3 Data Extraction Levels

Transcription

1

2 3 Data Extraction Levels

3 DMS Level Data Extractors

4 Data Broker Extractors

5 3 rd Party Extractors

6 The Problems DMS unauthorized selling of dealer data to 3 rd parties Data broker extracts unauthorized data Brokers and 3 rd parties can distribute data to other 3 rd parties

7 Problems Dealer authorized data extraction cancels contract but does not stop extraction Brokers and 3 rd parties can sell distribute data to other 3 rd parties

8 Chain of Custody Dealer 8

9 Chain of Custody Dealer Data Broker 9

10 Chain of Custody Dealer Data Broker Thief? 10

11 What Is Really Happening Dealers are contractually agreeing to provide access to information that third parties have no right to receive use or disclose. Third parties are accessing proprietary information regarding dealership s inventory, pricing, sales and customers. Third parties are reserving the right to share dealers information with their affiliates. They take and use dealer information and require you to indemnify and hold them harmless.

12 Partial Solution North Carolina passed a law requiring DMS to disclose the data being pulled Falls short because it does not require the 3 rd parties to disclose.

13 Solutions Continued Define the Data that is needed with specificity Define the purposes for which the data may be used. Define who third parties may share the information with and limit the purposes for which it may be used or disclosed. Reserve the right to give third parties access to your data and take that access away. Work with your DMS provider to create dedicated tables

14 Solutions Continued Require third parties to provide a snapshot of the data they have taken within 24 or 48 hours of request. Require third parties to provide a snapshot of the data they have taken within 24 or 48 hours of request. Avoid giving access to social security numbers, credit scores and specific financial information.

15 Solution continued Read your Contract Determine broker associated with 3 rd Party Determine information being pulled.

16 Solution continued What liabilities does the 3 rd party hold the broker to. Understand how the data is being manipulated DMS providers must partner with dealers to control and audit.

17 The END

18 Protecting Customers and the Store

19 Perception Privacy is HIGH PROFILE It s hard to open the newspaper or listen to a TV report where some agency or other isn t suing some company over privacy or identity theft A hospital lap top is stolen A university releases student info by accident VISA service center computer hacked Google is misusing your personal information Facebook is misusing your personal information Governments and the Mass Media both operate in a market place just like your dealerships do Their market place is politics and the court of public opinion A good politician and a good reporter both run towards public grievances and try to bring solutions It s often to the Mass Media s benefit to cater to the fears and perceptions of the public at large. That s the way they make their money Result: People believe all their data is private

20 What Consumers Think is Protected By Law What is Protected By Law

21 Fair to say car dealers aren t currently in the cross hairs of government enforcement agencies In spite of the scare tactics of vendors - selling dealers every imaginable compliance package - claiming that FTC Enforcement boogiemen are lurking behind every door There are no reported enforcement actions against car dealers regarding any of the Facta Gramm Leach privacy or identity theft laws I ve never been able to document any investigation of a car dealer or even a visit to a car dealer over any of these laws. Note: No private lawsuits authorized The true risk in a dealership - Trusted person messes with your data Private lawsuits when there are real damages / typically associated with some misrepresentation that you ve made with how you share or protect data

22 So, do we ignore these laws? Of course not Do we ignore the needs and desires of our customers? Of course not Do we cavalierly pass on our hard earned business intelligence without a thought? Of course not We create a culture of security within our dealerships We adopt policies to comply with the laws We follow them We train We live it. We don t just pay lip service Why? Mostly: It s good business

23 Federal laws Non-Public personal information FTC privacy rule FTC safeguards rule Minnesota Data Security Act General causes of action Negligence Deceptive and misleading trade practice Contract issues Indemnification Confidentiality Limiting access Limit sharing by 3 rd parties Remedies

24 Crucial definition. I m going to be detailing the requirements of federal privacy laws sharing and safeguarding. These laws only apply to NPI NPI - General rule: Any information that you collect in conjunction with a consumer finance transaction or motor vehicle lease. Includes Name Address SSN Income Employer Banks Assets Fact of having entered into a finance or lease transaction Upstream data merged with covered financial information Excludes publically available information

25 The bosses wife owns a specialty jewelry store in town. The boss wants to export a mailing list of all of our customers who bought a new or used BMW, Audi or VW in the past year. He plans to give his wife the text file to create mailing labels for a mailer promoting a special sale at her store. Is the mailing list regulated information?

