Winds of change in Canada are blowing when it comes to data privacy.

Quebec has been one of the first provinces to respond, passing Bill 64 in September of last year. This is the first European-Union-like privacy law, with massive fines, Andrea Amico and Mike Foster shared with Auto Remarketing Canada in May — both of whom will be speaking at the upcoming Canada’s Used Car Week.

Amico is the founder and CEO of Privacy4Cars, and Foster is the senior director of automotive sales at CARFAX Canada.

There is a “global warming in privacy,” the pair says. And Canada is heating up right along with it.

On a Federal level, Bill C-27 is data privacy legislation building momentum, which could drastically change the Canadian landscape for consumer data.

Increasing legislation is no surprise, considering the prevalence of data and personal data moved around in the auto landscape.

“It first became a bit of a bellwether in places like California, but more recently over the past maybe 18 months, we’re starting to see signals up here in Canada that are to a similar level of oversight, care and caution around privacy,” Foster said.

But the fact that the laws are changing is only part of the story.

Amico said, “The other part of the story is this is good for consumers. This is also potentially good for businesses if you are to embrace it.”

Dealers have the chance to develop a competitive advantage beyond simply just meeting data compliance regulations.

‘Hard drive on wheels’

There are a couple of ways dealers can tackle the changing data privacy winds.

“It’s no surprise and no secret to any of the dealers that vehicles today are just big hard drives on wheels … I don’t think any of them ignore the fact that they’ve got to take care of some of that data,” said Foster. “But more often than not, they don’t have the controls and the processes in place to do it on a very consistent basis.”

There’s lots of data and lots of important information that exists within dealership systems, relative to credit and personally identifiable information.

Ian Cruikshank, president and CEO at LEEDbox, said, “Being careful and setting up appropriate systems to manage that information is important.”

And establishing privacy procedures and processes at every level of the dealership is crucial, as well. Think clean-desk policies and locking computers when employees leave their desk. These policies work to help protect CRM data and any finance documents, like consumer credit reports.

Simple policies like that that have existed in corporate and banking environments for years.

“I’ve been to service departments where you see all sorts of customer data left behind,” said Amico. “People ‘live’ in their glove boxes. They tend to leave all sorts of data-heavy information in these when they sell or trade in their vehicle.”

Dealers also need to take action with their vendors and suppliers to ensure that  — downstream and upstream — they have a level of compliance and controls in place.

“Even if you’re just giving access to your accounts, you’re trusting your agency partners not to do anything malicious with that data. And there are brands out there where we’ve seen vendors do things like scrape the data or put it into an aggregator for their own purposes,” said Whitt Norrad, director of demand generation at FlexDealer and another session leader at the upcoming used-car event, in a recent interview with Auto Remarketing Canada. “It’s really about finding partners that you trust to work with. No dealership is just sort of in a silo where everything’s done in house.”

Data clearing in pre-owned vehicles

Over at Privacy4Cars, the company was involved in recent research with mystery shoppers to test some data privacy theories. All brands and provinces were represented in the mystery shopping project, where one hires consumers to go to a store and purchase a product, and then they are questioned on their experience.

The first thing the research showed was nine out of 10 consumers found data of the previous owners still in the vehicle they were test driving.

The consumers were asked: Who should be responsible for removing this data? Ninety-nine percent of consumers said it shouldn’t be their job. And 75% said the dealership — and potentially the manufacturer — should be collaborating together to get rid of the data from these pre-owned vehicles.

The mystery shoppers were also asked to test the knowledge of dealership associates about the capabilities of cars to collect, share and sell data.

“There’s a big gap in awareness,” said Amico. “And most importantly, zero out of 70 stores told consumers that the manufacturers actually have the right to share and sell this data.”

He doesn’t fault dealers.

“They’re just as uninformed as general consumers, probably because the OEMs have not invested in educating them in the first place,” Amico said. “They have received no materials, no education. They have no idea,” said Amico. “And so unfortunately, they say the wrong things on a regular basis.

“But it’s also an opportunity because we see there’s an incredible demand for consumers to want to learn more, and it actually creates the perfect positioning for dealerships,” Amico said.

He said on the wholesale side of the remarketing world, things are a bit different. Amico said wholesale always moves first, and there are a number of companies making clearing data a part of their normal process.

“We see wholesale moving quite fast actually on this, especially in the last four or five months,” Amico said, due in part to higher awareness.

“They do the same thing exactly over and over and over again. Hundreds and thousands of cars. It’s much easier to establish a pattern and a behavior if you’re doing it that repetitively,” Amico said.

Amico contends it’s time for dealers to follow suit.

“I always tell dealers, look, nothing good will ever come out of leaving somebody else’s phone number, addresses, garage codes, and other personal data in a car,” said Amico. “It literally takes minutes to remove it.”

Potential pitfalls & opportunities 

There may be some growing pains for dealers as privacy laws change and become stricter, but the good news is the legislative shift isn’t expected to happen overnight.

“I don’t think in Canada that the legislation is going to get teeth quickly,” said Foster. “I think it will take a little while for this to make its way down to the ground level where individual dealers might be held accountable, in terms of financial and other penalties.

“But the sooner you can get in front of it, and the sooner you can adopt it — the better,” he said.

If dealers do nothing, there are increasing risks. Ignoring this could denigrate the dealer’ brand with bad press and potentially bad customer reviews. And the ultimate punishment, of course, is growing fines and other penalties.

The large dealer groups will likely be targeted first.

“They have a broader swath of the market that legislators can address than individual rooftops,” said Foster. “But, eventually, the penalties will make their way down.”

There are a number of dealerships that are actually monetizing this opportunity, e.g. by partnering with Canadian company HeyAuto . Most used-car buyers and private sellers today want, or are going to want in the future, to see a certificate and/or some proof of data deletion in a pre-owned vehicle.

“Just the fact that it’s mandatory doesn’t mean that you cannot charge for it,” said Amico. “But again, if you’re a fast mover, you might get that opportunity. If you wait … I think your opportunities to turn this into value are going to be few.”

To ensure you don’t miss hearing from these and more thought leaders all across the industry speak on the latest trends, register today for Canada’s Used Car Week.