back to article Second-hand connected car data drama could be a GDPR minefield

What are the implications under GDPR of a previous owner retaining access to data and control of a connected car after it is sold on? Although El Reg's initial story on the topic focused on the experience of two Jaguar Land Rover owners and the car maker's response, it has become clear this is an industry-wide issue and cars …

Page:

  1. frank ly

    Duh!

    "Multiple manufacturers and their respective telematic technology providers appear to be at fault one way or another."

    Why the heck didn't they think of this in their early planning stages? In the various meetings, I wonder how many engineers said, "Excuse me but ....." and were then shouted down or ignored.

    1. 42

      Re: Duh!

      The BOFH got to them. It would be a very good lart.

    2. LucreLout

      Re: Duh!

      I wonder how many engineers said, "Excuse me but ....." and were then shouted down or ignored.

      They won't have been shouted down and they won't have been ignored: They will have been "resisitant to change", which is all too often management speak for "This employee is smarter than me and has exposed the utter idiocy of my bonus bagging idea".

      Quite why "society" values those whose main skill is watching others work at a value premium to those doing the work, is beyond me. I mean, sure, if the management add value, but as often as not, that isn't the case.

    3. This post has been deleted by its author

    4. Anonymous Coward
      Anonymous Coward

      'Why the heck didn't they think of this in their early planning stages?'

      You mean why didn't the car-mafia that rigged emissions tests for years - do the right thing? A. There were no GDPR lawyers around! B. There is still a reality distortion field mindset that tech can do no wrong. Yet every other day El Reg shows the harm.

      I've held off buying a car because of this and the emissions scandal. I'm also not buying SmartTV-slurp, Win10-Slurp, Android-Slurp or any IoT-Slurp. Vote with your wallet. Look around but don't buy. But do tell the salesmen why you're not buying!

  2. Anonymous Coward
    Anonymous Coward

    Wonder where rental cars sit in this field.

    I've hired various cars over the years that have been connected up, as well as connected up to previous renter's phones and still hosting a full copy of their contacts, call history, etc.......

    1. Spanners Silver badge
      Big Brother

      Rental Cars

      I have rented vehicles a couple of times where there was a lot of information about previous users. Before I connected my phone to anything, I cleared the lot. I also cleared it before I returned the vehicle.

      I also mentioned it on the customers comments each time and got appologies from the people there.

      Presumably, nowadays, this would be relevant to the GDPR? It's certainly relevant to common sense...

      1. MachDiamond Silver badge

        Re: Rental Cars

        "I have rented vehicles a couple of times where there was a lot of information about previous users. Before I connected my phone to anything, I cleared the lot. I also cleared it before I returned the vehicle."

        Why would you sync your phone to a hired car!? With your own car you can look up in the manual how to dump the data or visit a dealer if needs must, but with a rental, you probably don't have a manual, can't take it to a dealer and you would need to be something of an expert in the car you hired including the various software revisions.

        Keep your phone disconnected from cars you don't own. If might become a sideline for some lot monkey to clone data at a hire company as many people are not going to know how to clear it or will be in too much of a hurry to remember.

        1. Roundtuit

          Re: Rental Cars

          I wonder how many buses, trains, planes, taxis and Uber cars have shlurped down passenger info?

    2. Halfmad

      also ex-rentals

      My car is an ex-rental, it came with the previous rental agreement still in it with the guys contact details and a photocopy of his passport.

      It's not just the electronic data that's being mishandled. The automotive industry from manufacturers to garages is a **** storm waiting to happen.

    3. JoeTheAnnoying

      Rental cars sit... poorly...

      Modern designers make the assumption that everyone WANTS their data to be shared "for their own convenience", and so slurps it up without so much as a "by your leave".

      I was chaperoning a group of 15-17-year old girls on a drive down to Los Angeles. One of them wanted to play music for the rest, so she connected her iPhone to the car's audio system. BOOM! It downloaded all of her contact information into the in-car system, without so much as a "by your leave". (I found out because when I tried to use the hands-free system it had contacts such as "Mom" and "Jenna" and I asked the girls, "OK, whose mom's # is xxx?")

