Documenting Service History

[Seakingsam]

One topic not widely covered is how each of us document the service history of our vehicles.

My Vantage V8S was purchased in the UK in January 2020 in virtually as new condition, with very low mileage (just 2,500 miles). The car was then sent to BR for a very full upgrade path, before shipping back to my home here in New Zealand. Since then, a few little niggly issues resolved through the only Aston Martin dealership in New Zealand - replacing the EU-spec ICU with the NZ equivalent (didn't expect that), a pinched wire causing some minor electrical issues, and very annoying drifting GPS signal causing navigational havoc - finally resolved by the build and retro-fit of a bespoke replacement coaxial cable alongside the main wiring loom (Well done AM Auckland, Singapore and Gaydon for demonstrating such commitment and support).

For my part, the BR upgrade path has indeed been transformational. My documented service history celebrates that process in full detail, with my iPhone shot of my car in the BR workshop in Feb 2020 with Mike fiddling the last modifications to the engine management system, and with Adrian inside behind the seats - how is that even possible, Adrian ?

Capturing the history in its entirety is such an important aspect of the ownership experience - how have you done it ?

[BiggaJ]

I have a black ring binder with all the receipts for work that I have had done since I have owned my car. This covers ALL the work needed through servicing but also includes upgrades, add on carbon parts, upgrade suspension, car mats ... you name it my folder is updated.

I had little success getting information from past owners/dealerships on work carried out (under the guise of GDPR!!) but do have a full complement of stamps in the service book.

I just wished previous owners would have kept a file as I'm doing.

[Dewi 2]

I have a complete record of everything done to my car, from dealer PDI onwards.

Am I correct to say that the data privacy laws only apply to humans, not inanimate objects?
Anyway, when a pile of money is metaphorically on the far side of a salesman's desk, the data protection laws were not going to interfere with his sales bonus, so I was given a complete printout of workshop activity.
Very little corrective work was necessary and fortunately that has continued during my ownership.

The moral of the tale perhaps, is ask for a printout just before agreeing to purchase. It might only be practical though, for work within the same dealer group.

[LTP]

Dewi 2 said:

I have a complete record of everything done to my car, from dealer PDI onwards.

Am I correct to say that the data privacy laws only apply to humans, not inanimate objects?
Anyway, when a pile of money is metaphorically on the far side of a salesman's desk, the data protection laws were not going to interfere with his sales bonus, so I was given a complete printout of workshop activity.
Very little corrective work was necessary and fortunately that has continued during my ownership.

The moral of the tale perhaps, is ask for a printout just before agreeing to purchase. It might only be practical though, for work within the same dealer group.

A list of workshop activities carried out on the car is not the same as a sheaf of invoices with the owners' names and addresses on, assuming the workshop activities don't have the details of who requested/paid for them

[DB4DM]

My car is 60 this year, and I have documentary history from new. Plastic crate, full of files and stuff. Other car is also 60, but only have history since 97, another plastic crate. Other car is 58, and history is a slim envelope

[Markv8v]

This is a real bug bear for me as I have always kept full documentary evidence to prove what work and upgrades have been done.
When I part exchanged my Vantage for the DBS I handed this over but with my name and address details blacked out, I hope this went to the new owner.
Unfortunately my DBS only came with stamps in the service book and a copy of the service carried out by the dealer. It would have been great to look back for items such as spark plug change and diff and gearbox fluids.Let’s hope Aston catch up with others and link up dealer service history which should be available to buyers as a way to show providence.

[Seakingsam]

I agree with you, Mark - its not just invoices for service work done. In my view a full service history should include full detail of any mechanical upgrades, all repairs and any important settings, for example.

My approach is always for full disclosure - all of my cars over the years have been sold with the full history of use in my ownership, including original purchase invoices .

