Personal data warning as digital information not deleted from cars

One-in-three used car buyers have found previous owner’s data stored in the car’s infotainment system, new research suggests.

Personal digital information can be cached by in-car apps, such as sat nav, music streaming and in smartphone-mirrored contact lists.

Fleets were first warned that they run the risk of breaching data protection rules by leaving personal information stored on vehicle systems when they are defleeted some six years ago. 

The General Data Protection Regulation (GDPR), which came into force in 2018, requires businesses to comply with rules designed to safeguard personal data.

As specified in Article 5 of the GDPR terms, data should be kept in a form which permits identification of data subjects for no longer than is necessary.

This means that the data needs clearing when a vehicle is changing owners, a vehicle has been written off and will be scrapped or if a vehicle has been rented and will be rented by someone else.

At the time, the Government’s National Cyber Security Centre said the fleet industry should treat a modern car or van like any other connected device: delete all personal data and disable the account that has been used with the car.

“Privacy is already seen as a key issue with phones, tablets, and laptops,” it said. “Cars and other internet connected devices should also be added to the list.”

The latest findings from a survey conducted by Carwow point to a potential future data privacy issue for dealers, says Gaurav Jain, commercial director at the remarketing firm.

“It can be unclear whether responsibility to delete user information from a vehicle at change of ownership lies with the first owner, the manufacturer or with the dealer,” he said. 

“Allocation of responsibility could be influenced by which of these entities might be considered the ‘controller’ of the data under GDPR laws.”

Over three quarters (83%) of those surveyed by Carwow said they would expect the dealer to wipe personal data from the car, while just 17% would not expect dealers to do this.

Jain said: “We’d advise all car sellers to remove any personal data from the car prior to handing over their car - including from any in-car apps.

“In addition, dealers should safeguard their own interests, as well as that of their customers, by taking reasonable steps to remove data themselves before handing over the keys to a new owner.”