      Yes, of course I deleted all of her information. But the idea that, "If you connect your phone to this rental vehicle, it will automatically and WITHOUT YOUR EXPRESS PERMISSION extract all of your contacts into its own system" is appalling, to say the least...

      1. Anonymous Coward
        Anonymous Coward

        Re: Rental cars sit... poorly...

        I was chaperoning a group of 15-17-year old girls on a drive down to Los Angeles. One of them wanted to play music for the rest, so she connected her iPhone to the car's audio system. BOOM! It downloaded all of her contact information...

        Well they could have plugged in the audio output into the car's audio with the iPhone headphone jack. Oh wait a minute...

  3. Wiltshire

    Wonder how any buyer of a secondhand car is supposed to know if the car has been connected?

    1. smudge

      If it has that functionality, then you assume that it has been.

    2. macjules

      Correct. You should not have to worry.

      Even if there is a clear definition for the use of data in the JLR sales terms and conditions, especially in regards to GDPR then there should also be a requirement for JLR to automatically enforce the seller's RTBF.

      Mind you for most RangeRovers the history would be, "owner drove to kids school and blocked up the roads around the school" x2 every school day.

      1. Anonymous Coward
        Anonymous Coward

        Spot on sir.

        The nearest to "off-road" they ever get is going up the bloody kerb.

        1. Doctor Syntax Silver badge

          Re: Spot on sir.

          The nearest to "off-road" they ever get is going up the bloody kerb.

          Don't assume the only reason you need 4-wheel drive is to go off-road. In winter the road-clearing is so abysmal you need it if you live on a hill. And round here there are a lot of hills.

          (There's also an argument that general road maintenance is so abysmal there isn't actually that much difference between on-road and off-road.)

          1. Anonymous Coward
            Anonymous Coward

            Re: Spot on sir.

            Don't assume the only reason you need 4-wheel drive is to go off-road.

            Don't forget there are also many of us that live in the country where during the winter a 4-wheel drive is essential if you want to go out - townies object to real tractors parking on their roads.

          2. HamsterNet

            Re: Spot on sir.

            BAH,

            Drove my rear wheel drive through the hills in the snow and only had to dig myself out once. Most modern SUV gets stuck on dam grass anyways.

            1. Michael Wojcik Silver badge

              Re: Spot on sir.

              Drove my rear wheel drive through the hills in the snow and only had to dig myself out once.

              My parents lived on top of a mountain in rural Vermont for nine years, with a FWD Toyota Tercel and a RWD Toyota Van (the Toyota R20 or R30, sold in the US in the 1980s). There were a couple of miles of gravel roads, which were occasionally graded but nothing more, before you reached pavement; and while Vermont is pretty good about clearing snow, there are a lot of road miles relative to population, so when it snows (as it does most days of the winter) it may take a while.

              They drove pretty much daily and rarely got stuck with either vehicle. And that was generally with all-season (M+S) radial tires, not snow tires.

              It's mostly a matter of knowing what you're doing.

              When I taught my stepdaughter to drive, in my Honda Civic coupe (manual transmission, naturally), we had a nice snowy day so I drove around to the alley in back, ran it into a snow drift, then let her get it back out and back to the street. Took a while, but since then she's had no problems with 2WD vehicles in the snow.

              When I was in high school, living on the New England coast, almost no one I knew had 4WD or AWD. We kids mostly drove dreadful old American RWD cars with open differentials, primitive suspensions, vague steering, and ridiculous moments of inertia. And we flung 'em around the roads regardless of the weather, generally pretty successfully.

              These days everyone in the family has AWD vehicles because they're so common, why not? And it does make things easier. But necessary? I don't think so.

        2. Intractable Potsherd

          Re: Spot on sir.@cornz 1

          "The nearest to "off-road" they ever get is going up the bloody kerb."

