GDPR: Garages could be fined up to four per cent of turnover for non-compliance

Independent Garage Association reveals everything you need to know about General Data Protection Regulation

GDPR: Garages could be fined up to four per cent of turnover for non-compliance
Some of the most common GDPR myths have been corrected by the ICO and IGA.

Independent garages must be compliant with General Data Protection Regulation (GDPR) by May 25, 2018 or face a fine of up to four per cent of business turnover.

The warning has been highlighted by the Independent Garage Association (IGA) who say garages should now have received a ‘garage guide to GDPR’ through the post.

The IGA has summarised the most common myths surrounding compliance, as published by The Information Commissioner’s Office (ICO).


While it’s true that the ICO will have the power to impose fines much bigger than the £500,000 limit currently imposed by the Data Protection Act, the ICO says the new GDPR is about “putting the consumer and citizens first” and that issuing a fine is a last resort.

There are various sanctions that can help organisations comply, including warnings, reprimands and corrective orders and while they’re not economically damaging the reputation of the organisation may suffer as a result.

Personal data consent

“Consent under the current data protection law has always required a clear, affirmative action, the GDPR clarifies that pre-ticked opt in boxes are not indications of valid consent,” the ICO has said.

Under the GDPR, organisations must make it easy for people to withdraw their consent as well as using language that is clear and plain and organisations must ensure that consent previously obtained meets GDPR standards.

There are five other ways of processing data that, depending on the context, may be more appropriate than consent.

It is crucial that organisations document the decisions made to be able to demonstrate to the ICO the lawful basis use; data protection impact assessments can help in this case.

ICO formal guidance

The ICO is waiting until Europe-wide consent guidelines have been agreed before they publish their final guidance to ensure consistency.

However, they have already published a draft guidance on consent, which is unlikely to change significantly, and provides organisations with many of the tools needed.

Personal data breaches

It will be mandatory to report a personal data breach under the GDPR if there is a likelihood of a high risk to people’s rights and freedoms.

High risks include potential discrimination, damage to reputation, financial loss of any other significant economic or social disadvantage; organisations will need to report the breach to the affected individuals as well as the ICO.

The ICO will be able to advise on specific cases.

Organisations must report a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it.

Organisations must provide certain details when reporting, but if the organisation does not have all the details available, more can be provided later.

For more information about GDPR compliance, contact the Independent Garage Association on 0845 305 4230 or click “more details” below.

Home Page Forums GDPR: Garages could be fined up to four per cent of turnover for non-compliance

Viewing 22 posts - 1 through 22 (of 22 total)
  • Author
  • #151846 Reply
    Leon Thomas

    Independent garages must be compliant with General Data Protection Regulation (GDPR) by May 25, 2018 or face a fine of up to four per cent of business
    [See the full post at: GDPR: Garages could be fined up to four per cent of turnover for non-compliance]

    #151851 Reply

    As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at all

    #151855 Reply
    Howard Morris

    what are the guidelines for small businesses to comply with for the GDPR
    everyone who provides guidelines want to charge stupid prices for their services
    all we need to know is what are the rules
    so for us to stay within the law and not get fined no one knows what we are suppost to do
    in asking around other small businesses most are not even acknowledging the new rules

    #151860 Reply

    Stop scaremongering you will give most of us a heart attack.
    The regulation says applicable IF you have more than 250 employees, how many of us does that effect ?
    If you want scare the life out of us check the facts first.

    #151865 Reply

    “As a small garage, what data are we supposed to be afraid of losing, we don’t keep any records on line at all” This is nothing to do with data online specifically, it applies to all records whether in the invoicing software on your PC or even paper records in a filing cabinet.

    #151867 Reply

    The regulations only apply to a “small garage” with less than 250 employees IF you are processing “personal data” ie your processing information such as your customers religion. If your just raising an invoice with your VAT number on and their car details and address you are not processing personal data, merely carrying out your legal duties for tax collection and warranty validation that the car is being maintained to manufactures specification by using the correct oils and not the cheapest oils for instance. If they ask you to send a mot reminder that is fine as it is not processing personal data.
    If your over 250 employees you really should have a full time data protection officer which will be minimum £85k plus.

    #151891 Reply
    Monument Motors Wellington Ltd

    Our concerns are the same as already mentioned in the other comments. Why is there no guidance literature to say what we need to do if anything. Do we need to put some statement on our website stating that we are compliant, do you need a certificate to prove we are compliant, like you have taking card payments? There has been plenty of telling you about the changes but nothing to support the changes, unless you pay 100’s of pounds to somebody to tell you what is needed to put this in place. We have just paid out on the pension scheme what else will they come up with to get more money out of “The small business”.

    #151892 Reply

    If you only use paper invoices, have no employees, don’t keep a marketing mailing list and the only personal data you hold is that which is on invoices… I can understand this whole GDPR press coverage may seem a little OTT.

