GDPR: Garages could be fined up to four per cent of turnover for non-compliance

Independent Garage Association reveals everything you need to know about General Data Protection Regulation

GDPR: Garages could be fined up to four per cent of turnover for non-compliance
Some of the most common GDPR myths have been corrected by the ICO and IGA.

Independent garages must be compliant with General Data Protection Regulation (GDPR) by May 25, 2018 or face a fine of up to four per cent of business turnover.

The warning has been highlighted by the Independent Garage Association (IGA) who say garages should now have received a ‘garage guide to GDPR’ through the post.

The IGA has summarised the most common myths surrounding compliance, as published by The Information Commissioner’s Office (ICO).

Fines

While it’s true that the ICO will have the power to impose fines much bigger than the £500,000 limit currently imposed by the Data Protection Act, the ICO says the new GDPR is about “putting the consumer and citizens first” and that issuing a fine is a last resort.

There are various sanctions that can help organisations comply, including warnings, reprimands and corrective orders and while they’re not economically damaging the reputation of the organisation may suffer as a result.

Personal data consent

“Consent under the current data protection law has always required a clear, affirmative action, the GDPR clarifies that pre-ticked opt in boxes are not indications of valid consent,” the ICO has said.

Under the GDPR, organisations must make it easy for people to withdraw their consent as well as using language that is clear and plain and organisations must ensure that consent previously obtained meets GDPR standards.

There are five other ways of processing data that, depending on the context, may be more appropriate than consent.

It is crucial that organisations document the decisions made to be able to demonstrate to the ICO the lawful basis use; data protection impact assessments can help in this case.

ICO formal guidance

The ICO is waiting until Europe-wide consent guidelines have been agreed before they publish their final guidance to ensure consistency.

However, they have already published a draft guidance on consent, which is unlikely to change significantly, and provides organisations with many of the tools needed.

Personal data breaches

It will be mandatory to report a personal data breach under the GDPR if there is a likelihood of a high risk to people’s rights and freedoms.

High risks include potential discrimination, damage to reputation, financial loss of any other significant economic or social disadvantage; organisations will need to report the breach to the affected individuals as well as the ICO.

The ICO will be able to advise on specific cases.

Organisations must report a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it.

Organisations must provide certain details when reporting, but if the organisation does not have all the details available, more can be provided later.

For more information about GDPR compliance, contact the Independent Garage Association on 0845 305 4230 or click “more details” below.

Home Page Forums GDPR: Garages could be fined up to four per cent of turnover for non-compliance

This topic contains 15 replies, has 4 voices, and was last updated by  Mike Ruff, GW editor 6 days, 13 hours ago.

Viewing 15 posts - 1 through 15 (of 15 total)
  • Author
    Posts
  • #151851 Reply

    HAROLD

    As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at all

    #151855 Reply

    Howard Morris

    what are the guidelines for small businesses to comply with for the GDPR
    everyone who provides guidelines want to charge stupid prices for their services
    all we need to know is what are the rules
    so for us to stay within the law and not get fined no one knows what we are suppost to do
    in asking around other small businesses most are not even acknowledging the new rules

    #151860 Reply

    Bob

    Stop scaremongering you will give most of us a heart attack.
    The regulation says applicable IF you have more than 250 employees, how many of us does that effect ?
    If you want scare the life out of us check the facts first.

    #151865 Reply

    alan

    “As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at all” This is nothing to do with data online specifically, it applies to all records whether in the invoicing software on your PC or even paper records in a filing cabinet.

    #151867 Reply

    Bob

    The regulations only apply to a “small garage” with less than 250 employees IF you are processing “personal data” ie your processing information such as your customers religion. If your just raising an invoice with your VAT number on and their car details and address you are not processing personal data, merely carrying out your legal duties for tax collection and warranty validation that the car is being maintained to manufactures specification by using the correct oils and not the cheapest oils for instance. If they ask you to send a mot reminder that is fine as it is not processing personal data.
    If your over 250 employees you really should have a full time data protection officer which will be minimum £85k plus.

    #151891 Reply

    Monument Motors Wellington Ltd

    Our concerns are the same as already mentioned in the other comments. Why is there no guidance literature to say what we need to do if anything. Do we need to put some statement on our website stating that we are compliant, do you need a certificate to prove we are compliant, like you have taking card payments? There has been plenty of telling you about the changes but nothing to support the changes, unless you pay 100’s of pounds to somebody to tell you what is needed to put this in place. We have just paid out on the pension scheme what else will they come up with to get more money out of “The small business”.

    #151892 Reply

    LawJaw

    If you only use paper invoices, have no employees, don’t keep a marketing mailing list and the only personal data you hold is that which is on invoices… I can understand this whole GDPR press coverage may seem a little OTT.

    Whether you realise or not, you have already undertaken your information audit and that audit has concluded that the only personal data you hold is that which is on your invoices. You now have to check the basis on which the processing of that data is lawful. There are 6 lawful bases under the GDPR. Keeping personal data on invoices will be covered by Article 6(b) which states:

    “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering not a contract”.

    In simple terms as you can’t sell this person a car without knowing who they are, you need that personal data to be able to enter into a contract with them and so you are fine to keep it.

    Further, you need to keep those invoices to prepare your accounts for HMRC. This brings in a further lawful basis covered by Article 6 (c) which states:

    “Processing is necessary for compliance with a legal obligation to which the controller is subject.”

    In simple terms you are legally required to keep accounting records for 6 years and so holding that data also meets Article 6(c) .

    In addition to needing a lawful basis for processing, you have an obligation to ensure the data is accurate and that you do not hold more information than is necessary. Data minimalisation is one of the 6 principles of the GDPR which are set out in Article 5. Article 5 (c) states that personal data shall be:

    “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”

    So, if your invoices ask for an email address but you never send emails, you should remove the box from your invoices to ensure you don’t keep hold of more information than you need.

