4 ms·

Either BMW changed their mind or overstated what they’re doing, because they are on-record contradicting this story: https://www.motoringresearch.com/car-news/

Either BMW changed their mind or overstated what they’re doing, because they are on-record contradicting this story: https://www.motoringresearch.com/car-news/bmw-targeted-warranty-ads/ https://www.motoringresearch.com/car-news/bmw-targeted-warra... BMW has told Motoring Research its targeted billboard warranty adverts – which are claimed to use number plate registration technology to tailor public adverts to BMW drivers – do not actually draw upon vehicle warranty status. Rather, only publically available information is used. “There is no personalisation visible on the advert and no vehicle or customer data is stored or retained.” “No personal identifiable information applicable to GDPR is used in the [Vehicle Detection Technology] process nor does VDT ever have access to any personal data.”

tyingq 6y ago
That sounds like a weasel word version of "we can detect vehicle warranty status without using PII."
- bagacrap 6y ago
  I think they're saying they can't even tell if it's actually out of warranty, ie if you did buy the extended warranty you'd still see the popup.
  - smarx007 6y ago
    Most likely they figured out that they are about to violate GDPR and altered the code to also show the notice to those who bought the extended warranty. I cannot imagine execs spending so much money on a project to shame both those who bought an extended warranty and those who didn't. In that case you can just put a static printed ad for the warranty.
    - deleted 6y ago
      [deleted]
- avianlyric 6y ago
  You can probably guess without using PII. In the UK numberplate info is public, you can look up the make, model year and colour of a car just using it's numberplate, and anyone can do this. Using that info it would be trivial to detect a BMW car that was older than X years old. Where X is number of years the normal non-extended warranty is. You then just assume that any car older than the non-extended warranty doesn't have an extended warranty and display the advert. Then the only thing the advert would be giving away is that there is a BMW nearby that older than X years. Which anyone with a pair of eyes could figure out because the numbers of UK numberplates encode the issue year (thus the age of the car), and well, BMW's are pretty easy to identify just by looking at them.
  - itronitron 6y ago
    They could also not do the numberplate look up and achieve the same end result by posting a billboard that just says 'Don't buy a BMW'
- floatingatoll 6y ago
  The phrasing around "no vehicle data is stored or retained" implies that they're doing vehicle plate->VIN lookups in their database of cars manufactured and perhaps warranties issued, which as the manufacturer of said car they might well be correct to say that no PII is required. There's a missing piece of anti-targeting marketing legislation here, that GDPR won't cover under PII, even if it is eventually found that their plate lookup is a PII violation: Can the manufacturer of an object use their privately-held data about the object to target marketing to the bearer/operator/etc. of that object? Probably, yes, at least until a law is passed or a ruling is issued that states otherwise. The best short-term route of attack here would be on the plate->VIN conversion database, assuming that's what they're using anyways. But long-term, they'll figure out how to use a telephoto lens or LIDAR or paint-embedded QR codes to get VIN numbers somehow, so best to tackle the bigger problem too.
gambiting 6y ago
As I just said in another comment - they can figure it out without any private information. Licence plates are public and they are allowed to scan one with a camera, and they provide warranty on all BMW cars, so they know(and have the right to know) if a specific car is covered by them or not. They have all the iformation they need.
- avianlyric 6y ago
  You're not wrong about them in theory having all the data they need to identify out of warranty cars. But if they are legitimately identifying out of warranty cars (I suspect they're not), then that doesn't give them the right to publicly broadcast the information to the wider world. Which I suspect is the crux of this issue.
  - gambiting 6y ago
    But again, it depends what sort of information is broadcast. If the bilboard says "hey, driver of BMW reg number EK16 WHD, your warranty is expired!" then that's definitely a problem. But if all that happens is a generic BMW warranty bilboard appears whenever an out-of-warranty car drives past "hey, is your BMW warranty expired? Extend today!" then it's probably ok legally.
    - csunbird 6y ago
      I mean, the next step after this feels like ads on the infotainment system.
      - netsharc 6y ago
        "Today's game: Candy Crush!". But in all seriousness, it would be easy to profile the driver. Is it close to dinner time? "Try out the hot new vegan restaurant, het 10% discount when you show your BMW key. 2 miles away, navigate there, Y/N?". Replace vegan with steak, etc, depending on the profile. Driving to a residential address in an expensive part of town around dinner time? "Last minute dinner party gift idea: blah blah wines. Shop is en-route, navigate there, Y/N?".
mannykannot 6y ago
With this announcement, I hope that, by by helpfully bringing to people's attention that information such as the warranty status of your car is publicly available [1], BMW will annoy a broader group of people than just BMW owners. [1] Assuming that they are not outright lying here when they say "only publically available information is used."
- itronitron 6y ago
  well, certainly the information is publicly available after it's used
Spearchucker 6y ago
This is possible now that Brexit has happened. Whether the UK will need to comply with GDPR or not is dependent on the deal Boris strikes with the EU, if indeed he ever does.
- andylynch 6y ago
  Not quite - GDPR has been onshored into UK law and in effect little changes. https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/information-rights-at-the-end-of-the-transition-period-frequently-asked-questions/ https://ico.org.uk/for-organisations/data-protection-at-the-...
  - Spearchucker 6y ago
    Note I said "possible". Your link specifically states "During the transition period the GDPR will continue to apply in the UK". That said, apparently they've just reached a deal, and the transition period ends in 7 days, so lets see what they decided about with data protection.
  - maest 6y ago
    Most EU laws are getting grandfathered in post Brexit, but the UK reserves the right to change them whenever they want. In essence, they've branched off their legal code from the EU bramch and can now commit changes to their orivate UK-only branch. GDPR rights will most likely get eroded in the UK.

