Who has your data?
Discussion
Good friend of mine discovered some curious anomalies with his Range Rover......
https://www.watts-innovating.com/the-hidden-data-d... - also tweeted at https://twitter.com/mtjwatts/status/10203576181608...
Pretty certain they are flagrantly in breach of GDPR regulations (hmmm,....4% fine of their turnover could focus their mind to solve the problem)
Still, who cares about data security, it's just a car, right?
https://www.watts-innovating.com/the-hidden-data-d... - also tweeted at https://twitter.com/mtjwatts/status/10203576181608...
Pretty certain they are flagrantly in breach of GDPR regulations (hmmm,....4% fine of their turnover could focus their mind to solve the problem)
Still, who cares about data security, it's just a car, right?
The t
tter post said:
tter post said: If you buy a 2nd hand @LandRover_UK and a previous owner has registered the car for remote services, apparently it’s impossible for RR to change this. The previous owner can unlock it, start the engine, turn on the aircon and there is nothing I can do about it #technologyfail
Not sure I'm seeing where GDPR comes into it. What of his personally identifying information are LR being cavalier with?The Ts & Cs of the service describe how "ownership" is changed.
LR said:
15.2 When you no longer own or use your Vehicle (for example, if you sell the vehicle, your lease expires, or the vehicle is lost or stolen) you must:
(a) remove your Vehicle from your InControl Services account;
(b) where possible, delete your user profile and any stored settings, features, information and personal data from the Vehicle;
(c) where possible, ensure the ‘remember me’ function for certain features of the InControl Package is disabled and/or you have logged out from the features.
15.3 If you no longer own or use your Vehicle while a current subscription for the “SOS Emergency Call” service, the “Optimised Land Rover Assistance” service, and/or the “InControl Secure” service is in effect, those services will be provided to the new user of the Vehicle for the remainder of that current subscription period, subject to the new user completing their own InControl Services account setup. To be able to use the “Live” service and Wi-Fi Hotspot, the new user will need to complete their own InControl Services account setup and have an associated data plan
https://www.landrover.co.uk/Images/Land%20Rover%20... - p16(a) remove your Vehicle from your InControl Services account;
(b) where possible, delete your user profile and any stored settings, features, information and personal data from the Vehicle;
(c) where possible, ensure the ‘remember me’ function for certain features of the InControl Package is disabled and/or you have logged out from the features.
15.3 If you no longer own or use your Vehicle while a current subscription for the “SOS Emergency Call” service, the “Optimised Land Rover Assistance” service, and/or the “InControl Secure” service is in effect, those services will be provided to the new user of the Vehicle for the remainder of that current subscription period, subject to the new user completing their own InControl Services account setup. To be able to use the “Live” service and Wi-Fi Hotspot, the new user will need to complete their own InControl Services account setup and have an associated data plan
...so it sounds like the previous keeper's the problem here.
He confirms that in his replies to his tweet, but just doesn't see why it's his problem...
In fact, looking further through those replies, he says that LR have told him that it can be done even without the previous owner disconnecting the car from their account, but his dealer say otherwise. Sorry, but LR win that one. Why doesn't he just get LR to talk the dealer through it, if they've not had to before and cba to read the tech doc...?
He has been the a LR dealer who told him they couldn’t do anything!
GDPR? Well, knowing the location it lives most nights would be seen by most as pretty personal data......
Alternatively, just leave your spare key with previous owners if you are happy with this working practice!!
GDPR? Well, knowing the location it lives most nights would be seen by most as pretty personal data......
Alternatively, just leave your spare key with previous owners if you are happy with this working practice!!
Edited by mikeiow on Tuesday 24th July 09:21
There are two issues as I see it...
There are NO grey areas when it comes to collecting data about individuals, I am aware of the InControl services on my Range Rover and therefore want to get the vehicle disconnected from the previous owner and connected to me, by the way the dealer has agreed to do this after receiving instructions from JLR directly.
But here's the thing, many many people have no idea about these services and would therefore never even look to check, and in this situation the vehicles location, destination and status is all being collected and given to someone that previously connected the vehicle to their account. This does fly in the face of GDPR as it is now my responsibility to stop this data from being collected or to have it associated to me and for me to provide my consent. It cannot be left to the dealer (many of which will be independent) or the new owner to have to rectify this.
Secondly, not the case with JLR but with many other vehicles, without any subscription service you can locate the vehicle and unlock it, again this cannot be the responsibility of the new owner to have to check this and to take action to stop it.
Matt
There are NO grey areas when it comes to collecting data about individuals, I am aware of the InControl services on my Range Rover and therefore want to get the vehicle disconnected from the previous owner and connected to me, by the way the dealer has agreed to do this after receiving instructions from JLR directly.
But here's the thing, many many people have no idea about these services and would therefore never even look to check, and in this situation the vehicles location, destination and status is all being collected and given to someone that previously connected the vehicle to their account. This does fly in the face of GDPR as it is now my responsibility to stop this data from being collected or to have it associated to me and for me to provide my consent. It cannot be left to the dealer (many of which will be independent) or the new owner to have to rectify this.
Secondly, not the case with JLR but with many other vehicles, without any subscription service you can locate the vehicle and unlock it, again this cannot be the responsibility of the new owner to have to check this and to take action to stop it.
Matt
Update after getting the InControl services now registered to me...
There is no automatic or failsafe way for the services to be disabled, the V5 is not proof of ownership and when it gets changed with the DVLA this does not trigger any process for the InControl services to be disabled.
If you sell or buy through a main dealer then they should go through the process to deactivate or reactivate for you, I've had people tell me this did not happen for them. If you buy through an independent then it's your responsibility to take the car to a main dealer, with the V5, proof of ownership and your drivers license, to get the services switched from the previous owner to you.
As a new owner if you didn't know these features exist, or didn't even think to use them then it's basically pot luck as to whether your details are being collected and made available to someone that had previously registered for service
There is no automatic or failsafe way for the services to be disabled, the V5 is not proof of ownership and when it gets changed with the DVLA this does not trigger any process for the InControl services to be disabled.
If you sell or buy through a main dealer then they should go through the process to deactivate or reactivate for you, I've had people tell me this did not happen for them. If you buy through an independent then it's your responsibility to take the car to a main dealer, with the V5, proof of ownership and your drivers license, to get the services switched from the previous owner to you.
As a new owner if you didn't know these features exist, or didn't even think to use them then it's basically pot luck as to whether your details are being collected and made available to someone that had previously registered for service
mtjwatts said:
the V5 is not proof of ownership
Just as it says on the top of it in big letters.mtjwatts said:
and when it gets changed with the DVLA this does not trigger any process for the InControl services to be disabled.
DVLA don't tell manufacturers about keeper changes of used vehicles. Never have, almost certainly never will. It'd be illegal under GDPR for them to give the new keeper's details, anyway...Gassing Station | Land Rover | Top of Page | What's New | My Stuff