    Whether you realise or not, you have already undertaken your information audit and that audit has concluded that the only personal data you hold is that which is on your invoices. You now have to check the basis on which the processing of that data is lawful. There are 6 lawful bases under the GDPR. Keeping personal data on invoices will be covered by Article 6(b) which states:

    “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering not a contract”.

    In simple terms as you can’t sell this person a car without knowing who they are, you need that personal data to be able to enter into a contract with them and so you are fine to keep it.

    Further, you need to keep those invoices to prepare your accounts for HMRC. This brings in a further lawful basis covered by Article 6 (c) which states:

    “Processing is necessary for compliance with a legal obligation to which the controller is subject.”

    In simple terms you are legally required to keep accounting records for 6 years and so holding that data also meets Article 6(c) .

    In addition to needing a lawful basis for processing, you have an obligation to ensure the data is accurate and that you do not hold more information than is necessary. Data minimalisation is one of the 6 principles of the GDPR which are set out in Article 5. Article 5 (c) states that personal data shall be:

    “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”

    So, if your invoices ask for an email address but you never send emails, you should remove the box from your invoices to ensure you don’t keep hold of more information than you need.

    Finally, you need to ensure you don’t keep data for longer than is necessary and that you look after that data.

    In your case, you securely store your invoices in a locked filing cabinet. They are sent to your accountant by special delivery and returned in the same manner and then archived in your loft and then disposed of after 6 years by a registered data disposal company. This will all meet the GDPR standard and so as long as you continue with this business model, you will remain compliant.

    #151897 Reply

    We are glad some sense has appeared here since our blocked posting of yesterday.

    I will however again try to contribute to the discussion not with any comment as per yesterday but simply by posting an extract from the European Regulations.

    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)

    GDPR ST_5419_2016

    Brussels, 6 April 2016 (OR. en) 5419/16 DATAPROTECT 2 JAI 38 MI 25 DIGIT 21 DAPIX 9 FREMP 4 CODEC 52

    on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)


    Starting Line 12

    To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.

    Hopefully GarageWire will not censor this post or I will start to question whether it is worth reading anything.

    The Truth Is Out There

    #151898 Reply

    Does anybody have a view with regard to sending MOT reminders/special offers etc by email, SMS, post or using phone calls? This is where things seem to get trickier, does ‘legitimate interest’ apply to these activities as they are vital to retaining customers?

    #151899 Reply

    Its a good question Alan
    Our view is if the data relates to your business activity for the customer and does not include data such as “religion”, “sexual orientation” “NI number” etc, etc but contains data relating to Car Make, Model Reg Number so contact can be made for example when after doing an MOT where new parts were fitted and a recall is latter made and you need to contact them that is “business record keeping” and fine as long as you are below 250 employees.

    #151866 Reply

    “The regulation says applicable IF you have more than 250 employees” I don’t think that means you get away with it altogether.

    #152041 Reply

    well done alan

    #152042 Reply
    James Onions

    Thanks Bob,
    I’ve just asked Mike and Leon to look into the ‘blocked’ bit. We want to try and get some views on this one…
    It’s obviously a subject of interest, including to me as a business owner.
    Thanks for reference to the source material. Usefulas it does seem to have been a topic of scare-mongering, inevitably I guess, as service providers like training companies, consultants would tend to talk up the dangers to help sell their services.
    I’d guess legislators have bigger fish to fry but if ever asked then ‘What’s GDPR?’ is a much worse answer than ‘our policy is in this folder’.

    #152046 Reply
    Norma F itzpatrick

    Bob thank you for sharing that

    #152502 Reply

    Hi all, I’ve got some of advice here from Lawgistics which may prove useful. I’ll continue to do some more digging on this topic and will be publishing an article with some more answers for you shortly.

    We are advising our members on the standard they must achieve if they wish to rely on consent as their lawful basis for utilising personal data for direct marketing purposes. Direct marketing being defined in the current Data Protection Act as “the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.

    As a reminder Article 6 of the GDPR sets out 6 lawful bases for processing personal data:

    1. Consent
    2. Necessary for a contract with the individual
    3. Necessary for compliance of a legal obligation
    4. Necessary to protect interest of the data subject or another natural person
    5. Necessary for a public interest task or official duty
    6. Necessary for legitimate interests of the controller or a third party.

    While consent may seem the obvious basis for marketing activity, your pre-existing marketing databases may not meet the GDPR standard and so unless you want to do a Wetherspoons and scrap your entire marketing database, you will need to see if another base can apply. This is where ‘legitimate interests’ can come to your aid.

    We suspect ‘legitimate interest’ will be well used. The ICO will no doubt be making sure it is not overused. So what will work?

    Recital 47 of the GDPR specifically states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This is good news and could mean we can send out marketing under the lawful basis of legitimate interest. However, we need to balance this against the requirements of the Privacy and Electronic Communications Regulations (PECR) which deals with electronic

    PECR Regulation 22 requires that a company needs consent to send a marketing email unless;

    A) The recipient is an existing customer or potential customer who has previously made an enquiry for a product or service.
    B) The direct marketing is in respect to similar products and services only; and
    C) The recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and at the time of each subsequent communication.

