Possible Data Protection issue?

[Ringthane]

Last Tuesday, I set off for my car’s complementary check over, and I mentioned an issue to do with my Volvo ID. I had been in correspondence with Volvo UK Customer Relations regarding the issue, and they suggested that it was looked at when I dropped the car off.

Two days later, my dealership hadn’t managed to fix the issue and had escalated it to Volvo Sweden.

The issue is this: When I took delivery of the car, I set up a Volvo ID (my email address and password). I completed the setup of VOC, using said Volvo ID. I logged on to the Volvo website, and entered my VIN, to show me my car and also set up a preferred Dealership. All was well. The VOC app shows my car, correct VIN and registration number. The My Volvo website also shows the correct information.

However, I tried using the appointment booking app, in Sensus and the first message I got was a Popup, telling me I hadn’t assigned a preferred dealership. Having cleared the Popup, I noticed that the Volvo ID field, in the appointment app, shows my wife’s email address, not mine. Somehow, when setting up the car, this incorrect email address was added to a field in a database somewhere. This means I can’t use the app to book appointments, or send my preferred dealer any car specific information.

The issue is that no one seems to know how this incorrect information got there, but more importantly, how to correct it, or even remove it. I have tried a Factory Reset, which cleared it for an hour or so, but it returned. The dealership spent two days removing, and re-loading modules and it is still there.

When I come to sell the car, will the email address still be there, visible to anyone? What other personal information, stored on a back-end database somewhere, will still be there?

I’ve escalated the issue to Volvo Customer Relations; cc’d to Volvo’s Data Protection Representative, so I’ll keep you posted on the progress.

[Lexman8]

On a similar IT-related issue, I spent over 2 years trying to get Volvo UK to correct my home address on their database. Several emails and phone calls to them always led to assurances it would be corrected but it never was. It seems their system won't accept my address as valid even though I've lived here 20 years. Their postcode look-up database says I live in a pub and they cannot change it. The pub address is valid so presumably they get all my correspondence.

I've now given up trying to get it corrected.

[NewV90Owner]

GDPR is your friend here.

You have very very clear rights to:

1. Request a copy of all the information they have on you.

2. Request that data should be corrected.

3. Request that data be deleted.

GDPR also says that the information on doing the three things above should be clear and simple.


https://www.volvocars.com/intl/foote...t-request-form

They should have a designated data protection officer as well.

Please reference GDPR and that should get their attention.

[S90]

The ability to book a visit to the dealership currently does not work in the UK. Neither does sending car data to them.

You must have given Volvo your wife's email address at some point. However there is an issue when you come to sell the car and I find it amazing that Volvo have no idea how to remove the information, pretty worrying!

[simonjedrake]

Originally Posted by S90

You must have given Volvo your wife's email address at some point. However there is an issue when you come to sell the car and I find it amazing that Volvo have no idea how to remove the information, pretty worrying!

The common way that the “wrong” info incorrectly finds its way onto these online forms is when users fills a form in with their OS’s auto-complete option........

[nu11eaf]

In the VOC app in settings there are a remove option and an end my ownership option, in the remove option after entering your VOC pin all data will be removed, or so it says.
In the end my ownership all VOC services will be disabled and all accounts and data will be erased, to start using VOC services again you have to contact volvo support by pressing the in car VOC button and speak to them.

Are you sure you did not have a senior moment and put your wifes email address in by mistake.

[Ringthane]

A Senior Moment is a definite possibility.

I did suggest removing my Volvo ID completely, but the Volvo technician suggested that they try to find out why they can’t remove it first.

I wasn’t aware that the appointment booking functionality wasn’t available in the UK. It certainly wasn’t mentioned when I was at the dealership. That said, it doesn’t alter the fact that there is a database somewhere with the wrong data in it.

If there is no solution forthcoming from Volvo in the next week or so, then I will try removing my Volvo ID, as if I were going to sell the car, and see what happens.

[Ringthane]

Update...
Buckle up, this is a bumpy ride.

So after spending another couple of hours at the dealership, following some instructions given to the dealer, from Volvo UK, we completely deleted any association with my Volvo ID, and the car, and set it up again from scratch.

This had no effect, other than to erase the last three months of my VOC Driving Journal, which was irritating, but not the end of the world.

This still left me with having Mrs R’s email address in the Volvo ID field in the Car Status app.

During the investigation, it was discovered that there is a Primary and a secondary Volvo ID, and that somehow, the primary ID was Mrs R’s email address, which could only have been set up that way, because it was STMBO that did most of the communication with the dealership, once the various hands had been shaken. Well, maybe...

One of the service guys asked me if I had ever tried to set my wife up as another user of the car, and this reminded me that I did indeed set up a seperate account for her, and associate her Volvo ID with the car, via the VIN number.

Unfortunately, when she tried to use the VOC app on her phone, it wouldn’t link correctly, so I deleted her account, and set up her VOC app to use my Volvo ID instead.

I then tried setting her up again, with a Volvo ID, with her email address, and low and behold, found that once the account was set up, it was still associated with our car’s VIN, so proving that, even though I had deleted her Volvo ID, it was still there, on a Volvo database somewhere. I removed the association with our car, and then deleted the account. The next day, my Volvo ID appeared in the Car Status app.

So the takeaway from all of this seems to be that:

Only one Volvo ID can be associated with one car, but multiple cars can be associated with one Volvo ID and that Volvo doesn’t actually delete their database records, just marks them as deleted, presumably by setting a field in the database record.

It’s already been pointed out that the functionality to book appointments with a preferred dealer, is not available to UK owners, thus making the whole process pointless, but I raised this with the technician an he told me that it should be available now, or in the near future.

[SwissXC90]

Originally Posted by Ringthane

Volvo doesn’t actually delete their database records, just marks them as deleted,

Marking as deleted, but not deleting, is standard practice, because then Volvo knows it is deleted, and can record why and when it was deleted.

[RobQuads]

Originally Posted by SwissXC90

Marking as deleted, but not deleting, is standard practice, because then Volvo knows it is deleted, and can record why and when it was deleted.

It depends on the data - They can't just set a field to say all the data as deleted any more. With GDPR they need to delete all the data except if it's required for audit (i.e. tax) to provide account history or its required for legal reasons. All other data on the account has to be deleted.

In this instance the email is one thing that there is valid reason to keep for audit reasons.