Are you giving away your personal data in your old car by mistake? What to watch out for

• e-mail

One in three used car buyers say they've bought a motor that still had personal data belonging to the previous owner stored in it.

The majority of modern models are fitted with infotainment systems that can link to an owner's smartphone and allows them to input their home address in the sat-nav as well other private details.

But despite this, many drivers forget to wipe this information from the vehicle before they sell it on.

Carwow says this has the potential to be a future data privacy issue for dealers who sell used motors.

With car owners often failing to perform a factory reset on their vehicle's infotainment system before selling, many are inadvertently giving away their personal data

The poll of nearly 1,000 customers who had bought a used vehicle using Carwow's online platform found that 33 per cent had come across personal data of one or more former keepers stored in the car's infotainment system.

This includes information about the person as well as phone numbers for everyone in their contact list, which can be stored in a vehicle when drivers pair their smartphone to the vehicle. 

The increased availability of applications in cars also means data can be stored there, and in some cases people can leave their accounts open for others to access paid-for services and private information that's accessible via an app.

While many might expect a private sell to have forgotten to clear the system's history or performed a factory reset, more than four in five motorists believed a dealer selling a vehicle would be responsible for deleting this information from a vehicle on their forecourt.

Some 83 per cent of respondents said they would expect the dealer to wipe personal data from a car they have advertised.

Under current regulations, 'personal data' is any piece of information that would allow someone to be identified, such as a home address, email address or phone number.

If traders fail to remove this information from a car they are selling, there is potential for there to be a data privacy issue for dealers, says Gaurav Jain, commercial director at Carwow. 

The poll found that 33% of customers who had bought a used vehicle using Carwow's online platform had found personal data of one or more former keepers stored in the car's infotainment system 

Under current regulations, 'personal data' is any piece of information that would allow someone to be identified, such as an email address, phone number or their home address stored in a satellite navigation system

'It can be unclear whether responsibility to delete user information from a vehicle at change of ownership lies with the first owner, the manufacturer or with the dealer,' Jain told This is Money.

'Allocation of responsibility could be influenced by which of these entities might be considered the 'controller' of the data under GDPR [General Data Protection Regulation] laws.'

Carwow is calling for greater clarity from the Information Commissioner's Office (ICO) on the issue.

The ICO is responsible for outlining laws around data protection. It also upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. 

'We'd advise all car sellers to remove any personal data from the car prior to handing over their car - including from any in-car apps,' Jain added.

'In addition, dealers should safeguard their own interests, as well as that of their customers, by taking reasonable steps to remove data themselves before handing over the keys to a new owner.'

The wider availability of smartphone-style apps in cars could also be a privacy threat, and in some cases people can leave their accounts open for others to access paid-for services and content

Read More

Car makers with most distracting touchscreens revealed as drivers and safety bodies say they want more buttons in vehicles

A 2020 investigation by consumer watchdog Which? found that more than half (54 per cent) of 14,000 drivers polled had synced a phone to their car using Bluetooth or connecting via a USB cable.

Pairing a smartphone with a car will mean that drivers could play their own music, download their contacts and messages, get live traffic and navigation information and make hands free calls or send messages.

While this may be convenient, unless their smartphone is later disconnected, the account deleted and downloaded information erased, this data could be viewed by the next owner and potentially every owner thereafter if the systems are not properly wiped.

But of these drivers, more than half (51 per cent) had not tried to unsync their phone before they sold it.

More concerning is that almost a third (31 per cent) took no action at all to remove their personal information from they had shared with their cars - essentially handing over their private details to someone they didn't know.

Four out of five (79 per cent) vehicle owners did not follow instructions in the car manual to remove data and return the car to its factory settings before they sold it, despite this being the best way to make sure no personal details are left on the operating system.

Harry Rose, editor of Which? Magazine, said that cars risk becoming 'treasure troves of information' and drivers must treat the, like smartphones and tablets by restoring them to their factory settings before letting go of them.

'Manufacturers must do much more to prioritise customers' personal privacy so that drivers fully understand how much data their vehicle could be harbouring and how to delete this information in order to eradicate these risks,' Rose added.