    So companies will need to meet the GDPR criteria for consent to marketing unless it meets the above PECR criteria which is known as the ‘soft opt-in’ rule. The ‘soft op in’ means you can send marketing to your existing customers about similar products as long as you offered them the opportunity to opt-out when you first collected their details and you offer them to same opt-out opportunity in every subsequent marketing communication.

    So if you collected details from existing customers and had an opt out option, this marketing can continue under GDPR (using legitimate interest as the basis). But, you must comply with Article 21 of GDPR which gives customers the ‘right to object’ at any point.

    So, if you are a service and repair garage and you email existing customers prior to the anniversary of their car service to give them details of prices, then as long as you gave them the opportunity to opt-out when you took their details and state clearly in the email that they can opt-out at any time, you will be fine to continue emailing them every year. The same will apply if you send those customers details of similar services such as winter checks or MOT deals. Your GDPR lawful basis for processing is then legitimate interests (not consent as there is no opt-in, only an opt-out).

    However, if you haven’t been following the law in regard to email marketing already, then you are likely to need to start again and get consent when the customer first makes contact.

    #152889 Reply
    Simon Cook

    Hi Please to start with sorry to come across thick! I have read through the responses on here and am still none the wiser about my obligations as a business owner. I’ve got six staff we don’t send out digital marketing, we have a web site which is managed and has a very good organic presence through constant SEO. We send out written reminders for Service and Mot’s on a monthly basis, we take all major credit cards and hold our customer’s names and address on our data base as has always been normal. So this is quite simple nothing complicated what so ever! So please please help what do I have to do please.

    #152930 Reply
    katie haycock

    I’ve been reviewing the requirements and as a small garage with 5 employees I have completed the following:
    Carried out a data audit to work our what personal data we have
    Planned a training session/discussion with the staff so they understand about GDPR in the workshop – ie don’t leave personal details lying about
    Written a draft privacy notice outlining our lawful basis for GDPR (legitimate interests) and advising that customers can request us to delete historic data if required.
    I will be asking staff to check customers details each time they book in work to check our details are correct.

    I think that sort me just about. My area of query regards old data – ie previous customers and whether there is a requirement to delete their data. I have found advice which suggests you can put it beyond use – bit like archiving securely. The definition of beyond use is as follows:

    Data no longer required is put beyond use.

    We will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
    we will not give any other organisation access to the personal data;
    we will surround the personal data with appropriate technical and organisational security;
    we commit to permanent deletion of the information if requested by an individual

    In many ways I think it is all about getting your processes sorted to protect people’s data. Get a process in place and follow guidelines and I think micro businesses should be ok.

    #153100 Reply
    Leon Thomas

    Really, really happy with the conversations and questions being raised in this thread.

    Simon, Katie we’ll try and get an answer for you as soon as possible – if you think of any more questions please let us know.

    Leading on from what Katie said, what steps has everybody else taken to comply?

    #153218 Reply

    I went to a seminar on Tuesday about this and our obligations. A lot of this is Common sense really and things we should all be doing anyway when it comes to information security. For instance log in details on our PC’s, who has access? Login details to our booking systems are they protected and what are we doing to ensure that data cannot fall into the wrong hands by doing simple things like logging out of the systems at night and not leaving customer data lying around on our desks. Who holds our customer data? is it on a cloud? If so ask your provider for a privacy policy and keep a record of it, we must all have privacy policies and have them readily available. With regards to any marketing there must be a working opt out facility emphasis on the Working, most of us that send out reminders use a third party to do this so it will be their responsibility to make sure we have this facility. The interesting thing was I asked the lawyers were Reminders classed as marketing and in their opinion they were not providing you are just giving them a reminder not offering discounts etc as they are an existing customer that entered into a contract with you, however it would still be sensible to have an opt out button for reminders when you send them.

    #157658 Reply

    My husband has a garage. He works alone and I pop in twice a week to do some filing and cleaning.He does not do marketing. The only client details he has is name, address, phone numbers and car details. These are only used on the invoices. The details are kept on His computer. The paper invoice is given to the client. Could you please advise what we need to do? Thanks

    #158428 Reply
    val dootson

    Hi, so I’m assuming we have to draft some kind of statement saying how our business is dealing with GDPR? There are only 8 of us here so I’m just not sure how much of it applies to us. As far as our customers go, we have computer data base which holds just name, address and vehicle details. We don’t market at all, just send out reminders. As far as I’m aware we don’t do anything that GDPR is protecting the public from. Invoices are kept on the computer which has a password. Car sales invoices are written, but kept under loack and key for 6 years then burned. I could grumble about this for 6 years but whats the point. What a mess!!!

Viewing 22 posts - 1 through 22 (of 22 total)


Reply To: GDPR: Garages could be fined up to four per cent of turnover for non-compliance

Your email address will not be published. Required fields are marked *

Have your say!

1 1
Written by

Lost Password

Please enter your username or email address. You will receive a link to create a new password via email.

Sign Up