Tesla have given my in-depth personal details to another owner!

[pdk42]

I got a WhatsApp from an unknown contact today asking me about a Model S he'd just bought since it appeared I was the previous owner. I've never owned a Model S so this came as a bit of a surprise. On further discussion, it appears that he's been sent very detailed information about me, incl

- a full image copy of my driving licence
- a full image copy of my Model 3's V5
- all my and my wife's e-mail and phone numbers

So, he's got my name, my wife's name, full address details, phone numbers, e-mail addresses, vehicle VIN etc. It would be very easy to do an identity theft with all this. Thankfully, he seems a really nice genuine guy so hopefully no harm done - but what the hell are Tesla doing?

I'll be calling them Mon, and perhaps contacting the ICO. This is the second time I've had issues with my account - the first time my car was removed from my account and added to someone else's!

 

[DOCAL]

I would absolutely contact the ICO about that.

 

[Medved_77]

A letter addressed to the data controller should get the ball rolling:

 

[m3p_uk]

Sounds like a big gdpr fine!

 

[Tony Hoyle]

Yup data controller at least - that's a notifiable data breach. It shouldn't have happened (the data controller is then legally bound to notify the ICO).

 

[OttoR]

Sounds like a big gdpr fine!

Does that still apply post Jan 1st?
Isn't GDPR an EU regulation?

 

[TheGringoShow]

There will be little change during the transition (also known as “implementation”) period that is expected to end on 31 December 2020. During this period, EU law will continue to apply in the UK, including the EU General Data Protection Regulation (GDPR), after which the GDPR will be converted into UK law.

Assuming all goes to plan (which is almost impossible where Brexit is concerned), the UK will be a “third country” under the GDPR from 2021.

More details here: Post-Brexit Data Protection – Where Are We Now?

 

[GRiLLA]

It's something to take up with Tesla, specifically raise a complaint to their data protection team who I'm sure will look at the processes that led to the error.

I would absolutely contact the ICO about that

The ICO will just tell you to contact Tesla in writing, it's their responsibility to notify the ICO if it meets the criteria (TBH this probably isn't reportable). ICO will only get involved if you've contacted the company already.

Does that still apply post Jan 1st?
Isn't GDPR an EU regulation?

The UK copy/pasted pretty much all of EU laws into British law, there's no change to GDPR or pretty much any laws.

 

[Spacep0d]

Dangit Tesla don't doxx your customers! Good luck with the resolution or since you can't put the genie back in the bottle, maybe your report can prevent further leaks.

 

[Glan gluaisne]

Frankly I don't have a great deal of confidence in any of Tesla's "back office" functions, especially the Heath Robinson software they seem to use for account management and order processing. I have several invoices in my account from the time I bought my car, every single one of them is wrong. Same goes for their address database, rather than just use the standard RM database that everyone else uses, Tesla have an address database that seems not to accept addresses in the standard UK form much of the time.

For a company producing cars that rely on high integrity software for all safety critical functions, glitches like this don't exactly inspire confidence.

 

[DaveW]

Just seen this come up on TOGUK Facebook (linked back to here):

Just got my first Tesla before Christmas, a nearly new Model S LR+, fabulous car, took about a week to register my car with Tesla, website kept rejecting the .jpg’s I’d scanned, “try later” it said, eventually rang Tesla, a guy said, “try .PDF’s, that should work” should ? I thought, it didn’t, then noticed he website asks for photos, .jpg’s, rang back the next day, a lady went and asked someone to sort it, two hours later my account and app where working, so browsing through my account, came to Glovebox/Ownership transfer receipt, had a photo of a card licence, and all of a V5, plus name, address, email, mobile etc, thinks, that’s a lot of detail ? so I messaged the guy, assuming he’s the previous owner, saying does he mind me asking why he sold the car so quickly after buying it ? He replied “ thanks for letting me know, but I’ve got a Model 3, ive never owned that car, and I’ve never had a model S, I’ll take this up with Tesla, as it’s not the first security concern I’ve had with my Tesla account ! “
Has anyone else had a similar experience ?

Hopefully it's the same isolated issue, rather than it happening several times (not that it makes it any better of course).

 

[pdk42]

Just seen this come up on TOGUK Facebook (linked back to here):



Hopefully it's the same isolated issue, rather than it happening several times (not that it makes it any better of course).

Yes, that's the guy who messaged me - the same case.

 

[Morriscoombes]

At least you were lucky enough to get an honest person on the other side of it. Christ!

 

[MrBadger]

Individual cases like this are often best not discussed in social media. It can prejudice any case or claim that may arise.

 

[WheresMyCar]

Individual cases like this are often best not discussed in social media. It can prejudice any case or claim that may arise.

I would agree wholeheartedly. My approach, would be to report the issue to Tesla, indicating the potential severity and ask them to perform a thorough investigation and provide me with the results of that investigation and assurances that they have correctly identified the root cause and will implement preventative actions. If then I didn't receive an appropriate response (and some serious Supercharger credits) then I would consider approaching the ICO but I'd like to give them the chance to recognise the error, fix it and say sorry first.

 

[init6]

They should also be paying for credit monitoring for you and your wife. Just in case the data gets into the wrong hands.

 

[LukeSki]

When I bought a used model X from Tesla, it had the old owner's V5 and trade in sheet in the glove box, it had name, address, phone number, and email address on it. I reported it to Tesla and they didn't seem too fussed about the issue.

 

[pdk42]

When I bought a used model X from Tesla, it had the old owner's V5 and trade in sheet in the glove box, it had name, address, phone number, and email address on it. I reported it to Tesla and they didn't seem too fussed about the issue.

I sent a email to Tesla’s Data Protection Office about my problem - so far not even an acknowledgment. Tesla must be about the worst car company for customer service.

 

[LukeSki]

They said to be that checking the glove box is not part of their checklist on used cars, I would love to know what there 200 point checks are. Not that they actually do them anyway as the car has lots of issues and I ended up have to reject it.

 

[name you wish]

I handed my Model S back in August, did the erase/wipe in the car, send emails to Tesla asking them to remove it from my account, then promptly forgot about it.

October, ordered a Model 3 and logged into my account to see the Model S still there. Contacted them again, waited..
Still on my account.

Reinstalled the Tesla app. Could see the car was now in Ireland, where it was parked (a business). Then driving. Then parked.

Contacted Tesla again, included details of where the car was, etc. Mentioned I could have jumped on a plane, unlocked the car and drove it off... probably not a good idea.

Got a
'Please excuse the late reply.

The car has now been removed.'