This topic contains 21 replies, has 5 voices, and was last updated by val dootson 1 month, 3 weeks ago.
- February 6, 2018 at 11:31 am #151846
Independent garages must be compliant with General Data Protection Regulation (GDPR) by May 25, 2018 or face a fine of up to four per cent of business
[See the full post at: GDPR: Garages could be fined up to four per cent of turnover for non-compliance]February 6, 2018 at 12:22 pm #151851
As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at allFebruary 6, 2018 at 1:16 pm #151855
what are the guidelines for small businesses to comply with for the GDPR
everyone who provides guidelines want to charge stupid prices for their services
all we need to know is what are the rules
so for us to stay within the law and not get fined no one knows what we are suppost to do
in asking around other small businesses most are not even acknowledging the new rulesFebruary 6, 2018 at 1:54 pm #151860
Stop scaremongering you will give most of us a heart attack.
The regulation says applicable IF you have more than 250 employees, how many of us does that effect ?
If you want scare the life out of us check the facts first.February 6, 2018 at 2:50 pm #151865
“As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at all” This is nothing to do with data online specifically, it applies to all records whether in the invoicing software on your PC or even paper records in a filing cabinet.
February 6, 2018 at 3:20 pm #151867
- This reply was modified 5 months, 1 week ago by Mike Ruff, GW editor.
The regulations only apply to a “small garage” with less than 250 employees IF you are processing “personal data” ie your processing information such as your customers religion. If your just raising an invoice with your VAT number on and their car details and address you are not processing personal data, merely carrying out your legal duties for tax collection and warranty validation that the car is being maintained to manufactures specification by using the correct oils and not the cheapest oils for instance. If they ask you to send a mot reminder that is fine as it is not processing personal data.
If your over 250 employees you really should have a full time data protection officer which will be minimum £85k plus.February 7, 2018 at 12:19 pm #151891
Monument Motors Wellington Ltd
Our concerns are the same as already mentioned in the other comments. Why is there no guidance literature to say what we need to do if anything. Do we need to put some statement on our website stating that we are compliant, do you need a certificate to prove we are compliant, like you have taking card payments? There has been plenty of telling you about the changes but nothing to support the changes, unless you pay 100’s of pounds to somebody to tell you what is needed to put this in place. We have just paid out on the pension scheme what else will they come up with to get more money out of “The small business”.February 7, 2018 at 12:21 pm #151892
If you only use paper invoices, have no employees, don’t keep a marketing mailing list and the only personal data you hold is that which is on invoices… I can understand this whole GDPR press coverage may seem a little OTT.
Whether you realise or not, you have already undertaken your information audit and that audit has concluded that the only personal data you hold is that which is on your invoices. You now have to check the basis on which the processing of that data is lawful. There are 6 lawful bases under the GDPR. Keeping personal data on invoices will be covered by Article 6(b) which states:
“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering not a contract”.
In simple terms as you can’t sell this person a car without knowing who they are, you need that personal data to be able to enter into a contract with them and so you are fine to keep it.
Further, you need to keep those invoices to prepare your accounts for HMRC. This brings in a further lawful basis covered by Article 6 (c) which states:
“Processing is necessary for compliance with a legal obligation to which the controller is subject.”
In simple terms you are legally required to keep accounting records for 6 years and so holding that data also meets Article 6(c) .
In addition to needing a lawful basis for processing, you have an obligation to ensure the data is accurate and that you do not hold more information than is necessary. Data minimalisation is one of the 6 principles of the GDPR which are set out in Article 5. Article 5 (c) states that personal data shall be:
“adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”
So, if your invoices ask for an email address but you never send emails, you should remove the box from your invoices to ensure you don’t keep hold of more information than you need.
Finally, you need to ensure you don’t keep data for longer than is necessary and that you look after that data.
In your case, you securely store your invoices in a locked filing cabinet. They are sent to your accountant by special delivery and returned in the same manner and then archived in your loft and then disposed of after 6 years by a registered data disposal company. This will all meet the GDPR standard and so as long as you continue with this business model, you will remain compliant.February 7, 2018 at 2:12 pm #151897
We are glad some sense has appeared here since our blocked posting of yesterday.
I will however again try to contribute to the discussion not with any comment as per yesterday but simply by posting an extract from the European Regulations.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)
Brussels, 6 April 2016 (OR. en) 5419/16 DATAPROTECT 2 JAI 38 MI 25 DIGIT 21 DAPIX 9 FREMP 4 CODEC 52
REGULATION (EU) 2016/… OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Starting Line 12
To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.
Hopefully GarageWire will not censor this post or I will start to question whether it is worth reading anything.
The Truth Is Out ThereFebruary 7, 2018 at 2:36 pm #151898
Does anybody have a view with regard to sending MOT reminders/special offers etc by email, SMS, post or using phone calls? This is where things seem to get trickier, does ‘legitimate interest’ apply to these activities as they are vital to retaining customers?February 7, 2018 at 2:50 pm #151899
Its a good question Alan
Our view is if the data relates to your business activity for the customer and does not include data such as “religion”, “sexual orientation” “NI number” etc, etc but contains data relating to Car Make, Model Reg Number so contact can be made for example when after doing an MOT where new parts were fitted and a recall is latter made and you need to contact them that is “business record keeping” and fine as long as you are below 250 employees.February 8, 2018 at 3:27 pm #151866
“The regulation says applicable IF you have more than 250 employees” I don’t think that means you get away with it altogether.February 8, 2018 at 4:02 pm #152041
well done alanFebruary 8, 2018 at 4:13 pm #152042
I’ve just asked Mike and Leon to look into the ‘blocked’ bit. We want to try and get some views on this one…
It’s obviously a subject of interest, including to me as a business owner.
