Bsrhrki

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me off the garage's phone and emailed me off their work email but I have been busy with work so missed the call and forgot to email back. I received a text from an unknown number asking if I still wanted the car, I replied asking who it was to which he replied: "it's X from Windsor's lol".

To say I'm furious he got my personal details from their system to text me off his personal phone is an understatement, I just want to know if this is a breach in GDPR or anything like that. Receiving calls and emails from the garage are fine because that is their work environment but when someone goes onto that system to get my information and use it this way is unacceptable to me.

I am looking to take this further and would just like to know my options here because who knows how many other people he has done this to, I have been in touch with his manager but got the feeling he thought X was doing an outstanding job by hounding me in his personal time.

This is possibly but not necessarily fine.

The data controller (the garage) is responsible for safeguarding your personal data. They must take appropriate safety measures, but this depends a lot on their own risk assessment. For example, to protect the data from being used by employees for their personal purposes, the controller might use organizational measures like a policy “you're not allowed to do that.”

Many companies allow employees to use their personal devices for work purposes (BYOD). When the data controller allows this and takes appropriate safety measures, everything is perfectly fine. The company still has to make sure that the data is only processed for legal purses and deleted afterwards.

Implementing a BYOD policy in a GDPR compliant manner is difficult but not impossible.

A data breach has occurred when the security measures were insufficient and your data was deleted or disclosed without authorization. Your scenario would only be a breach if the company did not have a BYOD policy and the salesman used their personal phone, and arguably then only if that device is also breached. However, do not discount the alternatives:

• they do have a BYOD policy and the salesman is acting within their instructions


• the salesman was using a company-controlled device, not their personal phone

If you have good reason to believe that your data was mishandled (and these alternatives do not apply), then the GDPR offers you the following remedies:

• You can of course complain to the data controller, especially if they have a dedicated data protection officer.


• You can lodge a complaint with a supervision authority, which is the ICO in the UK. They expect you to attempt to resolve your issue with the controller first. The ICO can then decide if they want to investigate the issue.


• You can sue them for compliance and for actual damages suffered (you have none, though).

Note that all of these alternatives are more effort than they are likely worth. In particular, the garage can always correct the problem, e.g. by getting your contact info deleted from the personal device or by creating a retroactive BYOD policy.