Motor Vehicle Dealership Test Drives

Introduction

It is common for prospective buyers to want to test drive vehicles they are considering to purchase, before they make their final decision. When a prospective buyer takes a vehicle from a motor vehicle dealership out on the road for a test drive, there are a number of risks that dealerships may face, from receiving violation tickets, to damages, or to the extreme, theft of the vehicle.

While motor vehicle dealers have a need to collect personal information due to the risks noted above, they must ensure that their collection of personal information about drivers complies with Alberta’s privacy legislation.

This document was prepared by the Office of the Information and Privacy Commissioner (OIPC) to provide practical guidance to motor vehicle dealership owners and employees regarding the collection, use, disclosure and retention of personal information related to test drives.

In Alberta, the Personal Information Protection Act (PIPA) governs how you, as a motor vehicle dealership owner or employee, can collect, use, disclose and retain the personal information of individuals.

Do you have to tell individuals you are collecting their personal information?

Before, or at the time information about individuals is collected, a dealership:

• must notify individuals, orally or in writing, of its purpose for collecting the information;
• must clearly specify that it is requesting the information for identification purposes;
• must identify any other purpose, if applicable, and obtain consent; and
• must provide the name or title of a person who is able to answer questions on behalf of the dealership about the collection.

Do you need to get consent to collect personal information from individuals?

Before collecting personal information of an individual asking to test drive a vehicle, a dealership must first obtain consent. Consent may be given in writing, orally, or by electronic means. However, dealerships need to consider how they will keep a record and how individuals can withdraw their consent. Please refer to the OIPC website for the guidance document on consent titled “PIPA Advisory 1 – Consent” that can be found at
www.oipc.ab.ca.

What personal information can you collect?

PIPA limits the personal information dealerships can collect, stating that information can be collected only for purposes that are reasonable and only the information that is reasonably required for meeting the intended purposes. PIPA defines “reasonable” as “what a reasonable person would consider appropriate in the circumstances”.

In relation to test drives, this means dealerships should collect only first name, last name, address and driver’s licence number. Specifically, they must not make or keep paper or electronic copies of the drivers’ licences of test drivers.

How about using the information collected?

Just like dealerships may collect only the least amount of information, they may use the personal information collected only for purposes individuals agreed to, or as authorized by law. Specifically, dealerships must not make secondary uses of the information, such as using it for marketing purposes, unless they have consent from the individuals to do so.

Who can you share this information with?

Finally, dealerships must not disclose to third parties the personal information of individuals collected for a test drive, unless authorized by law, or with the consent of these individuals.

How long should you keep the information?

Under PIPA, dealerships have an obligation to maintain accurate records of information. Dealerships may retain this information only as long as reasonably required for legal and business purposes. For example, a dealership should determine the length of time it is required to retain the information to address the risks it identified, and set the retention based on that. It is recommended that dealerships draft a policy that specifies the adequate retention period, make the policy available to employees, customers, and the public. Dealerships should also designate someone as responsible to periodically and securely dispose of records at the end of the stated retention period.

In Order P2012-10, the OIPC found that a car rental agency had no reasonable purpose to photocopy and keep photocopies of the drivers’ licences of renters. The Adjudicator determined that simply verifying the licence and recording its number, with name and address of the renter was adequate to address issues of vehicle theft without photocopying the licence.

Do you have to protect the personal information you collected?

Throughout the lifecycle of the information, from collection to destruction, dealerships must make reasonable security arrangements to protect it. This is a requirement under PIPA and it applies regardless of the format of the records. For example, this means restricting access to the information to only those staff members with “a need to know”, storing paper records in a locked cabinet, and encrypting electronic devices that contain personal information.

If dealerships become aware of the loss, unauthorized access, or disclosure of personal information, they must notify the OIPC where there is a real risk of significant harm to individuals.

For more information on breach notification, please visit our website at www.oipc.ab.ca.

Who can you contact?

Dealerships are encouraged to contact the OIPC and to view the OIPC website for more information about complying with PIPA.