I tend to favor private sale and rarely trade. Enthusiast's cars are generally on-sold to enthusiasts, and de-risking the opportunity for the prospective buyer seems to me to improve the odds of yielding asking price and, I think, a better quality sale. It's also a great filter mechanism - the tyre-kicker just wants to negotiate you down, and take the car for a burst - they generally won't turn a page in the offered service history. The enthusiast, on the other hand, will appreciate the disclosure, and appreciate your courtesy in providing the detail which de-risks their decision. In my experience, the enthusiast will immediately get into the history and the discussion. An easy way to figure out to whom you offer the test-drive.

[Andy665]

I have started using the Custodian app, find it pretty good and new features being added on a regular basis, means I have an electronic record of everything as well as a catalogued paper copy

[Seakingsam]

Thanks Andy - I've never heard of it before, and I can't find it on App Store or web-site. Can you point us to a link, and what does it do? A transferrable electronic record seems to be an excellent alternative.

[Rappa]

Before GPDR I part ex my TVR that I had from new with all the documents etc. The one I bought had only work done by the dealer in preparing it and nothing from the perilous owner.
Frustratingly the dealer then binned all of my paperwork for my old car saying ‘the new owner won’t need that!!’

I even try and keep all paperwork even for my kid’s Polo.

[alscar]

I keep every piece of paper from every car purchase and depending on how special the car is and how sold ( dealer , SOR , partex , private etc ) offer up such.
Whether it ever gets passed on via a dealer partex I have my doubts.
When I sold my GT3 via SOR through an old friend given the cars history I took copies of anything I wanted to retain ( sad I know ) and gave them everything including original sales brochures , invoices of sale and literally every invoice for every penny spent including new dust caps.
Not an everyday car or sale admittedly.

[MarkwG]

Dewi 2 said:

I have a complete record of everything done to my car, from dealer PDI onwards.

Am I correct to say that the data privacy laws only apply to humans, not inanimate objects?
Anyway, when a pile of money is metaphorically on the far side of a salesman's desk, the data protection laws were not going to interfere with his sales bonus, so I was given a complete printout of workshop activity.
Very little corrective work was necessary and fortunately that has continued during my ownership.

The moral of the tale perhaps, is ask for a printout just before agreeing to purchase. It might only be practical though, for work within the same dealer group.

Yes, GDPR only applies to humans: the confusion often arises about what that data consists of, & sadly that is often poorly understood. The act of having someone's name & address on file isn't a problem, neither is handing it onto someone else for a legitimate purpose. After all, that data is in the public domain anyway. However, should the invoice include credit card or bank details, that would be more difficult, however there are ways of redacting that, & most systems will do that automatically. The destruction of a cars historical data under the spurious use of GDPR is frankly more of a danger than holding paperwork with someone's name & address on it...

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

[LTP]

MarkwG said:

<snip>

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

I don't disagree that a dealer holding and processing the owner's details in their CRM system is a legitimate use of data under GPDR, and I don't think anyone disputed that. However, I would dispute that a dealer handing my name and address across to a third party without my consent, thus identifying me as the previous owner of a high-value car and with no guarantee what that information would be used for would be infringing my rights under GDPR to have my data protected. There is no possible legitimate use for a new owner to have my contact details, irrespective of a woolly "...unlikely to cause any distress..." and my data would not have been "left in the car" - it was on the dealer's CRM system on the invoice copies.

I 100% agree that it should be possible to have the complete service history of a car, much the same as you can look up the MoT history of any UK-registered car on the DVLA website, but to have that you don't need the past owners' details.

Edited by LTP on Wednesday 20th July 11:25

[TheRainMaker]

My last car came with a file, the salesman said to me at the time he shouldn't be doing it, but it would be a shame to lose all the history.

The thing I didn't really understand is the two owners before me couldn't care as they handed it over, so why dealers then feel the need to bin it all I have no idea.

I will pass it on when the car gets sold.