Thanks for reference to the source material. Usefulas it does seem to have been a topic of scare-mongering, inevitably I guess, as service providers like training companies, consultants would tend to talk up the dangers to help sell their services.
I’d guess legislators have bigger fish to fry but if ever asked then ‘What’s GDPR?’ is a much worse answer than ‘our policy is in this folder’.February 8, 2018 at 4:29 pm #152046
Norma F itzpatrick
Bob thank you for sharing thatFebruary 14, 2018 at 1:56 pm #152502
Mike Ruff, GW editorKeymaster
Hi all, I’ve got some of advice here from Lawgistics which may prove useful. I’ll continue to do some more digging on this topic and will be publishing an article with some more answers for you shortly.
We are advising our members on the standard they must achieve if they wish to rely on consent as their lawful basis for utilising personal data for direct marketing purposes. Direct marketing being defined in the current Data Protection Act as “the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.
As a reminder Article 6 of the GDPR sets out 6 lawful bases for processing personal data:
2. Necessary for a contract with the individual
3. Necessary for compliance of a legal obligation
4. Necessary to protect interest of the data subject or another natural person
5. Necessary for a public interest task or official duty
6. Necessary for legitimate interests of the controller or a third party.
While consent may seem the obvious basis for marketing activity, your pre-existing marketing databases may not meet the GDPR standard and so unless you want to do a Wetherspoons and scrap your entire marketing database, you will need to see if another base can apply. This is where ‘legitimate interests’ can come to your aid.
We suspect ‘legitimate interest’ will be well used. The ICO will no doubt be making sure it is not overused. So what will work?
Recital 47 of the GDPR specifically states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This is good news and could mean we can send out marketing under the lawful basis of legitimate interest. However, we need to balance this against the requirements of the Privacy and Electronic Communications Regulations (PECR) which deals with electronic
PECR Regulation 22 requires that a company needs consent to send a marketing email unless;
A) The recipient is an existing customer or potential customer who has previously made an enquiry for a product or service.
B) The direct marketing is in respect to similar products and services only; and
C) The recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and at the time of each subsequent communication.
So companies will need to meet the GDPR criteria for consent to marketing unless it meets the above PECR criteria which is known as the ‘soft opt-in’ rule. The ‘soft op in’ means you can send marketing to your existing customers about similar products as long as you offered them the opportunity to opt-out when you first collected their details and you offer them to same opt-out opportunity in every subsequent marketing communication.
So if you collected details from existing customers and had an opt out option, this marketing can continue under GDPR (using legitimate interest as the basis). But, you must comply with Article 21 of GDPR which gives customers the ‘right to object’ at any point.
So, if you are a service and repair garage and you email existing customers prior to the anniversary of their car service to give them details of prices, then as long as you gave them the opportunity to opt-out when you took their details and state clearly in the email that they can opt-out at any time, you will be fine to continue emailing them every year. The same will apply if you send those customers details of similar services such as winter checks or MOT deals. Your GDPR lawful basis for processing is then legitimate interests (not consent as there is no opt-in, only an opt-out).
However, if you haven’t been following the law in regard to email marketing already, then you are likely to need to start again and get consent when the customer first makes contact.February 23, 2018 at 9:03 am #152889
Hi Please to start with sorry to come across thick! I have read through the responses on here and am still none the wiser about my obligations as a business owner. I’ve got six staff we don’t send out digital marketing, we have a web site which is managed and has a very good organic presence through constant SEO. We send out written reminders for Service and Mot’s on a monthly basis, we take all major credit cards and hold our customer’s names and address on our data base as has always been normal. So this is quite simple nothing complicated what so ever! So please please help what do I have to do please.February 26, 2018 at 1:19 pm #152930
I’ve been reviewing the requirements and as a small garage with 5 employees I have completed the following:
Carried out a data audit to work our what personal data we have
Planned a training session/discussion with the staff so they understand about GDPR in the workshop – ie don’t leave personal details lying about
Written a draft privacy notice outlining our lawful basis for GDPR (legitimate interests) and advising that customers can request us to delete historic data if required.
I will be asking staff to check customers details each time they book in work to check our details are correct.
I think that sort me just about. My area of query regards old data – ie previous customers and whether there is a requirement to delete their data. I have found advice which suggests you can put it beyond use – bit like archiving securely. The definition of beyond use is as follows:
Data no longer required is put beyond use.
We will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
we will not give any other organisation access to the personal data;
we will surround the personal data with appropriate technical and organisational security;
we commit to permanent deletion of the information if requested by an individual
In many ways I think it is all about getting your processes sorted to protect people’s data. Get a process in place and follow guidelines and I think micro businesses should be ok.February 27, 2018 at 2:02 pm #153100
Really, really happy with the conversations and questions being raised in this thread.
Simon, Katie we’ll try and get an answer for you as soon as possible – if you think of any more questions please let us know.
Leading on from what Katie said, what steps has everybody else taken to comply?March 1, 2018 at 1:07 pm #153218
My husband has a garage. He works alone and I pop in twice a week to do some filing and cleaning.He does not do marketing. The only client details he has is name, address, phone numbers and car details. These are only used on the invoices. The details are kept on His computer. The paper invoice is given to the client. Could you please advise what we need to do? ThanksMay 21, 2018 at 12:21 pm #158428
Hi, so I’m assuming we have to draft some kind of statement saying how our business is dealing with GDPR? There are only 8 of us here so I’m just not sure how much of it applies to us. As far as our customers go, we have computer data base which holds just name, address and vehicle details. We don’t market at all, just send out reminders. As far as I’m aware we don’t do anything that GDPR is protecting the public from. Invoices are kept on the computer which has a password. Car sales invoices are written, but kept under loack and key for 6 years then burned. I could grumble about this for 6 years but whats the point. What a mess!!!