The Daily Mail UK reports that the car registration data of millions of motorists were sold to an oil company that used the data for marketing. Giant digital billboards from Castrol scanned motorists’ license plates, ran the plates through a database and instantly displayed on the billboards what the best oil was for that specific driver’s car.
It’s not surprising that data collected for one use was also used — without the motorists’ consent — for another use. This has happened in many cases and the uproar over this has proved why “use limitation” is one of the pillars of the OECD Privacy Guidelines. You must use the data for the purpose for which it was originally collected; you must not get consent for one purpose and then, because you have access to the data, decide you can use it for any purpose you please without notifying nor receiving consent from affected individuals. (Harley Geiger at CDT has written extensively about privacy issues surrounding digital signage — billboards with eyes.)
The Daily Mail reports:
Castrol used another firm to obtain the data, which is believed to have contained most of the 34 million-strong driver details held by the [UK government’s Driver and Vehicle Licensing Agency].
This identified the make, year, engine size and model of vehicle, enabling Castrol to specify the lubricant suitable for each car.
Liberal Democrat transport spokesman Norman Baker said: ‘This completely inappropriate and unacceptable behaviour by the DVLA shows how cavalier it is with motorists’ information. […]
The Mail on Sunday has previously revealed that the agency was selling motorists’ names and home addresses to convicted criminals. In the past five years the DVLA has earned £15 million from selling the names and addresses of more than six million motorists.
In an interview with Brand Republic several days ago, when the Castrol billboards first went up, Rob Stroud, marketing manager at Castrol, said: “We’re confident that the campaign will not only excite and intrigue drivers, but serve its purpose in helping motorists to understand the right oil right car message. If the campaign proves successful, we may consider a roll out to further sites including areas with longer dwell times such as forecourts.”
I’ve written about government use of license-plate scanning technology before, but not on commercial use. One of the biggest questions about the use of such technology (by anyone) is: What happens to all the data on innocent individuals? After all, we don’t know what the restrictions are on the collection and use of the data. In the United States, officials in the Washington, D.C. area, are installing license-plate readers on police vehicles and along roads. “The readers will scan the license plate of every vehicle that zooms by and run the numbers through federal criminal databases and terrorist watch lists [… and] Maryland, Virginia and the District could plug in additional databases,” the Washington Post reported last year. Memphis, Tennessee, police are also using license-plate scanners, as are law enforcement officials in Arizona, and a town near San Francisco, California.
Also, the Guardian UK previously reported that UK police are keeping data on innocent individuals’ daily car trips for up to five years. The technology, originally installed for one purpose, has kept changing to expand data collection. Previously, surveillance cameras only recorded video. Now, “Thousands of CCTV cameras across the country have been converted to read ANPR data, capturing people’s movements in cars on motorways, main roads, airports and town centres,” the Guardian UK reports. The UK Information Commissioner’s Office is currently investigating the data collection, after a complaint was filed by civil liberties group Privacy International.