          And that only to park in the most inconvenient place. My experience of posh 4WD drivers on the move is that they will always be at least 2 feet from the edge of the road - annoying when on a road that is two cars plus 18 inches wide...

          1. Steve Renouf

            Re: Spot on sir.@cornz 1

            Lot's of those here!

      2. Anonymous Coward
        Anonymous Coward

        > Mind you for most RangeRovers the history would be, "owner drove to kids school and blocked up the roads around the school" x2 every school day.

        And bonus points for showing they parked in the 'keep clear' / 'no waiting' zone.

      3. MachDiamond Silver badge

        "Mind you for most RangeRovers the history would be, "owner drove to kids school and blocked up the roads around the school" x2 every school day."

        The other data would be "went from Home to Tesco" and the car weighed 1kg more on the return 4x/week.

  4. Chris G

    Just Wondering

    As slight aside; how long it will be before the cops want access to your vehicle's data logs when they stop you so that they can go phishing. Of course they will try to find reasons to keep everything indefinitely, along with you biometrics, fingerprints, toenail clippings and anything else they may be able to use to stitch you up at a later date.

    Expect at some point in the future to be required by law to provide access to cops, insurance companies, uncle Tom Cobley and all.

    1. MachDiamond Silver badge

      Re: Just Wondering

      It won't be that the cops will ask for access to your data, they will be able to slurp it during that long interval they are sitting behind you when they pull you over if not before. The car will rat you out by providing the SatNav data and where you have exceeded the speed limit on a road for the entire day.

  5. Anonymous Coward
    Anonymous Coward

    Almost as good as The Dartford Crossing....

    They have gone the complete other direction....

    If someone has (ever) registered the cars number plate for the Dartford crossing and not removed it from their account after sale, they(Sanef) refuse point blank to do anything about it without sending original documentation to an address they specify only when you call them up.....and they will take an unspecified amount of time to sort it out.

    All the while of course, registration plate is being recorded and charged illegaly to the wrong person.

    1. BenDwire Silver badge
      Facepalm

      Re: Almost as good as The Dartford Crossing....

      Eh? If you've sold the car and not bothered to remove it from the system, then that's your problem, shirley? It only takes a couple of clicks to deregister once you realise you've been funding the new driver...

      1. Roland6 Silver badge

        Re: Almost as good as The Dartford Crossing....

        >It only takes a couple of clicks to deregister once you realise you've been funding the new driver...

        Are you sure? I mean you are assuming the Dartford Crossing system only contains unique registration details. I would not be surprised if a car can be registered against several accounts concurrently and all get billed everytime the vehicle completes a crossing...

        1. Hopalong

          Re: Almost as good as The Dartford Crossing....

          Yes, it is very easy to remove a vehicle from your account.

          Also, they will automatically remove a vehicle (after few months) if its car tax group changes to 'Disabled'.

          1. Roland6 Silver badge

            Re: Almost as good as The Dartford Crossing....

            >Also, they will automatically remove a vehicle (after few months) if its car tax group changes to 'Disabled'.

            Thanks, useful to know, they obviously take a feed from DVLC for vehicles taxed as disabled. Which seems to mean that you are driving an exempt vehicle you don't need an account and won't get a letter demanding payment.

        2. ChrisC Silver badge

          Re: Almost as good as The Dartford Crossing....

          I had this exact problem when I bought my last car, went to add it to my Dart Charge account only to have it rejected due to being assigned to another account - absolutely no way (just as it should be) to have the same registration assigned to multiple accounts. Contacted Dart who said it'd be no trouble to remove it from that account just as soon as I could send them a copy of the V5 in my name...

          As I was planning to use the crossing a couple of days later, waiting for the DVLA to get their ducks in a row and send me out the new V5 wasn't exactly an option, so I was considering simply driving t'other way around the M25 to get into Kent, when I then started having a look through the various bits of old service history paperwork that'd been left in the car. A-HA! Garage receipt from a few months prior to the car having been sold, complete with mobile phone number of the previous owner. One quick text later and the car had been removed from their Dart account and I could add it to mine without any further hassle.