[MarkwG]

LTP said:

MarkwG said:

<snip>

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

I don't disagree that a dealer holding and processing the owner's details in their CRM system is a legitimate use of data under GPDR, and I don't think anyone disputed that. However, I would dispute that a dealer handing my name and address across to a third party without my consent, thus identifying me as the previous owner of a high-value car and with no guarantee what that information would be used for would be infringing my rights under GDPR to have my data protected. There is no possible legitimate use for a new owner to have my contact details, irrespective of a woolly "...unlikely to cause any distress..." and my data would not have been "left in the car" - it was on the dealer's CRM system on the invoice copies.

I 100% agree that it should be possible to have the complete service history of a car, much the same as you can look up the MoT history of any UK-registered car on the DVLA website, but to have that you don't need the past owners' details.

Edited by LTP on Wednesday 20th July 11:25

You're absolutely entitled to that view, & perhaps a responsible dealer should redact that part of any information under GDPR to protect themselves anyway - but that protection is for them, as much as you. However, if you're really concerned, surely it's your responsibility to a) make that clear to the dealer you sell the car to you do not consent to them passing on your data, & b) take all steps to redact it yourself. I'm not sure what additional risk there is, when you no longer own the car? If your contacted by a following owner, then you can choose to ignore that contact. The protection is in case your data is used fraudulently, not just to prevent someone from contacting you. The far bigger risk is an attack on their system releasing your data to someone with mal intent, & in that regard, you're only 100% safe if they don't hold any data on you at all, whether that's service, sales or after sales. I've both been contacted as a previous owner, & contacted previous owners of some of my previous cars, just to find out about particular features & details - in both cases, the contact has been warmly received: the value isn't really relevant, after all, it's about a mutual interest in the car.

[AdamV12V]

MarkwG said:

LTP said:

MarkwG said:

<snip>

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

I don't disagree that a dealer holding and processing the owner's details in their CRM system is a legitimate use of data under GPDR, and I don't think anyone disputed that. However, I would dispute that a dealer handing my name and address across to a third party without my consent, thus identifying me as the previous owner of a high-value car and with no guarantee what that information would be used for would be infringing my rights under GDPR to have my data protected. There is no possible legitimate use for a new owner to have my contact details, irrespective of a woolly "...unlikely to cause any distress..." and my data would not have been "left in the car" - it was on the dealer's CRM system on the invoice copies.

I 100% agree that it should be possible to have the complete service history of a car, much the same as you can look up the MoT history of any UK-registered car on the DVLA website, but to have that you don't need the past owners' details.

Edited by LTP on Wednesday 20th July 11:25

You're absolutely entitled to that view, & perhaps a responsible dealer should redact that part of any information under GDPR to protect themselves anyway - but that protection is for them, as much as you. However, if you're really concerned, surely it's your responsibility to a) make that clear to the dealer you sell the car to you do not consent to them passing on your data, & b) take all steps to redact it yourself. I'm not sure what additional risk there is, when you no longer own the car? If your contacted by a following owner, then you can choose to ignore that contact. The protection is in case your data is used fraudulently, not just to prevent someone from contacting you. The far bigger risk is an attack on their system releasing your data to someone with mal intent, & in that regard, you're only 100% safe if they don't hold any data on you at all, whether that's service, sales or after sales. I've both been contacted as a previous owner, & contacted previous owners of some of my previous cars, just to find out about particular features & details - in both cases, the contact has been warmly received: the value isn't really relevant, after all, it's about a mutual interest in the car.

Sorry but LTP is spot on and you are incorrect about "you should take steps to redact any data passed over". The data processor is the responsible party for ensuring your personal data is kept safe, regardless of your prior steps.

Whilst your specific personal situation may well be that you are happy to be contacted by subsequent owners, there are many, nay the majority of normal (i.e. not PH members), would not want to have any such contact. The dealer realistically has no choice under GDPR but to ensure your personal data is not held by them to avoid any complications in the future. In most cases this will simply mean destroying all paperwork handed over.

