5 ms·

Just because you're crossing public data with data you own does not mean you are not breaking the law.

by oakfr 6y ago

gambiting 6y ago
Ok, but then I'm genuienly curious - which laws are being broken? Licence plates in the UK can be scanned by automated machines owned by private companies, that's been established many times before. To request the owner data from the DVLA you need their permission - but that's not necessary here, BMW doesn't need to know anything about the owner, so no such request would be made to the DVLA. Then on the other side, they have a database of cars that they sold and which are still under warranty - again, nothing about owners, none of the silo'ed personal information needs to be accessed at all. If the car is not on the "warranty==true" list, then they show the ad. I assume the ad doesn't display anything like "hey john smith, your warranty is expired!".
- astura 6y ago
  >nothing about owners, none of the silo'ed personal information needs to be accessed at all I mean, they probably don't even have that information for half the cars they scan because the warranty belongs to the car, not the person who bought the car. The warranty is transferred to the new owner if someone sells the car. They will not know the owner of all private used sales and used sales through 3rd party dealers.
  - gambiting 6y ago
    But...why does that matter? They know if a car with licence plate "GH13 JFG" is covered under warranty or not, because they know when they sold it. It doesn't matter if since then it got sold several times. I suppose it won't work any more if you put a custom plate on the car, but if you kept the one it was originally registered with then yeah, it doesn't matter if it's second hand or not.
- mordae 6y ago
  In EU, this would probably still violate GDPR. They need your consent to use any personal data (data about a person) for anything else than the core service they provide. Can the car license be tracked back to you? If yes, then anything attached to it is still personal. For example subscriptions or maintenance status. Can they use this information to deny you access to their services if the subscription expires? Yes! Can they call you that it's about to expire? Probably yes. Can they call you about this other service? No way! Can they publicly shame you? I'd sue them.
  - gambiting 6y ago
    Well, what "probably" happens is that whenever an out-of-warranty car is detected, they show a generic bilboard that says "hey, is your BMW out of warranty? Extend today!". Like I said, in the UK private companies are explicitly allowed to use AMPR machines to read licence plates(every supermarket in this country will have AMPR machines that record when you come and go). BMW just cross-references that with their own record to see if the car is under warranty or not - but like I said, they probably don't actually identify you in any way on the bilboard.
- oakfr 6y ago
  Here is a simple, troubling scenario with this product. You're going to a professional event with your boss. Each of you is driving their own car and your boss is following you. Now your boss knows you have an expired warranty, which, whether you like it or not, will reflect badly on your professional image. You may think this scenario is far-fetched, but it will happen regularly because people who know each other sometimes drive with each other. The same kind of stuff happens with highly personalized advertising on your laptop. All these things seem inoffensive but seriously violate user privacy and will (for sure) get people in trouble in the end.
- oakfr 6y ago
  The EU Charter of Fundamental Rights stipulates that EU citizens have the right to protection of their personal data. And the fact that you (the driver) have an expired warranty is private data. Period. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
  - gambiting 6y ago
    Well, UK citizens are no longer EU citizens. But surely, BMW also simply knows when they sold that specific car thanks to their own records, no? Like, imagine you were selling cameras, you sold someone a camera and then they come in to your store 5 years later with the same device - is it ok for you to ask "hey, this device has an expired warranty, would you like to extend it?" - you know this because as a seller, you have to keep a record of every device sold. You don't even need to know the owner or any personal information about them - you just know that the camera in front of you has an expired warranty. >> And the fact that you (the driver) have an expired warranty is private data. Well I think that's where the problem lies. It's not the driver who has an expired warranty - it's the car that does, and there's nothing you can do, EU or not, to prevent BMW from simply knowing that a car they sold at point X only had a warranty for 3 years. They don't need to know anything about the owner at all.

Just because you're crossing public data with data you own does not mean you are not breaking the law.

by oakfr 6y ago

Just because you're crossing public data with data you own does not mean you are not breaking the law.

Ok, but then I'm genuienly curious - which laws are being broken? Licence plates in the UK can be scanned by automated machines owned by private companies, that's been established many times before. To request the owner data from the DVLA you need their permission - but that's not necessary here, BMW doesn't need to know anything about the owner, so no such request would be made to the DVLA. Then on the other side, they have a database of cars that they sold and which are still under warranty - again, nothing about owners, none of the silo'ed personal information needs to be accessed at all. If the car is not on the "warranty==true" list, then they show the ad. I assume the ad doesn't display anything like "hey john smith, your warranty is expired!".

astura 6y ago
>nothing about owners, none of the silo'ed personal information needs to be accessed at all I mean, they probably don't even have that information for half the cars they scan because the warranty belongs to the car, not the person who bought the car. The warranty is transferred to the new owner if someone sells the car. They will not know the owner of all private used sales and used sales through 3rd party dealers.
- gambiting 6y ago
  But...why does that matter? They know if a car with licence plate "GH13 JFG" is covered under warranty or not, because they know when they sold it. It doesn't matter if since then it got sold several times. I suppose it won't work any more if you put a custom plate on the car, but if you kept the one it was originally registered with then yeah, it doesn't matter if it's second hand or not.
mordae 6y ago
In EU, this would probably still violate GDPR. They need your consent to use any personal data (data about a person) for anything else than the core service they provide. Can the car license be tracked back to you? If yes, then anything attached to it is still personal. For example subscriptions or maintenance status. Can they use this information to deny you access to their services if the subscription expires? Yes! Can they call you that it's about to expire? Probably yes. Can they call you about this other service? No way! Can they publicly shame you? I'd sue them.
- gambiting 6y ago
  Well, what "probably" happens is that whenever an out-of-warranty car is detected, they show a generic bilboard that says "hey, is your BMW out of warranty? Extend today!". Like I said, in the UK private companies are explicitly allowed to use AMPR machines to read licence plates(every supermarket in this country will have AMPR machines that record when you come and go). BMW just cross-references that with their own record to see if the car is under warranty or not - but like I said, they probably don't actually identify you in any way on the bilboard.
oakfr 6y ago
Here is a simple, troubling scenario with this product. You're going to a professional event with your boss. Each of you is driving their own car and your boss is following you. Now your boss knows you have an expired warranty, which, whether you like it or not, will reflect badly on your professional image. You may think this scenario is far-fetched, but it will happen regularly because people who know each other sometimes drive with each other. The same kind of stuff happens with highly personalized advertising on your laptop. All these things seem inoffensive but seriously violate user privacy and will (for sure) get people in trouble in the end.
oakfr 6y ago
The EU Charter of Fundamental Rights stipulates that EU citizens have the right to protection of their personal data. And the fact that you (the driver) have an expired warranty is private data. Period. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
- gambiting 6y ago
  Well, UK citizens are no longer EU citizens. But surely, BMW also simply knows when they sold that specific car thanks to their own records, no? Like, imagine you were selling cameras, you sold someone a camera and then they come in to your store 5 years later with the same device - is it ok for you to ask "hey, this device has an expired warranty, would you like to extend it?" - you know this because as a seller, you have to keep a record of every device sold. You don't even need to know the owner or any personal information about them - you just know that the camera in front of you has an expired warranty. >> And the fact that you (the driver) have an expired warranty is private data. Well I think that's where the problem lies. It's not the driver who has an expired warranty - it's the car that does, and there's nothing you can do, EU or not, to prevent BMW from simply knowing that a car they sold at point X only had a warranty for 3 years. They don't need to know anything about the owner at all.