26 According to the Federal Trade Commission in an Automobile Dealer Privacy FAQ A list of all the retail customers who bought cars from you falls outside the Rule. The mailing list is not Non-Public Personal Information

27 Mostly same facts. The jewelry store owner spouse still wants to do the mailer. But she wants to personalize the mailer as follows: Congratulations on your recent [purchase \ lease] of a [year] [model] from Apex Motors. In order for the mail merge to work, the Boss wants to export a yes/no field differentiate records where the vehicle was leased or purchased. He wouldn't differentiate between purchases for cash or finance. Is the mailing list now NPI?

28 By including the Yes/No lease field, the entire file becomes subject to the federal privacy rule Here s the complete answer in the FTC FAQ: A list of all the retail customers who bought cars from you falls outside the Rule assuming that the list doesn t reveal how they paid for the car and isn t derived from any information about how their purchases were financed. However, if the list specifies which customers financed or leased their cars, it would be covered by the Rule. A list of people who applied to you to finance or lease a car would also be covered.

29 Sharing a list of finance customers? Sharing a list of customers who bought GAP? Sharing a list of customers who bought a service contract? Sharing finance penetration numbers with your sister store? Sharing finance prospects with sister store? Maybe try and resurrect dead deals?

30 Credit card numbers for cash deposits? Or in service & parts? Drivers license numbers? Perhaps photocopy? Ownership history of a vehicle?

31 Social security numbers Collected on a credit application? Collected to fill out IRS 8300? Collected to pull a bureau on a cash customer to clear OFAC One more time: Just because it s not NPI doesn t mean that you should be careless. If you carelessly release customer credit card numbers, you may not have violated the privacy laws. But as we ll see a little later, there are other means of recourse for an injured customer.

32 Must accurately reflect Types of personal information you collect Types of third parties with whom you share Affiliate Service provider Joint marketer Other non affiliates Right to opt out of certain types of sharing as provided by law How the dealership protects the confidentiality and security of personal information

33 Joint marketing agreement must be in writing Writing Required - Service Provider Exemption

34 You may be contractually agreeing to give information to third parties in a manner inconsistent with your stated privacy policy You may be allowing someone to extract info from you DMS thinking that it s not NPI but it is You may be relying on the exemption that the receiving vendor is marketing on your behalf but the deal with the purchasing customer creates a relationship with the vendor not you. You may be relying on the joint marketing agreement and in fact your partner is not another financial institution Service Provider Agreements The law requires a written agreement with the provider that prohibits the provider from sharing the non public personal information in any fashion except to carry out the marketing or administrative function for which you hired them Vendors may be improperly sharing information with their affiliates

35 The other big Federal privacy constraint Objectives Insure security and confidentiality of customer information Protect against anticipated threats and hazards Protect against unauthorized access Very importantly only applies to Non Public Personal Information Requires every dealership to have a written program which describes how it protects NPI

36 Any time a financial institution (you) lets an outsider (janitorial service, outside billing agency, DMS and others have access to NPI) Reasonable steps to select and retain Contractual provision to safeguard

37 Personal Information means an individual's first name or first initial and last name in combination with any one or more of the following data elements Social security number Driver's license number or identification card number Account number or credit or debit card number, in combination with any required security code Access code to permit access to an individual's financial account If there s a breach must give notice This is a big law that has important consequences However excludes financial institutions as defined in Gramm Leach. That s us. (Finally a benefit of being a financial institution)

38 Minnesota Data Privacy Not Covered Regulatory penalties for violations of Gramm Leach Bliley and FACTA $3500 per violation Injunctions Who have the actions been against? Major violations with lots of data loss Vendors report FTC audit and action against dealers, but I haven t been able to document it Consumer lawsuits for GLB and FACTA violations NO Consumer lawsuits Negligence No attorneys fees Misleading trade practice Attorneys fees We only share as follows We have safeguards FTC & Attorney General lawsuits Largely based on alleged misrepresentations in privacy policies

39 Read them For example, do you really want to allow ZAG to extract propriety information from your computers about your inventory, pricing, sales and customer? Look for mutuality Indemnification Clauses Remedies and limitation of action ZAG examples Privacy and safeguards compliance provisions Are they open to negotiation?

40 Define data that is needed with specificity Define purposes for which it can be used Work with DMS provider to get dedicated data structure for sharing Avoid access to SSN, credit scores and other clearly financial data

41 You re required to maintain a written policy which describes how you administer your company specific no call list Make sure any exports are consistent with this obligation

42 Web site privacy policies Not required to have them May be used against you Google Buzz litigation Web site pricing policies Do you really want to say this in writing: Fair, Competitive Pricing: Whether it s online, over the phone or at the dealership, ABC Motors provides up-front prices on all vehicles. Customers will feel at ease knowing that ABC won t play the frustrating back-andforth negotiating game when it comes to a vehicle s price. Prices listed include manufacturers incentives and maximum discounts everyone pays the same low price.

43 Jim Schutjer