Only a digital service record of what happened and when to the car will be kept but of course that means only data held by the MD network is likely to be accessible from one dealer to the next, and as such Im sorry to say you guys who are keeping extensive paper records for the next keeper are largely wasting your time these days. Of course if it has value to you personally then keep as much as makes you smile, but dont think its adding value like it used to do in the past. Those days are gone sadly.

[BiggaJ]

AdamV12V said:

Sorry but LTP is spot on and you are incorrect about "you should take steps to redact any data passed over". The data processor is the responsible party for ensuring your personal data is kept safe, regardless of your prior steps.

Whilst your specific personal situation may well be that you are happy to be contacted by subsequent owners, there are many, nay the majority of normal (i.e. not PH members), would not want to have any such contact. The dealer realistically has no choice under GDPR but to ensure your personal data is not held by them to avoid any complications in the future. In most cases this will simply mean destroying all paperwork handed over.

Only a digital service record of what happened and when to the car will be kept but of course that means only data held by the MD network is likely to be accessible from one dealer to the next, and as such Im sorry to say you guys who are keeping extensive paper records for the next keeper are largely wasting your time these days. Of course if it has value to you personally then keep as much as makes you smile, but dont think its adding value like it used to do in the past. Those days are gone sadly.

I agree with this. However, the comment to guys keeping records to add value etc. isn't the reason for me keeping records as in most cases a cars value will drop no matter. My reason for keeping records is to show any prospective purchaser that my car has been looked after and this may just be the added deal clincher if a buyer has a few cars in mind.

When purchasing my car I did see a few cars of which only one came with a full documented history the selling garage was OK for me to look through. I do feel it is a shame that we can't have data that would support a decision to buy.

[MarkwG]

AdamV12V said:

MarkwG said:

LTP said:

MarkwG said:

<snip>

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

I don't disagree that a dealer holding and processing the owner's details in their CRM system is a legitimate use of data under GPDR, and I don't think anyone disputed that. However, I would dispute that a dealer handing my name and address across to a third party without my consent, thus identifying me as the previous owner of a high-value car and with no guarantee what that information would be used for would be infringing my rights under GDPR to have my data protected. There is no possible legitimate use for a new owner to have my contact details, irrespective of a woolly "...unlikely to cause any distress..." and my data would not have been "left in the car" - it was on the dealer's CRM system on the invoice copies.

I 100% agree that it should be possible to have the complete service history of a car, much the same as you can look up the MoT history of any UK-registered car on the DVLA website, but to have that you don't need the past owners' details.

Edited by LTP on Wednesday 20th July 11:25

You're absolutely entitled to that view, & perhaps a responsible dealer should redact that part of any information under GDPR to protect themselves anyway - but that protection is for them, as much as you. However, if you're really concerned, surely it's your responsibility to a) make that clear to the dealer you sell the car to you do not consent to them passing on your data, & b) take all steps to redact it yourself. I'm not sure what additional risk there is, when you no longer own the car? If your contacted by a following owner, then you can choose to ignore that contact. The protection is in case your data is used fraudulently, not just to prevent someone from contacting you. The far bigger risk is an attack on their system releasing your data to someone with mal intent, & in that regard, you're only 100% safe if they don't hold any data on you at all, whether that's service, sales or after sales. I've both been contacted as a previous owner, & contacted previous owners of some of my previous cars, just to find out about particular features & details - in both cases, the contact has been warmly received: the value isn't really relevant, after all, it's about a mutual interest in the car.

Sorry but LTP is spot on and you are incorrect about "you should take steps to redact any data passed over". The data processor is the responsible party for ensuring your personal data is kept safe, regardless of your prior steps.

Whilst your specific personal situation may well be that you are happy to be contacted by subsequent owners, there are many, nay the majority of normal (i.e. not PH members), would not want to have any such contact. The dealer realistically has no choice under GDPR but to ensure your personal data is not held by them to avoid any complications in the future. In most cases this will simply mean destroying all paperwork handed over.

