Drivers' privacy concerns grow over B.C. car dealer scanner

The head of the New Car Dealers Association of B.C. says he hasn't seen any members uploading drivers' licences onto marketing software, a day after a CBC undercover investigation found​ B.C. car dealers may be violating customers' privacy rights.

The CBC investigation was prompted by former Dueck GM salesman Kurtis Lemon, who came forward after quitting his job in Vancouver, saying he wasn't comfortable following a new procedure to scan customers’ licences before test drives.

Lemon claims Dueck GM scans drivers’ licence data and imports it directly into a new software program called DealerMine, a customer relationship management or CRM tool, that helps dealers track and market to customers.

This, despite guidelines for businesses issued by the privacy commissioners of Canada, Alberta and British Columbia, which state that "photocopying or scanning the licence generally goes too far."

Dueck denies they are using the data for marketing purposes and say they routinely delete drivers' information after 30 days.

On Wednesday, Blair Qualey, president of the New Car Dealers Association of B.C., said he hadn't observed any of the association's members scanning licences and uploading the data to marketing programs.

"I have not personally come across a dealer that I know of who is directly scanning licences into that software," said Qualey. "You may have seen that but I have not personally witnessed that."

Qualey said keeping a record of who is requesting a test drive is "standard practice in the industry and required for good business reasons."

CBC used hidden cameras to test several dealerships, including all three Dueck locations in the Lower Mainland, with varying results.

At Dueck's Richmond location, a CBC producer's licence was scanned and her photo and personal data were immediately uploaded to DealerMine software, which indicated the scan was 100 per cent complete.

"By law, we have to scan it, but after 30 days, we have to destroy the form," the salesman said, referring to a consent form which he mentioned but never produced.

Before a second test drive at Dueck in Richmond, another salesman photocopied a CBC journalist's licence and is recorded on hidden camera saying, "I'm supposed to use the scanner but... I photocopy, I'm old school."

He explained why they scan now, saying, "Basically, what it does is it uploads your info into our new kind of tracking software system. Not physically tracking, just to keep a database of customers."

The same make and model of driver's licence scanner used at Dueck was also spotted at other car dealerships at Richmond's auto mall, including Richport Ford and Open Road Toyota.

Overall, at six different dealerships, salespeople told CBC journalists they needed a copy of a driver’s licence prior to a test drive for insurance purposes.

None explicitly asked for permission to keep personal information in a customer database or for marketing purposes.

The Insurance Corporation of British Columbia (ICBC) confirmed there is no insurance requirement for a dealership to photocopy or scan the driver’s licence of a customer test driving their vehicles.

Dueck GM told the CBC customers must sign a consent form before their licence is scanned, that also authorizes Dueck to retain certain contact information, but that form was not provided to us before five recent test drives.

The company now concedes this form was re-written after CBC started asking questions.

Meanwhile, Micheal Vonn, policy director for the B.C. Civil Liberties Association (BCCLA), wants the information and privacy commissioner to investigate the auto sales industry.

She wants to know if dealers are failing to get consent from customers about how their personal information is used and is considering launching a formal complaint.

"If you know there is widespread flouting of that law, then we need to kick up enforcement," said Vonn.

Qualey says he has called the commissioner to ask for a meeting and says the association will review test drive procedures.

He added that if the information and privacy commissioner wants changes, then the association's members will make them.