the video they sent me a breach of GDPR? I’ve never spoken to this person before, and to be honest I don’t know why or how he got access to my data? If they give resistance about fixing my car tomorrow, can I use this video as leverage to get my car fixed for once and all?

Surely a business who you gave your contact info to are then entitled to use that i information to contact you directly.
It's not like they put all your personal info on a public email or something.

eeloe

I bought the car in 2016. So data privilege wasn’t high on my radar back then.

I may have given them my data, but I also didn’t advertise to the entire garage how much of a deposit I paid nor my monthly payments.

troyzer

eeloe wrote: »

I bought the car in 2016. So data privilege wasn’t high on my radar back then.

I may have given them my data, but I also didn’t advertise to the entire garage how much of a deposit I paid nor my monthly payments.

That's all internal data. It's the left hand sharing data with the right hand. You would have given your details at some point and there would have been a bit on marketing information.

They haven't done anything illegal here.

eeloe

Okay, that’s all I wanted to know.

Thanks.

troyzer

Having said that.

You can tell them you no longer wish to have your details stored for marketing purposes and they're obliged to do this.

In case it's bothering you.

dudara

Data processors (the garage in this case) must have a legal basis for processing someone’s details. Keeping your car details and informing you when a service is due etc is fine. But contacting people for marking purposes requires informed consent.

If they can demonstarate that they have your informed consent to send you marketing communications, then they are covered and it’s not a violation of data privacy laws.

However, if they don’t have your informed consent, it is a violation to contact you for marketing purposes (of which this was an example). Just because they have your details doesn’t mean they can send you marketing info. GDPR is quite clear on the distinct bases.

eeloe

I don’t remember telling them, or signing anything to say not to contact me, it’s just the whole, a stranger knowing my monthly payments.

I was under the impression the finance manager would be the only person to know the details of the payments

troyzer

dudara wrote: »

Data processors (the garage in this case) must have a legal basis for processing someone’s details. Keeping your car details and informing you when a service is due etc is fine. But contacting people for marking purposes requires informed consent.

If they can demonstarate that they have your informed consent to send you marketing communications, then they are covered and it’s not a violation of data privacy laws.

However, if they don’t have your informed consent, it is a violation to contact you for matketing purposesoses (of which this was an example).

It's quite likely he would have consented when he bought the car originally. There's so much paperwork that it can easily be overlooked. I bought a car a few weeks ago, spotted a section on marketing and decided to opt out.

dudara

troyzer wrote: »

It's quite likely he would have consented when he bought the car originally. There's so much paperwork that it can easily be overlooked. I bought a car a few weeks ago, spotted a section on marketing and decided to opt out.

GDPR requires informed consent, in other words you must explicitly opt-in. A pre-ticked box does not meet GDPR requirements, neither does a “tick here to not receive marketing communications”.

Depending how long ago it was when the OP bought his car, the consent form may not meet the requirements under the GDPR, and therefore should not be relied upon.

It’s hard to say what’s the case here as we don’t know the details, but the OP should request his details from the garage and ascertain if they have valid consent.

eeloe

I only really wanted to use this as a bargaining tool to make sure my car was fixed in a timely manner, as the exact same issue happened almost a year ago today and I had quite a job trying to source another means of transport while they had my car for repair.

eeloe

Thanks guys, at least now I know i’m just going to have to fight the warranty fight!

eeloe

eeloe wrote: »

Thanks guys, at least now I know i’m just going to have to fight the warranty fight!

If it's a main dealer, and a warranty issue, they should really be giving you a car to get you around whilst they work on your one, I'd have thought..?

eeloe

One would think that, any time I’m there I’m offered a lift in to the city centre and that’s it,

45 miles away from home

Alanstrainor

I have to say I wouldn't be at all happy with this kind of carry on from a dealer at all. It seems beyond ridiculous to me. I don't know the in's and out's of GDPR to say anything about that though...

Toyotafanboi

It's a very popular way for dealers to try and sell cars, the last few years.

Dealers are forever trying to find ways to get people into showrooms, then one day someone realised they have 30-40 potential customers visiting the showroom everyday that they weren't engaging with, the service department customers.

Sounds like you consented to marketing OP. They were a bit pushy in getting into exact facts and figures via text but nothing against GDPR.

A previous garage I worked for used to hang a label from the rear view mirror "your car is in demand as a trade in, please contact us to be shilled" in every single service vehicle. I think it was quite successful for them. A lot of bigger places now will have a salesman who just focuses on service customers, which sounds like what this is.

GM228

dudara wrote: »

GDPR requires informed consent, in other words you must explicitly opt-in. A pre-ticked box does not meet GDPR requirements, neither does a “tick here to not receive marketing communications”.

This is not entirely correct, a pre-ticked box is OK when dealing with electronic direct marketing once the customer has the choice to un-tick.

DublinDilbert

It's a 2016 car and you had the same problem 1 year ago, on a one year old car and they weren't too pushed to sort it. Now the problem is back and you feel you will need to push them to get it resolved.

I would find the sales man, tell him to look up your car on their crm and ask him why does he think you'd even consider purchasing another one from them.

colm_mcm

GM228 wrote: »

This is not entirely correct, a pre-ticked box is OK when dealing with electronic direct marketing once the customer has the choice to un-tick.

