Independent garages must be compliant with General Data Protection Regulation (GDPR) by May 25, 2018 or face a fine of up to four per cent of business turnover.
The warning has been highlighted by the Independent Garage Association (IGA) who say garages should now have received a ‘garage guide to GDPR’ through the post.
The IGA has summarised the most common myths surrounding compliance, as published by The Information Commissioner’s Office (ICO).
While it’s true that the ICO will have the power to impose fines much bigger than the £500,000 limit currently imposed by the Data Protection Act, the ICO says the new GDPR is about “putting the consumer and citizens first” and that issuing a fine is a last resort.
There are various sanctions that can help organisations comply, including warnings, reprimands and corrective orders and while they’re not economically damaging the reputation of the organisation may suffer as a result.
Personal data consent
“Consent under the current data protection law has always required a clear, affirmative action, the GDPR clarifies that pre-ticked opt in boxes are not indications of valid consent,” the ICO has said.
Under the GDPR, organisations must make it easy for people to withdraw their consent as well as using language that is clear and plain and organisations must ensure that consent previously obtained meets GDPR standards.
There are five other ways of processing data that, depending on the context, may be more appropriate than consent.
It is crucial that organisations document the decisions made to be able to demonstrate to the ICO the lawful basis use; data protection impact assessments can help in this case.
ICO formal guidance
The ICO is waiting until Europe-wide consent guidelines have been agreed before they publish their final guidance to ensure consistency.
However, they have already published a draft guidance on consent, which is unlikely to change significantly, and provides organisations with many of the tools needed.
Personal data breaches
It will be mandatory to report a personal data breach under the GDPR if there is a likelihood of a high risk to people’s rights and freedoms.
High risks include potential discrimination, damage to reputation, financial loss of any other significant economic or social disadvantage; organisations will need to report the breach to the affected individuals as well as the ICO.
The ICO will be able to advise on specific cases.
Organisations must report a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it.
Organisations must provide certain details when reporting, but if the organisation does not have all the details available, more can be provided later.
For more information about GDPR compliance, contact the Independent Garage Association on 0845 305 4230 or click “more details” below.