Breach of GDPR

[RWilson]

Hi there,

Recently I complained to Peugeot about a long series of (some resolved and some ongoing) issues to do with a car I purchased from a dealership which is outright owned by Peugeot.

A Peugeot representative emailed me to inquire as to whether or not I would be okay with them sharing my concerns raised with the head of the dealership in question. I stated that because part of my complaint related to the head of the dealership, I did not want them to contact him in this regard.

Inadvertently, Peugeot seemingly ignored my response (they've admitted they received my response in time not to proceed) and emailed the head of the dealership, emailing me his response a couple of days later, which was pure fiction.

Extremely shocked that Peugeot had gone against my request, they apologised and advised the matter is being investigated internally. But this leaves me with a really bad taste in my mouth, owing to the fact that I will be taking my car in for service to the same dealership at least once a year for the free service plan I signed up for. I also have additional issues with my vehicle which currently remain unresolved.

I'm also pretty shocked that they ignored my request not to contact the head of the dealership and that they have just gone ahead and done this.

There are a number of other issues that have made me want to go down the route or pursuing the data protection breach, including:

- the dealership calling me to offer £500 to change the low-scored answers to a questionnaire I completed about the service received after a number of issues occurred during the sales process. They have since told Peugeot that it was, instead, a "goodwill gesture". Why would I turn down a £500 gesture of goodwill?! I wouldn't. What I would turn down is their unethical practice, though.

- being told an automatic stop-start function on my car which stopped working was expected to do so "as the car gets older" - it was 4 months off the production line at the time.

- the dealership pretending to have applied a £2,000 contribution deposit to the price of my car when they did not. Peugeot have agreed with the dealership that the deposit was included in the 'discount price' even through they are a bunch of liars.

Ultimately, I've been left extremely embarrassed by the GDPR breach and would like to press for compensation for this, as well as report them to the ICO.

Would anyone know how much I compensation I should request if asked?

Many thanks,

[R0b]

Where is the breach of GDPR? On what basis have they breached data protection?

Regardless of whether someone asked you if they could share details, it seems like a legitimate interest to contact the dealership to get their side of the story. How else could they seek to resolve it, take your word for it?

[2222]

I, and others, have not found that ICO do anything. It's a waste of time.

If you want to, you can bring your own action, but don't expect a large award. A few pounds, maybe.

Also, I am not even sure a breach has occurred, as Peugeot own the dealership.

If if you want to cause them some grief, talk to the local paper, perhaps. Try to get maximum publicity for your issues with the car, but don't waste your time over GDPR.

[RWilson]

Where is the breach of GDPR? On what basis have they breached data protection?

Regardless of whether someone asked you if they could share details, it seems like a legitimate interest to contact the dealership to get their side of the story. How else could they seek to resolve it, take your word for it?

According to the person I spoke to at the ICO, under the Principle of fair and lawful processing. I think they might know what they're talking about.

I'm not sure if you read my original post correctly, but part of the complaint related to the head of the dealership and they reached out to him to seek resolution in relation to this. I believe a better course of action would have been to reach out to the head office of the dealership - a separate entity of Peugeot - and someone less impartial.

[RWilson]

I, and others, have not found that ICO do anything. It's a waste of time.

If you want to, you can bring your own action, but don't expect a large award. A few pounds, maybe.

Also, I am not even sure a breach has occurred, as Peugeot own the dealership.

If if you want to cause them some grief, talk to the local paper, perhaps. Try to get maximum publicity for your issues with the car, but don't waste your time over GDPR.

Thanks for your response, 2222. Having spoken to the ICO, it appears they would simply send them a reminder of some sorts on how to process data fairly, so not much except a little nudge in the right direction.

A different entity of Peugeot owns the dealership, which is something I didn't mention, so this is where the ICO have stated they have breached GDPR.

Many thanks.

[R0b]

Well, I’m not so sure the person at the ICO is correct either and you would think they know what they are talking about but that person is probably only first line support - the really knowledgeable people are the ones higher up in the escalation chain. I don’t think they have breached the fair and lawful processing principle because there a 6 principles that only Peugeot need to satisfy in order to comply, one of which as I already pointed out is the purpose of a legitimate interest except where the interests or fundamental rights and freedoms override that interest does it not apply.

You’ve acknowledged that the Peugeot dealership entity and the other Peugeot entity are separate so your complaint should have really been addressed to the head office of that dealership in the first instance. Nevertheless I would still stand by my point that there is unlikely to be a breach of GDPR based on what you’ve said. Your complaint was sent to the wrong Peugeot entity, and they had a legitimate reason to contact the other entity (head of the dealership or head office I don’t think it would matter, even if it went to head office they would have on balance contacted the head of dealership) and that is one of the lawful processing principles under the GDPR. Refusing consent is not an automatic right for businesses to stop processing your data, legitimate interest is wide in scope and I think would be an acceptable defence in this case.