I thought that specifically changed and the customer has to actually tick the box to receive stuff rather than unstick to not receive?

uck51js9zml2yt

GM228 wrote: »

This is not entirely correct, a pre-ticked box is OK when dealing with electronic direct marketing once the customer has the choice to un-tick.

It's the opposite way around !!

It's opt in not opt out

GM228

Kaelyn Delicious Kindergarten wrote: »

It's the opposite way around !!

It's opt in not opt out

I'm afraid not, when somebody buys a product they must be given the choice to opt out when electronic marketing is involved, they don't have to be given an opt in only.

This is covered under the ePrivacy Directive itself (via the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011), as it is provided for in the Directive it overrides the provisions of GDPR because it is a specific provision of GDPR that where matters are provided for in the ePrivacy Directive then the general provisions of GDPR does not apply. The only issue is however they can only do this for 12 months after purchase, the OP bought in 2016 so there is indeed a GDPR issue now.

There is a lot of mis-information and misconceptions concerning GDPR and DP in general.

Lantus

Focus on the real issue and don't get side tracked with an ad. Hours of effort on the GDPR front will get you nothing while your car remains unfixed.

troyzer

An option opt out is fine. We had this issue recently in an association I'm a member of.

Jim79

Incidently, whats the issue with the car? If they fixed it before then it suggests that they can find the source again.

eeloe

O2 sensor issue.

Almost a year to the day it happened, they wanted to keep the car for 3-4 days without providing a courtesy car.

I live 45 miles away from the garage.

Toyotafanboi

eeloe wrote: »

O2 sensor issue.

Almost a year to the day it happened, they wanted to keep the car for 3-4 days without providing a courtesy car.

I live 45 miles away from the garage.

How do you know it's the o2 sensor again?

Sometimes peoples biggest mistake is taking it to the garage. I assume your car is reasonably new and still within manufacturers warranty based on what you've said.

If that's the case, why don't you call out the manufacturers roadside assistance, most if not all manufacturers offer this. If you have a warning light on the dashboard or the car is clearly not running correctly, they will send a mechanic to check it out and they have to recover your car to the dealer and provide you with a replacement car. They'll come to you, at a time that suits and either fix (if it's simple) or tow to the dealer and get you a rental car.

In fact, the best way to exploit this to speed up your repair, rather that going down some dicky GDPR slant may be to fake an interest in the new car they are trying to push on you and take it for a 24 hour test drive while yours is being worked on.

nim1bdeh38l2cw

dudara wrote: »

Data processors (the garage in this case)

Data Controllers :pac:

Skylinehead

Toyotafanboi wrote: »

Sounds like you consented to marketing OP. They were a bit pushy in getting into exact facts and figures via text but nothing against GDPR.

In 2016. To continue sending him marketing post-GDPR they should re-affirm consent.

nim1bdeh38l2cw

Nixonbot wrote: »

In 2016. To continue sending him marketing post-GDPR they should re-affirm consent.

Nonsense. If the initial consent was valid, there is no requirement to re-affirm it.

Captain_Crash

dudara wrote: »

GDPR requires informed consent, in other words you must explicitly opt-in. A pre-ticked box does not meet GDPR requirements, neither does a “tick here to not receive marketing communications”.

With GDPR, Auto Opt in is permitted if the marketing material is related to the product/service you have purchased ect. So if for instance you buy a screwdriver online, you can be auto opted in to receive marketing material telling you about a new version of the screwdriver, but you cant be opted in to receive marketing information for a spanner that would work well with the screwdriver.

ArrBee

It's not a citron is it? :P

GM228

Sandra CoolS Shot-putter wrote: »

Nonsense. If the initial consent was valid, there is no requirement to re-affirm it.

In relation to electronic marketing related to a product you bought yes there is, consent is only valid for 12 months.

nim1bdeh38l2cw

GM228 wrote: »

I'm afraid not, when somebody buys a product they must be given the choice to opt out when electronic marketing is involved, they don't have to be given an opt in only.

This is covered under the ePrivacy Directive itself (via the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011), as it is provided for in the Directive it overrides the provisions of GDPR because it is a specific provision of GDPR that where matters are provided for in the ePrivacy Directive then the general provisions of GDPR does not apply. The only issue is however they can only do this for 12 months after purchase, the OP bought in 2016 so there is indeed a GDPR issue now.

There is a lot of mis-information and misconceptions concerning GDPR and DP in general.

You are spreading this misinformation. A Regulation overrules a Directive, not the other way around.

GM228

Sandra CoolS Shot-putter wrote: »

You are spreading this misinformation. A Regulation overrules a Directive, not the other way around.

Not always, some Regulations (just like the GDPR) have relationship clauses.

It's an area of law I deal with, I suggest you read Article 95 of the GDPR Regulation:-

https://eur-lex.europa.eu/eli/reg/2016/679/oj

Article 95

Relationship with Directive 2002/58/EC

This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC.

GDPR does not impose any additional obligations over that which are already provided for by the ePrivacy Directive and this matter is already provided for by the Directive so it trumps the Regulation.

Also, here's a thread we discussed this in the Legal Discussion forum, the Data Protection Commission confirmed this very point to the OP:-

https://www.boards.ie/vbulletin/showthread.php?t=2057918695