The Industry's Leading Source For F&I, Sales And Technology

Article

GDPR Compliance: Minimize Your Exposure

The European Union’s General Data Protection Regulation has put U.S. auto dealers in the crosshairs.

May 2018, F&I and Showroom - WebXclusive

by Greg Sparrow

A European Union regulation governing data protection and privacy for EU citizens has profound implications for American auto dealers, many of whom are completely unaware of it. Photo by David Iliff via Wikimedia Commons
A European Union regulation governing data protection and privacy for EU citizens has profound implications for American auto dealers, many of whom are completely unaware of it. Photo by David Iliff via Wikimedia Commons

The General Data Protection Regulation is a new standard in European Union law concerning data protection and privacy for all individuals within the EU. The GDPR may appear to be an ocean away, but the effects it will have on your dealership are very real and more immediate than you may realize.

Since its inception, the GDPR has raised a number of questions as to whether businesses are properly prepared to comply. The GDPR was adopted on April 27, 2016, and allotted a two-year post-adoption grace period for businesses to strategize and implement their compliant approach. With less than one month left, an International Association of Privacy Professionals (IAPP) survey found that 61% of U.S. businesses are not ready for the regulation, and that only 67% of European-based businesses have begun moving into the implementation phase of their GDPR compliance program.

The potential fines have many concerned about compliance as the May 25, 2018, enforcement deadline approaches. But many dealers and other business owners struggle to fully understand the regulation and thus fail to launch a comprehensive plan.

The GDPR and You

American dealers are very much in the crosshairs here. Several automotive brands have displayed international influence not with the presence of dealerships in several nations but through international marketing efforts. A well-known example might include Porsche Holdings and its business of selling Volkswagen and Porsche cars throughout Central and Eastern Europe. Outside of the benefit of concrete locations near its customers, there is marketing data to be obtained through sales and marketing efforts. The utilization of this data is where automotive dealers may find difficulty with GDPR compliance.

The GDPR places the automotive business under scope not only through its presence in the European Union, but also due to its monitoring of EU data subjects and any attempt to offer them goods and services. Marketing practices most likely include the use of automated individual decisionmaking against EU data subjects, requiring explicit consent under the GDPR.

“Processing” is broadly defined in the regulation to include most actions that can be performed with data and can specifically refer to collection and storage — which dealerships, in this case, are likely doing. Therefore, dealers must have processes in place to honor nine distinct rights awarded to EU data subjects and be able to operate under the guiding privacy principles, defined within the GDPR.

The regulation further dictates appropriate security efforts around the protection of personal data, establishes breach reporting requirements, and increases the risk associated with vendors processing this data. These expansive requirements make the process of marketing and vendor outsourcing much more complex for anyone with a direct consumer relationship with EU data subjects.

Smaller, mom-and-pop-owned dealerships may not be considering the new regulations as seriously as they should be. Past actions point to enforcement risk even with these smaller companies. The GDPR states that noncompliant companies posing a risk to EU citizens and their privacy can be fined up to $20 million or 4% of their global turnover for the previous fiscal year, whichever is greatest. It is important to note that this fine can be assessed per violation.

First Steps for U.S. Dealers

There are several steps that dealers must immediately embark on to mitigate their exposure to risk. A solid start begins with understanding GDPR regulation applicability to various parts of the automotive business and each unit’s risk profile to establishing priorities for the initiative. Once risk and priorities have been identified, it is critical for organizations to identify and establish their lawful basis for processing of this data.

Every industry has its own unique risk and operational challenges, and every business within has its own maturity relative to industry peers. Using the trusted counsel of a dealer attorney or compliance firm helps to quickly identify both industry and organizational risk that, as a nonbiased third party, are often otherwise overlooked. A risk management and compliance consulting firm can help organizations quickly identify risk, formulate a plan to mitigate this risk, and setup ongoing monitoring programs to maintain valuable records of compliance.

Some have suggested the GDPR will set the global precedent for data privacy and security regulations. Brazil and China have both showed interest in forming similar requirements to protect the privacy of its citizens’ personal information from businesses storing and transferring data across borders.

To adequately prepare for the GDPR and similar regulations likely to be introduced in the future, businesses must begin educating themselves on these regulations, and how they will choose to conquer the requirements. Applicable processes and procedures can obviously help minimize exposure to fines, but also provide an opportunity within the market to reassure customers and, in return, earn their trust.

Greg Sparrow is senior vice president and general manager for CompliancePoint and has expertise in privacy, information security, and risk management.

Your Comment

Please note that comments may be moderated. 
Leave this field empty:
Your Name:  
Your Email:  

Blog

So Here's the Deal

Ronald J. Reahard
The Dealer Moved My Goal Posts

By Ronald J. Reahard
Top trainer has hard-earned advice — and a word of warning — for F&I pros whose dealers seem to change their pay plans every time they have a good month.

Addressing F&I’s Internet Problem

By Ronald J. Reahard
A frustrated F&I manager poses an increasingly common question: How do you sell protection products to customers who demand the final price by phone and then show up with a bank check?

(Video) Selling Eight Products Without Losing the Customer

By Ronald J. Reahard

He Had a Goal: Remembering David Ressler

By Ronald J. Reahard

Done Deal

Gregory Arroyo
The Repair Is Covered

By Gregory Arroyo
The editor opens up about his first service-contract claim, which resulted in a covered and repaired vehicle as well as a few lessons.

Change Is Happening

By Gregory Arroyo
Saddened by the potential loss of another piece of his childhood, the editor tries to put the pieces together when he realizes there’s a good lesson to be learned in a toy retailer’s likely demise.

Who Will Take Up the CFPB's Torch?

By Gregory Arroyo

Military Lending Act Guidance: The Gift That Keeps On Giving

By Gregory Arroyo

Mad Marv

Marv Eleazer
Is That Legal?

By Marv Eleazer
Is manipulating a sales agreement to accommodate a customer’s request to cash out of a dealer-arranged retail sales contract allowed? His Madness gets answers from the industry’s top legal mind.

Overcome Your F&I Weaknesses

By Marv Eleazer
His Madness issues a challenge to every F&I professional: Eradicate your bad work habits, diversify your lender spread, and check your God complex at the door.

Proper Deal Structure Moves Mountains

By Marv Eleazer

Show Us Some Love

By Marv Eleazer

On the Point

Jim Ziegler
Bound to Fail

By Jim Ziegler
Da Man returns with a message to vehicle manufacturers jumping into the subscription waters: It ain’t gonna happen.

Sharpen Your Survival Skills

By Jim Ziegler
‘Da Man’ has a plan you can use to survive the collapse of the car business and remain profitable through the dealer apocalypse.

Sales Rock Stars Still Exist

By Jim Ziegler

The New Stooges

By Jim Ziegler