It’s all about the data

5 October 2017  

It is pretty obvious to all of us that all sorts of organisations, companies and authorities want or need to know about our data, whether that is personal, business or security related. This is increasingly becoming a business issue as it impacts not just what data you need, but importantly, how you acquire, process, store and use data. This is both a threat and an opportunity.

A fundamental issue will now be that much of the data contained in the vehicle can also be considered personal data and is subject to data protection legislation. It is much more than just logging your customer’s contact details as you may have previously done. To help understand how this is linked together and how it can develop from being a liability to an asset, let’s look at how a typical repair workshop business should handle data.

Stored or measured
It starts when the customer contacts you and you log their personal name, address and contact details. When you start working on their vehicle, technical data is considered to be ‘machine generated data’ and current legal analysis considers that this does not belong to anyone – like the temperature of the air, it just exists. However, stored or measured data from the vehicle can contain details which can be considered as personal data (e.g. thickness of the brake pads, fuel consumption etc.) and it is then the use and storage of this data that is subject to significant new data protection regulations that must be complied with by May 2018.
Critically, the customer must give their consent to the use of this data by a positive action or statement; it cannot be just assumed.


GDPR
General Data Protection Regulation (GDPR) aims to ensure that data protection is a fundamental basic right and is regulated uniformly and consistently throughout Europe. This creates a legal framework for companies to operate in. Effectively, organisations may only collect the data that they specifically need for the purpose approved by the data subject (your customer). Therefore, these principles will result in a series of obligations for any company handling personal data from EU citizens, which are: ‘Privacy by design’ and ‘privacy by default’. This must be built into the way data is collected and managed. The controller (the company) must implement appropriate technical and organisational measures. The ‘right to be forgotten’ will help people better manage data protection risks online. Data controllers will be responsible to take all reasonable steps to inform third parties that are processing data, but the person may request that any links to or copy of that data is erased.

With the ‘data portability’ in the GDPR, users will also have the right to know about how their own data is being used and stored and be able to transfer personal data from one service provider to another. The right to data portability is primarily aimed at social media platforms, but would apply to all controllers and is likely to impose a significant burden.

Collected data falls into either structured (directly attributable to the person) or unstructured categories (e.g. information in an e-mail or indirectly linked). Different challenges are posed depending on which category the data falls into. The GDPR places accountability obligations on data controllers to demonstrate their compliance. This includes requiring them to maintain documentation, conduct a data protection impact assessment for higher risk processing, and implement data protection both by design and by default. Fines have been set at a maximum of 4% of turnover in the previous financial year, or £20m for major violations, whichever is the greater.

Handled and stored
Acquiring, processing and storing data are critically important clearly, but how do you ensure that this data is handle correctly and is stored securely? There are basic elements that must be implemented. Data storage areas must be secure, dry and fire-retardant. A filing system should be created that has referencing guidelines to retrieve documents if required by an authority. Once data no longer needs to be retained, it should be disposed of correctly, including shredding confidential documents. Data retention is a process which can become onerous, so make sure that your staff are up-to-date with any legal requirements and that they are clearly informed of their direct responsibility for their actions to ensure compliance with both your data handling policy and the requirements of the GDPR.

On a more positive side, data and information can be used internally in your own business to link to support services, such as technical information providers or the identification of spare parts that can help parts suppliers make more accurate deliveries of replacement parts, all helping to optimise your workshop efficiency.

Assuming your data handling policy is now in place and robust, how do you know what data is sensitive and requires protection, as opposed to data that is not directly related to a person and can be traded in the developing ‘data eco system’ economy? The data you have processed is only subject to the data privacy legislation if it can be linked to an individual, so ensuring that this link cannot exist allows data to be used more widely. For example, the registration number or vehicle identification number (VIN) could be linked back to the owner, but if the data from the vehicle, or the data being stored separates this information, then it remains ‘technical machine generated data’ that may still contain useful and valuable information that can be of benefit to your business.

Added value
There are an increasing number of organistaions who handle ‘big data’ and ‘data mine’ to help them provide services and forecast trends for various vehicle related services. Therefore, handled correctly, the data that is the basis of your workshop business can have an important added value, but only if processed and shared in compliance with the data regulations. Although you may see this new data legislation as a necessary evil, handled correctly, it can equally be the basis of a great new opportunity.
xenconsultancy.com