  6. smudge

    Not a new problem...

    ... but getting more serious, of course.

    I guess it started with built-in sat navs. Logs where you have been. May have recorded what speed you were travelling at - hence the old advice to clear it fast if you are stopped by the cops. And how many people have entered their actual home address as "home"?

    Then Bluetooth phone connectivity came along. And so on...

    My BMW has a function to delete all user data. Says it can take 15 or 30 minutes - can't remember which. You've got to trust it, of course, and I don't know if it deletes everything that you would want deleted. But if it does what it says then it sounds good. As long as you remember to use it.

    1. Red Bren
      Big Brother

      Re: Not a new problem...

      "BMW has a function to delete all user data. Says it can take 15 or 30 minutes"

      That's how long it takes to upload the data to base before the actual deletion, which only takes a second or two...

      1. smudge
        Joke

        Re: Not a new problem...

        Don't be silly - they gather the data as it is created.

        Do you wait until you resign before downloading your company's client database, sales forecasts, product plans and designs, etc?

    2. tiggity Silver badge

      Re: Not a new problem...

      The classic satnav "home" was to pick location of nearest police station

      That no longer works as most of them are now closed down, so no such thing as a local plod station for most people

  7. adam payne

    Customer confidentiality and the security and privacy of customer data is paramount to Jaguar Land Rover. We continually review our processes to identify further improvements to meet the security and privacy needs of our customers.

    Multiple people have raised an issue and you don't seem to be doing anything about it apart from issue stock statements.

    In this case I don't see how confidentiality, security or privacy are paramount to you.

    1. tfewster
      Facepalm

      Paramount: adj

      "more important than anything else". What, more important than sales, revenue, profit, design, reliability...?

      I don't think I'll be buying a JLR product.* Even if they haven't gone bust, apparently their product quality is of even less importance than their shoddy service.

      Or, more probably, their stock statement is just a lie.

      * I always wanted a SWB Land Rover Defender one day, but too late :-(

  8. Len
    Thumb Up

    I love how the GDPR...

    I love how the GDPR has suddenly unearthed all these issues that few people ever thought about. It's not just a law, it's the greatest (global, thanks to the "Brussels Effect") privacy awareness campaign ever.

    1. Lee D Silver badge

      Re: I love how the GDPR...

      Indeed. And given that GDPR is really not much more than "Data Protection Act, plus long-established case law from data protection cases, plus application to non-IT-based data storage", it's quite shocking how much of an impact it's had now that people are actually pulling their finger out and complying.

      I've been telling people for years that they were risking being sued, even if they followed the wording of the DPA, the case law established very different rulings, but they never listened. GDPR has made them "finally" compliant.

      Interestingly, at my workplace, I've been praised several times for being "ahead of the curve", GDPR-wise, not because I spent thousands of hours like a headless chicken, but precisely because I've just always managed data under those rules anyway.

      1. Doctor Syntax Silver badge

        Re: I love how the GDPR...

        "Data Protection Act, ... plus application to non-IT-based data storage"

        Non-IT-based storage was always covered under the DPA v2.0 if not DPA 1.0.

  9. Red Bren
    Pirate

    Software not designed for a secondary market

    Isn't this a manifestation of the blurring line between hardware that is owned, and software that is licensed?

    If you buy a new car that requires you to create an account to access all the features, can all subsequent owners do the same for free? If the new owner of the car tries to break the link with the previous owner's online account, will they be greeted with an extortionate "In order to use the advanced features of this vehicle, please register at www.britishleyland.com" where they will be given an option to pay a fee (double dipping by the manufacturer) or be told "your vehicle is no longer supported"

    How do we ensure that exercising your GDPR rights doesn't force you to brick your car?

    1. Doctor Syntax Silver badge

      Re: Software not designed for a secondary market

      "How do we ensure that exercising your GDPR rights doesn't force you to brick your car?"