    Finally, you need to ensure you don’t keep data for longer than is necessary and that you look after that data.

    In your case, you securely store your invoices in a locked filing cabinet. They are sent to your accountant by special delivery and returned in the same manner and then archived in your loft and then disposed of after 6 years by a registered data disposal company. This will all meet the GDPR standard and so as long as you continue with this business model, you will remain compliant.

    #151897 Reply

    Bob

    We are glad some sense has appeared here since our blocked posting of yesterday.

    I will however again try to contribute to the discussion not with any comment as per yesterday but simply by posting an extract from the European Regulations.

    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)

    GDPR ST_5419_2016

    Brussels, 6 April 2016 (OR. en) 5419/16 DATAPROTECT 2 JAI 38 MI 25 DIGIT 21 DAPIX 9 FREMP 4 CODEC 52

    REGULATION (EU) 2016/… OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
    of
    on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

    (13)

    Starting Line 12

    To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.

    Hopefully GarageWire will not censor this post or I will start to question whether it is worth reading anything.

    The Truth Is Out There

    #151898 Reply

    alan

    Does anybody have a view with regard to sending MOT reminders/special offers etc by email, SMS, post or using phone calls? This is where things seem to get trickier, does ‘legitimate interest’ apply to these activities as they are vital to retaining customers?

    #151899 Reply

    Bob

    Its a good question Alan
    Our view is if the data relates to your business activity for the customer and does not include data such as “religion”, “sexual orientation” “NI number” etc, etc but contains data relating to Car Make, Model Reg Number so contact can be made for example when after doing an MOT where new parts were fitted and a recall is latter made and you need to contact them that is “business record keeping” and fine as long as you are below 250 employees.

    #151866 Reply

    alan

    “The regulation says applicable IF you have more than 250 employees” I don’t think that means you get away with it altogether.

    #152041 Reply

    Bob

    well done alan

    #152042 Reply

    James Onions
    Keymaster

    Thanks Bob,
    I’ve just asked Mike and Leon to look into the ‘blocked’ bit. We want to try and get some views on this one…
    It’s obviously a subject of interest, including to me as a business owner.
    Thanks for reference to the source material. Usefulas it does seem to have been a topic of scare-mongering, inevitably I guess, as service providers like training companies, consultants would tend to talk up the dangers to help sell their services.
    I’d guess legislators have bigger fish to fry but if ever asked then ‘What’s GDPR?’ is a much worse answer than ‘our policy is in this folder’.

    #152046 Reply

    Norma F itzpatrick

    Bob thank you for sharing that

    #152502 Reply

    Hi all, I’ve got some of advice here from Lawgistics which may prove useful. I’ll continue to do some more digging on this topic and will be publishing an article with some more answers for you shortly.

    We are advising our members on the standard they must achieve if they wish to rely on consent as their lawful basis for utilising personal data for direct marketing purposes. Direct marketing being defined in the current Data Protection Act as “the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.

    As a reminder Article 6 of the GDPR sets out 6 lawful bases for processing personal data:

    1. Consent
    2. Necessary for a contract with the individual
    3. Necessary for compliance of a legal obligation
    4. Necessary to protect interest of the data subject or another natural person
    5. Necessary for a public interest task or official duty
    6. Necessary for legitimate interests of the controller or a third party.

    While consent may seem the obvious basis for marketing activity, your pre-existing marketing databases may not meet the GDPR standard and so unless you want to do a Wetherspoons and scrap your entire marketing database, you will need to see if another base can apply. This is where ‘legitimate interests’ can come to your aid.

    We suspect ‘legitimate interest’ will be well used. The ICO will no doubt be making sure it is not overused. So what will work?

    Recital 47 of the GDPR specifically states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This is good news and could mean we can send out marketing under the lawful basis of legitimate interest. However, we need to balance this against the requirements of the Privacy and Electronic Communications Regulations (PECR) which deals with electronic
    marketing.

    PECR Regulation 22 requires that a company needs consent to send a marketing email unless;

    A) The recipient is an existing customer or potential customer who has previously made an enquiry for a product or service.
    B) The direct marketing is in respect to similar products and services only; and
    C) The recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and at the time of each subsequent communication.

    So companies will need to meet the GDPR criteria for consent to marketing unless it meets the above PECR criteria which is known as the ‘soft opt-in’ rule. The ‘soft op in’ means you can send marketing to your existing customers about similar products as long as you offered them the opportunity to opt-out when you first collected their details and you offer them to same opt-out opportunity in every subsequent marketing communication.

    So if you collected details from existing customers and had an opt out option, this marketing can continue under GDPR (using legitimate interest as the basis). But, you must comply with Article 21 of GDPR which gives customers the ‘right to object’ at any point.

    So, if you are a service and repair garage and you email existing customers prior to the anniversary of their car service to give them details of prices, then as long as you gave them the opportunity to opt-out when you took their details and state clearly in the email that they can opt-out at any time, you will be fine to continue emailing them every year. The same will apply if you send those customers details of similar services such as winter checks or MOT deals. Your GDPR lawful basis for processing is then legitimate interests (not consent as there is no opt-in, only an opt-out).

    However, if you haven’t been following the law in regard to email marketing already, then you are likely to need to start again and get consent when the customer first makes contact.

Viewing 15 posts - 1 through 15 (of 15 total)

LEAVE A REPLY:

Reply To: GDPR: Garages could be fined up to four per cent of turnover for non-compliance

Your email address will not be published. Required fields are marked *

Have your say!

0 1
Written by

Lost Password

Please enter your username or email address. You will receive a link to create a new password via email.