An industry-wide initiative to strengthen data deletion practices in the used car and van sector is being backed by the Vehicle Remarketing Association (VRA).<\/p>\r\n\r\n\r\n\r\n
The new Data Deletion and Privacy Protection Certificate has been launched by the National Association of Motor Auctions (NAMA) and developed with input from auction operators, compliance experts, and technology providers.<\/p>\r\n\r\n\r\n\r\n
It addresses areas including data deletion procedures, auditability and reporting, operational workflows, and GDPR-aligned governance.<\/p>\r\n\r\n\r\n\r\n
Jonathan Butler, VRA legal counsel and partner at Geldards explained: \u201cLegal analysis and regulatory expectations make clear organisations handling vehicles \u2013 including rental, leasing, fleet and remarketing businesses \u2013 become data controllers for personal data stored in a vehicle once it returns to their possession.<\/p>\r\n\r\n\r\n\r\n
\u201cFailing to delete this data before the vehicle is passed to another user may constitute unlawful processing and a personal data breach, potentially contravening several articles of UK GDPR.<\/p>\r\n\r\n\r\n\r\n
\u201cThe new NAMA certificate provides the means for the automotive industry to take decisive action to protect consumer privacy as connected vehicle features continue to expand the volume of personal data stored in modern vehicles.\u201d<\/p>\r\n\r\n\r\n\r\n
VRA member Privacy4Cars has been named the first approved supplier under the initiative, following assessment of its data-deletion platform. The company met key requirements, ensuring that personally identifiable information and other sensitive data are removed from vehicles in a consistent and verifiable manner prior to resale.<\/p>\r\n\r\n\r\n\r\n
Philip Nothard, VRA chair, said: \u201cAs cars and vans incorporate more and more digital technology, the responsible management of the personal data stored in them is becoming an increasingly acute issue.<\/p>\r\n\r\n\r\n\r\n
\u201cFrom navigation histories and call logs to synced contacts and messages, modern vehicles routinely store sensitive information \u2013 and when those vehicles are returned, resold, or remarketed, that data frequently remains.<\/p>\r\n\r\n\r\n\r\n
\u201cFor all of those reasons, this NAMA initiative is timely and welcome. At the VRA, we are pleased to offer our support and are sure that it will also quickly find popularity among our members.\u201d<\/p>\r\n\r\n\r\n\r\n
Notes on vehicle data and the law for journalists<\/u><\/strong><\/p>\r\n\r\n\r\n\r\n Under UK GDPR, any organisation that determines the purposes and means of processing personal data becomes a data controller. When a rental, leasing, fleet, or remarketing business regains possession of a vehicle, it assumes control over the data stored within it.<\/p>\r\n\r\n\r\n\r\n Continuing to store or disclose that data without a lawful basis risks breaching:<\/p>\r\n\r\n\r\n\r\n \u2022 Article 5(1)(a) \u2013 lawfulness, fairness, transparency<\/p>\r\n\r\n\r\n\r\n \u2022 Article 5(1)(c) \u2013 data minimisation<\/p>\r\n\r\n\r\n\r\n \u2022 Article 5(1)(f) and Article 32 \u2013 security of processing<\/p>\r\n\r\n\r\n\r\n Passing a vehicle to another user without erasing the data may amount to unlawful processing and a personal data breach.<\/p>\r\n\r\n\r\n\r\n The ICO has the power to impose significant penalties for breaches of UK GDPR, with fines reaching up to \u00a317.5 million or 4% of global annual turnover \u2013 and reinforces this expectation.<\/p>\r\n\r\n\r\n\r\n Controllers must implement appropriate technical and organisational measures. Relying on customers or staff to remember to delete data is not compliant. Such an approach is not objective, repeatable, or auditable \u2013 and cannot reliably prevent unauthorised disclosure.<\/p>\r\n\r\n\r\n\r\n <\/p>\r\n","protected":false},"excerpt":{"rendered":"