      I think if that happened it would take the fines into the top tier.

    2. MachDiamond Silver badge

      Re: Software not designed for a secondary market

      "In order to use the advanced features of this vehicle, please register at www.britishleyland.com" where they will be given an option to pay a fee (double dipping by the manufacturer) or be told "your vehicle is no longer supported"

      You've hit on another topic, no future support, that will be an issue in the years to come. What will you do when the car you bought with autonomous driving is 5 years old and the company no longer updates the software since it doesn't have the newest hardware to run it? With EV's, if the manufacturers don't install time bombs, they should last longer than an ICEV. Not many laser printers are supported on the latest OS's even though they are perfectly serviceable.

      1. SImon Hobson Bronze badge

        Re: Software not designed for a secondary market

        Indeed, there's already a long line of case history to show the risks of that - ask Zune or Revolv hub owners !

  10. nrhw

    What about the manufacturers' rights to the data?

    Obviously a previous owner seeing the current owner's data is a potential GDPR breach, but I was wondering what the manufacturers' position is? Do they need to permission from the current owner of a vehicle to collect their data in the first place?

    If I buy a secondhand car, how does the manufacturer know the owner of the car has changed (and that they need to stop gathering data until they have permission from me) and how would I know that the car was connected and sending data to the manufacturer?

    1. Dazed and Confused

      Re: What about the manufacturers' rights to the data?

      If I buy a secondhand car, how does the manufacturer know the owner of the car has changed

      I think this is a key issue here. If the car is sold through the main dealer chain then they should know, sure. But if I sell a car privately do the manufactures have the right to know that I have sold it?

      It's sometimes hard enough to get the DVLA to recognise the change of ownership.

      I don't believe the DVLA pass on the information to the manufacturer so who is going to be responsible for informing them.

      What happens if there is a third party monitoring device?

      The second hand car we bought for our kid to learn on isn't connected as a standard feature but VW provide a module that plugs into the industry standard diagnostic port to collect data and then uses a app on the phone to upload things. So this shouldn't leak, but I can imagine a business providing many of the features of connected cars as an after market add on, if they included their own comms unit instead of relying on a phone and app, they'd face the same issue. Tracking devices already do this kind of thing.

      This looks like being a much wider issue that just the car manufactures.

    2. IsJustabloke
      Meh

      Re: What about the manufacturers' rights to the data?

      "If I buy a secondhand car, how does the manufacturer know the owner of the car has changed"

      I've driven a lot of FIAT group cars over the years, only two of which were bought from main dealers, yet somehow, the FIAT security register has always been aware of my ownership so somebody somewhere is connecting the dots as far as car ownership changing is concerned. I've never told them directly.

  11. yoganmahew

    Uxbridge English Dictionary

    Paramount = where you hang your parachutist after you've shot tthem

    Or "couldn't give a stuff while there's money to be made doing lowest cost development where they'll just do what the spec said, and the spec said nothing about security"

    The ICO or Advertising Standards should start looking at the product specifications for anything like this and see if security is mentioned at all and levy fines accordingly.

  12. andymcp

    Having been through the process of unlinking a car during a private sale (not JLR), even if the app has an ‘end ownership’ option, it also likely comes with an in-car registration that’s entirely separate. Hence you still get phone calls when the new owner sets the alarm off. Or reinstall the app after getting an alarm notification call to find it’s been happily collecting data attributed to you for months. Or have a few buttons that offer you the chance to remote unlock, remote start, remotely activate the alarm, send destinations....

    And revised ‘features’ get added at such a rate, or in-car systems updated so often, that nobody in the dealer, UK manufacturer customer service or outsourced service provider know how to identify the fault, far less fix it (because obviously you don’t have the car any more to check the manual).

    Still, if anyone here has a silver ****, registration **14 ***, and forgets their keys just give me a shout and I’ll let you in and start it up for ya. No charge.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like