If you feel that’s not correct, why don’t you pursue your complaint and commence legal proceedings and let a court resolve it, if Peugeot don’t settle in the first instance? Personally, I don’t think you’d get very far with that argument because if your issues lie with the conduct of the dealership, then the Peugeot entity you had written to wouldn’t be aware of this unless it made inquiries, which I don’t think you can dictate how they carry out those inquiries. It might be worth seeking a reasonable sum of compensation for the distress and/or inconvenience caused but I wouldn’t set your expectations.

Out of curiosity, is the car on finance, hence writing to the other Peugeot entity and not the dealership? If yes, then they would be the correct entity to direct your complaint but doesn’t change anything else. Of course this is my opinion only and you are free to disregard it entirely.

[RWilson]

You’ve acknowledged that the Peugeot dealership entity and the other Peugeot entity are separate so your complaint should have really been addressed to the head office of that dealership in the first instance. Nevertheless I would still stand by my point that there is unlikely to be a breach of GDPR based on what you’ve said. Your complaint was sent to the wrong Peugeot entity, and they had a legitimate reason to contact the other entity (head of the dealership or head office I don’t think it would matter, even if it went to head office they would have on balance contacted the head of dealership) and that is one of the lawful processing principles under the GDPR. Refusing consent is not an automatic right for businesses to stop processing your data, legitimate interest is wide in scope and I think would be an acceptable defence in this case.

I didn't want to bog the forum down with too much information, but perhaps I missed adding something relevant, which was that I attempted to raise a complaint regarding my issues with the dealership's head office on several occasions to no avail. Therefore, I emailed the UK Chief Executive of Peugeot's executive team who took this on.


Nevertheless I would still stand by my point that there is unlikely to be a breach of GDPR based on what you’ve said. Your complaint was sent to the wrong Peugeot entity, and they had a legitimate reason to contact the other entity (head of the dealership or head office I don’t think it would matter, even if it went to head office they would have on balance contacted the head of dealership) and that is one of the lawful processing principles under the GDPR. Refusing consent is not an automatic right for businesses to stop processing your data, legitimate interest is wide in scope and I think would be an acceptable defence in this case.

I was actually unaware of any GDPR breach until Peugeot highlighted it to me. It was at this stage I contacted the ICO to inquire as to how my personal data had been breached. So, essentially, it has been confirmed by both Peugeot and the ICO. As I stated in response to your assumption of legitimacy in Peugeot contacting the head of the dealership, I would've thought that common sense should prevail and that they would not go directly to the person my complaint related to in order to resolve.


...why don’t you pursue your complaint and commence legal proceedings and let a court resolve it, if Peugeot don’t settle in the first instance? Personally, I don’t think you’d get very far with that argument because if your issues lie with the conduct of the dealership, then the Peugeot entity you had written to wouldn’t be aware of this unless it made inquiries, which I don’t think you can dictate how they carry out those inquiries. It might be worth seeking a reasonable sum of compensation for the distress and/or inconvenience caused but I wouldn’t set your expectations.


This is what I am currently considering, dependent on the response received from one of Peugeot's directors, which, I have been advised, will be forthcoming by the 16th of this month. I am looking to seek advice while I wait via this forum. My complaint is now twofold in the sense that, through initially complaining about the dealership to the Chief Executive of Peugeot UK, I have since had personal data divulged without my consent.

I should add that I am not trying to dictate how Peugeot's inquiries are carried out, I am simply looking for the inquirer to investigate my issue by using common sense; at the time, I was asked whether - 'for reasons of data protection' - I would be happy for Peugeot to share details of my complaint regarding the manager of the dealership with the same manager of the dealership, which was subsequently denied. Peugeot has since stated that they were wrong to do so and that they breached their data protection policy. The ICO has confirmed this.

[R0b]

There is a common misconception since the GDPR coming into force that businesses can't process an individual's data unless consent is given. I understand that someone at Peugeot has admitted a data breach but as far as I can tell, no data breach seems to have occurred. Whether or not they can withdraw that admission would be up to a Court to decide.

If your main concern is about getting the main issues resolved then you may want to sort that out first and then deal with the personal data issue afterwards.

P.s. just because the ICO might think Peugeot are in breach, doesn't mean to say a Court will agree - there have been examples of this before.