A whistleblower in the auto sales industry says car dealers may be violating customers' privacy rights when they take a test drive.
Kurtis Lemon says he quit his job as a salesman at Dueck GM’s Marine Drive location in Vancouver because he wasn't comfortable following a new procedure to scan customers’ licences.
The 27-year-old says car dealers are collecting customers’ information, including their addresses and birthdates under the guise of needing it for a test drive, when what they are really doing is building a database for marketing purposes.
"I think it’s wrong because the car dealerships are still running off of the 70s and 80s models," said Lemon, referring to what he perceives as outdated sales practices.
Lemon says Dueck GM scans drivers’ licence data and imports it directly into a new software program called DealerMine, a customer relationship management or CRM tool, that helps dealers track and market to customers.
According to DealerMine's website, it can "track leads, enforce your sales process and measure the effectiveness of your team," and help dealers "market to customers that are ready to purchase and connect with them any way you choose."
"These new photo licence scanners are taking that info and they are directly taking the address and the height and age and all that info and putting it right into the CRM utility tool," said Lemon.
"So the customer thinks, 'I needed a copy for their test drive.' But really, I am capturing all this information so I can start marketing to the customer and make a sale."
Lemon says Dueck's new licence scanner also copies information from both sides of the licence or card, which in the case of B.C.'s combined Services Card, includes personal health numbers.
"As a sales person, later on I can go find out which drivers’ licences were scanned and then pick my customer and start adding personal information."
A guide for businesses issued by the privacy commissioners of Canada, Alberta and British Columbia says that most retailers can satisfy their needs by checking the customer has a valid licence but not recording it, stating that "photocopying or scanning the licence generally goes too far."
Lemon says that when he brought his concerns and the privacy commissioners' guide to his manager, nothing was done.
‘By law, we have to scan it.’
CBC used hidden cameras to test several dealerships, including all three Dueck locations in the Lower Mainland.
At Lemon's former workplace on Marine Drive we asked to test drive a 2014 Buick Encore.
The salesman asked for a driver's licence, saying it was "just to...ah...photocopy and get a...gonna get a demo plate...”
He went to the reception desk, where there is no photocopier, only a small scanner. He returned just five seconds later and we could not see if the licence was scanned or not.
At Dueck's Richmond location, a CBC producer's licence was scanned and her photo and personal data were immediately uploaded to DealerMine software, which indicated the scan was 100 per cent complete.
"By law, we have to scan it, but after 30 days, we have to destroy the form," the salesman said, referring to a consent form which he mentioned but never produced.
Before a second test drive at Dueck in Richmond, another salesman photocopied a CBC journalist's licence and is recorded on hidden camera saying, "I'm supposed to use the scanner but... I photocopy, I'm old school."
He explained why they scan now, saying, "Basically, what it does is it uploads your info into our new kind of tracking software system. Not physically tracking, just to keep a database of customers."
At six different dealerships, salespeople told CBC journalists they needed a copy of a driver’s licence prior to a test drive for insurance purposes.
None explicitly asked for permission to keep personal information in a customer database.
The Insurance Corporation of British Columbia (ICBC) confirmed there is no insurance requirement for a dealership to photocopy or scan the driver’s licence of a customer test driving their vehicles.
‘The law is very clear’
B.C.'s information and privacy commissioner, Elizabeth Denham, was frustrated to hear the results of CBC's investigation and said dealers are not allowed to store and use customer data without their consent.
"They have been subject to this law for 10 years," said Denham, referring to a 2005 ruling on the collection of customers' personal information.
The commissioner says in most cases, it is sufficient to simply show your driver’s licence information.
“If it's collected, the auto dealer has to get the individual’s consent and there has to be a fulsome explanation as to how they are using the person’s personal information...The law is very clear.”
Denham says customers should only allow salespeople to view their driver's licence to verify it, not copy it.
The commissioner said car dealerships must adhere to the guide for businesses which Lemon claims was not acted upon when he brought it to his manager.
‘Shocking for consumers’
Micheal Vonn, policy director for the B.C. Civil Liberties Association (BCCLA), says businesses cannot deceive customers to take their data.
Vonn advises consumers not to allow anyone to walk away with their ID. "Photocopying and scanning a driver’s licence is just virtually never allowable under that legislation," she said.
"When you a check a licence, it's very different than saying, ‘We’re going to capture that data, we’re gonna mine the data and do things with data you never anticipated,'” said Vonn.
“That's obviously a breach of private sector privacy law, I think in that it's such a blatant dismissal of what has already been long decided.
“It's not a grey area. It should be a little bit shocking for consumers.”
She says the BCCLA will launch a formal complaint to B.C.'s information and privacy commissioner, who could then investigate the industry's practices.
‘Get you in the system’
The same make and model of driver's licence scanner used at Dueck was also spotted at other car dealerships at Richmond's auto mall.
A receptionist at Richport Ford was recorded on hidden camera complaining that her scanner needed an update because it "doesn't scan your driver’s licence properly. It puts the address in the name and the name in.... It's just easier if I just do it."
She then manually typed our producer’s name, address, and birthdate into Ford's customer database.
A salesman at Open Road Toyota did not photocopy or scan the driver's licence.
"What I would like to do is get you in my system, then we go on the road" said the salesman, who explained all customers’ data must be entered into his computer before any test drive.
The Toyota salesman did not explain how customers’ information would be used. "We have to do this; this is our new procedure, compensation board, ICBC and all that," he said.
However, he did not enter any of our information into his computer before the test drive.
Consent form changed
CBC contacted all six general managers of the dealerships we tested.
In an email, Stu Haskins, vice-president of Dueck Auto Group, told CBC it is both "necessary" and "reasonable" that they copy drivers’ licences prior to test drives, and that they do so with customers' consent.
- Scroll to the bottom of this story to see Haskins' full email statement
Haskins provided CBC with a copy of a consent form he says customers sign before all test drives, stating the customer agrees to allow Dueck to retain their name, address, email and phone number for “contact purposes.”
The form sent to us by Haskins specifies that the scanned copy of the driver's licence will be "auto deleted from our records within 30 days."
But at all five test drives we took at Dueck's three dealerships, CBC investigators were never asked to sign that consent form. Before one of these test drives, at Dueck on Marine Drive, the salesman did not ask to see a driver’s licence at all.
There was a waiver of liability form that was required to test drive at Dueck's downtown location, but it did not include anything about allowing Dueck to retain personal data for contact purposes or about auto deletion of this data after 30 days.
Haskins acknowledged that the company's consent form had been updated since he was approached by the CBC.
‘Protecting customers’ information’
Haskins also writes that after 30 days, "the customer’s scanned or photocopied driver’s licence will be eliminated from the CRM system or destroyed.”
“What is retained, if agreed to by the customer, is name, address, email and mailing address," said Haskins.
"We are a firm believer in protecting customers’ information in accordance with the [Privacy] Act.
“It is our position that copying an individual's driver’s licence in advance of test driving one of our vehicles is reasonable, for legal, insurance, and security purposes.”
Haskins also said in response to our inquiry that Dueck has asked the New Car Dealers Association of B.C. to review this process with the information and privacy commissioner to ensure it is following the guidelines of the Privacy Act.
For his part, Kurtis Lemon says he was never told to destroy copies of customers' licences when he worked at Dueck on Marine Drive.
He says customers have no idea their information is being stored and used after a test drive, until perhaps a few weeks later, when promotional material starts arriving in the mail.
It is not clear whether the practice of scanning drivers’ licences and retaining their data is occurring nationwide or only in B.C.
Since quitting his job, Lemon is starting a new business as an independent consultant for people who hate car shopping.