tyingq 6y ago

That sounds like a weasel word version of "we can detect vehicle warranty status without using PII."

bagacrap 6y ago
I think they're saying they can't even tell if it's actually out of warranty, ie if you did buy the extended warranty you'd still see the popup.
- smarx007 6y ago
  Most likely they figured out that they are about to violate GDPR and altered the code to also show the notice to those who bought the extended warranty. I cannot imagine execs spending so much money on a project to shame both those who bought an extended warranty and those who didn't. In that case you can just put a static printed ad for the warranty.
  - deleted 6y ago
    [deleted]
avianlyric 6y ago
You can probably guess without using PII. In the UK numberplate info is public, you can look up the make, model year and colour of a car just using it's numberplate, and anyone can do this. Using that info it would be trivial to detect a BMW car that was older than X years old. Where X is number of years the normal non-extended warranty is. You then just assume that any car older than the non-extended warranty doesn't have an extended warranty and display the advert. Then the only thing the advert would be giving away is that there is a BMW nearby that older than X years. Which anyone with a pair of eyes could figure out because the numbers of UK numberplates encode the issue year (thus the age of the car), and well, BMW's are pretty easy to identify just by looking at them.
- itronitron 6y ago
  They could also not do the numberplate look up and achieve the same end result by posting a billboard that just says 'Don't buy a BMW'
floatingatoll 6y ago
The phrasing around "no vehicle data is stored or retained" implies that they're doing vehicle plate->VIN lookups in their database of cars manufactured and perhaps warranties issued, which as the manufacturer of said car they might well be correct to say that no PII is required. There's a missing piece of anti-targeting marketing legislation here, that GDPR won't cover under PII, even if it is eventually found that their plate lookup is a PII violation: Can the manufacturer of an object use their privately-held data about the object to target marketing to the bearer/operator/etc. of that object? Probably, yes, at least until a law is passed or a ruling is issued that states otherwise. The best short-term route of attack here would be on the plate->VIN conversion database, assuming that's what they're using anyways. But long-term, they'll figure out how to use a telephoto lens or LIDAR or paint-embedded QR codes to get VIN numbers somehow, so best to tackle the bigger problem too.

gambiting 6y ago

As I just said in another comment - they can figure it out without any private information. Licence plates are public and they are allowed to scan one with a camera, and they provide warranty on all BMW cars, so they know(and have the right to know) if a specific car is covered by them or not. They have all the iformation they need.

avianlyric 6y ago
You're not wrong about them in theory having all the data they need to identify out of warranty cars. But if they are legitimately identifying out of warranty cars (I suspect they're not), then that doesn't give them the right to publicly broadcast the information to the wider world. Which I suspect is the crux of this issue.
- gambiting 6y ago
  But again, it depends what sort of information is broadcast. If the bilboard says "hey, driver of BMW reg number EK16 WHD, your warranty is expired!" then that's definitely a problem. But if all that happens is a generic BMW warranty bilboard appears whenever an out-of-warranty car drives past "hey, is your BMW warranty expired? Extend today!" then it's probably ok legally.
  - csunbird 6y ago
    I mean, the next step after this feels like ads on the infotainment system.
    - netsharc 6y ago
      "Today's game: Candy Crush!". But in all seriousness, it would be easy to profile the driver. Is it close to dinner time? "Try out the hot new vegan restaurant, het 10% discount when you show your BMW key. 2 miles away, navigate there, Y/N?". Replace vegan with steak, etc, depending on the profile. Driving to a residential address in an expensive part of town around dinner time? "Last minute dinner party gift idea: blah blah wines. Shop is en-route, navigate there, Y/N?".

mannykannot 6y ago

With this announcement, I hope that, by by helpfully bringing to people's attention that information such as the warranty status of your car is publicly available [1], BMW will annoy a broader group of people than just BMW owners. [1] Assuming that they are not outright lying here when they say "only publically available information is used."

itronitron 6y ago
well, certainly the information is publicly available after it's used

Spearchucker 6y ago

This is possible now that Brexit has happened. Whether the UK will need to comply with GDPR or not is dependent on the deal Boris strikes with the EU, if indeed he ever does.

andylynch 6y ago
Not quite - GDPR has been onshored into UK law and in effect little changes. https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/information-rights-at-the-end-of-the-transition-period-frequently-asked-questions/ https://ico.org.uk/for-organisations/data-protection-at-the-...
- Spearchucker 6y ago
  Note I said "possible". Your link specifically states "During the transition period the GDPR will continue to apply in the UK". That said, apparently they've just reached a deal, and the transition period ends in 7 days, so lets see what they decided about with data protection.
- maest 6y ago
  Most EU laws are getting grandfathered in post Brexit, but the UK reserves the right to change them whenever they want. In essence, they've branched off their legal code from the EU bramch and can now commit changes to their orivate UK-only branch. GDPR rights will most likely get eroded in the UK.