Dealers wonder about recalls under privacy law

A privacy law in California that will allow consumers to demand that businesses delete their personal information has left some dealers questioning how to simultaneously satisfy safety standards and customers' requests.

If customers ask the dealership to delete their information, Peter Hoffman, dealer principal at Sierra Autocars in Monrovia, Calif., wonders how he'd reach customers if their vehicles were recalled.

"It's confusing as to where the line is drawn," Hoffman said.

The California Consumer Privacy Act, taking effect Jan. 1, affects many types of businesses, but in the auto industry, some worry that the deletion request could hinder alerting customers about recalls and warranty work.

The California New Car Dealers Association has sponsored a bill that would narrow the act's effect on auto retail and allow automakers and dealers to share consumer data and contact them when vehicles have been recalled, even if those consumers request that their data is deleted.

"It's the manufacturers' obligation under federal law if there is a recall to communicate with consumers, but they get that information, logically, from the dealer because it's the dealer that sold the customer the car or services the car," said Brian Maas, president of the association.

The bill would put a limited exception on the act to make warranty and recall work possible, he said.

"It's really a safety measure," Maas said. "We don't want a consumer unwittingly to say, 'Yeah, please delete my information, dealer' and then not understanding that they're not going to be able a year down the road to get information from the automaker that the car they're driving around has, for example, a Takata airbag recall."

Notifying vehicle owners about recalls is also a federal directive under NHTSA, the nation's top auto safety regulator, said Melanie Cliff, partner at law firm Scali Rasmussen in Los Angeles. The goal is "to make sure the public is really safe from these cars that are defective," she said.

Meghan Musselman, partner at law firm Hudson Cook, said most dealerships could be exempt in recall situations from the right to deletion provision. The act states that a business is not required to comply with the request for deletion if the consumers' information is necessary to provide a service requested by the consumer or reasonably anticipated within the context of a company's ongoing business relationship with the consumer.

"When you're talking about a consumer-initiated transaction, like buying a car, one would think a reasonable consumer has an expectation that if you're buying a car from someone, they're going to have to keep certain records about that purchase. So, it's in line with the consumer's expectations," Musselman said.

The law affects various consumer-facing businesses, but as dealers, "we do feel like we're in a bit of a unique position," said Maas. A vehicle is very different from most products a consumer would buy on Amazon, for example.

"We're still retailers, of course," said Maas, "but our products are obviously more expensive and have a safety [component] that just doesn't apply to most products."