Hacker News Reader

Comment by floatingatoll | Hacker News Reader

Either BMW changed their mind or overstated what they’re doing, because they are on-record contradicting this story:

https://www.motoringresearch.com/car-news/bmw-targeted-warra...

BMW has told Motoring Research its targeted billboard warranty adverts – which are claimed to use number plate registration technology to tailor public adverts to BMW drivers – do not actually draw upon vehicle warranty status.

Rather, only publically available information is used. “There is no personalisation visible on the advert and no vehicle or customer data is stored or retained.”

“No personal identifiable information applicable to GDPR is used in the [Vehicle Detection Technology] process nor does VDT ever have access to any personal data.”

View on HN

That sounds like a weasel word version of "we can detect vehicle warranty status without using PII."

You can probably guess without using PII. In the UK numberplate info is public, you can look up the make, model year and colour of a car just using it's numberplate, and anyone can do this.

Using that info it would be trivial to detect a BMW car that was older than X years old. Where X is number of years the normal non-extended warranty is. You then just assume that any car older than the non-extended warranty doesn't have an extended warranty and display the advert.

Then the only thing the advert would be giving away is that there is a BMW nearby that older than X years. Which anyone with a pair of eyes could figure out because the numbers of UK numberplates encode the issue year (thus the age of the car), and well, BMW's are pretty easy to identify just by looking at them.

They could also not do the numberplate look up and achieve the same end result by posting a billboard that just says 'Don't buy a BMW'

I think they're saying they can't even tell if it's actually out of warranty, ie if you did buy the extended warranty you'd still see the popup.

Most likely they figured out that they are about to violate GDPR and altered the code to also show the notice to those who bought the extended warranty. I cannot imagine execs spending so much money on a project to shame both those who bought an extended warranty and those who didn't. In that case you can just put a static printed ad for the warranty.

The phrasing around "no vehicle data is stored or retained" implies that they're doing vehicle plate->VIN lookups in their database of cars manufactured and perhaps warranties issued, which as the manufacturer of said car they might well be correct to say that no PII is required. There's a missing piece of anti-targeting marketing legislation here, that GDPR won't cover under PII, even if it is eventually found that their plate lookup is a PII violation:

Can the manufacturer of an object use their privately-held data about the object to target marketing to the bearer/operator/etc. of that object?

Probably, yes, at least until a law is passed or a ruling is issued that states otherwise. The best short-term route of attack here would be on the plate->VIN conversion database, assuming that's what they're using anyways. But long-term, they'll figure out how to use a telephoto lens or LIDAR or paint-embedded QR codes to get VIN numbers somehow, so best to tackle the bigger problem too.

With this announcement, I hope that, by by helpfully bringing to people's attention that information such as the warranty status of your car is publicly available [1], BMW will annoy a broader group of people than just BMW owners.

[1] Assuming that they are not outright lying here when they say "only publically available information is used."

well, certainly the information is publicly available after it's used

As I just said in another comment - they can figure it out without any private information. Licence plates are public and they are allowed to scan one with a camera, and they provide warranty on all BMW cars, so they know(and have the right to know) if a specific car is covered by them or not. They have all the iformation they need.

You're not wrong about them in theory having all the data they need to identify out of warranty cars. But if they are legitimately identifying out of warranty cars (I suspect they're not), then that doesn't give them the right to publicly broadcast the information to the wider world. Which I suspect is the crux of this issue.

But again, it depends what sort of information is broadcast. If the bilboard says "hey, driver of BMW reg number EK16 WHD, your warranty is expired!" then that's definitely a problem. But if all that happens is a generic BMW warranty bilboard appears whenever an out-of-warranty car drives past "hey, is your BMW warranty expired? Extend today!" then it's probably ok legally.

I mean, the next step after this feels like ads on the infotainment system.

"Today's game: Candy Crush!".

But in all seriousness, it would be easy to profile the driver. Is it close to dinner time? "Try out the hot new vegan restaurant, het 10% discount when you show your BMW key. 2 miles away, navigate there, Y/N?". Replace vegan with steak, etc, depending on the profile.

Driving to a residential address in an expensive part of town around dinner time? "Last minute dinner party gift idea: blah blah wines. Shop is en-route, navigate there, Y/N?".

Not private, personal.

My name is in the phone book, therefore public.

It is also personally identifiable information and protected by European law.

That said, processing this data is legal, but you are missing an important distinction in your logic as it relates to data protection laws.

Whether courts agree that broadcasting this information is legal.. we shall see.

> Licence plates are public and they are allowed to scan one with a camera,

CCTV cameras that record public areas need to be registered with ICO.

This is possible now that Brexit has happened. Whether the UK will need to comply with GDPR or not is dependent on the deal Boris strikes with the EU, if indeed he ever does.

Not quite - GDPR has been onshored into UK law and in effect little changes.

https://ico.org.uk/for-organisations/data-protection-at-the-...

Note I said "possible". Your link specifically states "During the transition period the GDPR will continue to apply in the UK".

That said, apparently they've just reached a deal, and the transition period ends in 7 days, so lets see what they decided about with data protection.

Most EU laws are getting grandfathered in post Brexit, but the UK reserves the right to change them whenever they want. In essence, they've branched off their legal code from the EU bramch and can now commit changes to their orivate UK-only branch.

GDPR rights will most likely get eroded in the UK.

Reply on news.ycombinator.com