XSeries-forum

I've just had yet another call from yet another claim-line. The usual patter - an Asian gentleman introducing himself with a very Anglo-Saxon name. And, as usual, he wouldn't take no for an answer. I suppose that's kind-of understandable because the company he represents will be getting a significant proportion of any reparation they obtain for their clients - despite protestations that it is a free service.

As is also usual, I ended-up hanging-up on him. Hanging-up is something I rarely do, because - for one thing - it's b****y rude and I dislike it when it's done to me.

But I asked myself afterwards, where do they get the information that links my car registration and my full name and full address AND our 'phone number? The only answer I can come-up with is either the dealership group where my car has been for recalls, or BMWUK. I'm fairly certain it won't be DVLA, because as far as I know they won't randomly release registered keeper details, and they don't have my 'phone number.

So, chaps, do you think it's ethical for BMWUK, or their dealers, to be selling (presumably) customer's contact details?? .......Particularly in the age of GDPR?

Possibly from one of the price comparison websites if you have ever entered your details for an insurance quote.
I would think its very unlikely BMWUK would provide that info, possibly a dealer depending on who actually manages their data.

DVLA do supply information as a paid service, however there are very specific circumstances that apply. These are listed here:

https://www.gov.uk/request-information- ... red-keeper

So, it might be worth making a Freedom of Information Act (FOIA) request to DVSA/DVLA to identify if they have supplied your vehicle details to anyone, and if so under what circumstances. DVLA are not exempt from FOIAs as far as I know. You may have to state that you are investigating a data breach or fraudulent activity. Ideally you also need to know who called you. The ICO (see next para) will need that too.

Given that access requests are made in writing, on a form and must be paid for, there will be a record. If it turns out the subject access request was fraudulent then it becomes an incident for the Information Commissioner’s Office and they can take action against the third party (or the DVLA if they failed to follow process). If identified and found guilty then large fines can be issued by the ICO.

I think that it is unlikely that BMW will have supplied that data without a warrant (or that should be the process) unless there is an inside leak. Two ex-members (now) of the RAC have just been prosecuted for supplying details to ambulance chasers so it is possible, but unlikely. An access request into DVLA would be my guess. A dealer will need your specific and written consent to offer your data for sale. As you rightly say, that might be a breach of the UK GDPR or Data Protection Act 2018.

Thanks, X5Sport.