Only a digital service record of what happened and when to the car will be kept but of course that means only data held by the MD network is likely to be accessible from one dealer to the next, and as such Im sorry to say you guys who are keeping extensive paper records for the next keeper are largely wasting your time these days. Of course if it has value to you personally then keep as much as makes you smile, but dont think its adding value like it used to do in the past. Those days are gone sadly.

I disagree with your point re personal responsibility: the law may not demand it, but if you're that concerned, then take your own action too. It's not absolving the dealer from their responsibility, it's an additional safeguard. If you perceive a risk, mitigate it yourself.

I'm not convinced the majority of people actually give a stuff what happens, unless or until something goes wrong. The level of understanding regarding data security in general is woefully low, & the law is quite complex; this being a prime example. The law is not there to protect you from unwanted contact: it's there to protect you from fraud.

[AdamV12V]

MarkwG said:

AdamV12V said:

MarkwG said:

LTP said:

MarkwG said:

<snip>

This taken from one online legal advice site:

"To check if we can use ‘legitimate interest’ as our lawful ground for processing, we need to undertake the 3 part Legitimate Interest Assessment (LIA):

1. The purpose test – is there a legitimate interest for processing this data?
2. The necessity test – is processing necessary to achieve the intended purpose?
3. The balancing test – does the person’s rights, interests and freedoms override your legitimate interest?

In this case, our legitimate interest is adding value and credence to the vehicle to be sold. It is necessary as without the documents, the vehicle history is less clear. As for the person’s rights, interests and freedoms, an unrelated person having someone’s name and address is unlikely to cause any risk or distress, plus they left the details in the car and so the balance test is also satisfied."

https://www.lawgistics.co.uk/blog/legal_updates/gd...

I don't disagree that a dealer holding and processing the owner's details in their CRM system is a legitimate use of data under GPDR, and I don't think anyone disputed that. However, I would dispute that a dealer handing my name and address across to a third party without my consent, thus identifying me as the previous owner of a high-value car and with no guarantee what that information would be used for would be infringing my rights under GDPR to have my data protected. There is no possible legitimate use for a new owner to have my contact details, irrespective of a woolly "...unlikely to cause any distress..." and my data would not have been "left in the car" - it was on the dealer's CRM system on the invoice copies.

I 100% agree that it should be possible to have the complete service history of a car, much the same as you can look up the MoT history of any UK-registered car on the DVLA website, but to have that you don't need the past owners' details.

Edited by LTP on Wednesday 20th July 11:25

You're absolutely entitled to that view, & perhaps a responsible dealer should redact that part of any information under GDPR to protect themselves anyway - but that protection is for them, as much as you. However, if you're really concerned, surely it's your responsibility to a) make that clear to the dealer you sell the car to you do not consent to them passing on your data, & b) take all steps to redact it yourself. I'm not sure what additional risk there is, when you no longer own the car? If your contacted by a following owner, then you can choose to ignore that contact. The protection is in case your data is used fraudulently, not just to prevent someone from contacting you. The far bigger risk is an attack on their system releasing your data to someone with mal intent, & in that regard, you're only 100% safe if they don't hold any data on you at all, whether that's service, sales or after sales. I've both been contacted as a previous owner, & contacted previous owners of some of my previous cars, just to find out about particular features & details - in both cases, the contact has been warmly received: the value isn't really relevant, after all, it's about a mutual interest in the car.

Sorry but LTP is spot on and you are incorrect about "you should take steps to redact any data passed over". The data processor is the responsible party for ensuring your personal data is kept safe, regardless of your prior steps.

Whilst your specific personal situation may well be that you are happy to be contacted by subsequent owners, there are many, nay the majority of normal (i.e. not PH members), would not want to have any such contact. The dealer realistically has no choice under GDPR but to ensure your personal data is not held by them to avoid any complications in the future. In most cases this will simply mean destroying all paperwork handed over.

Only a digital service record of what happened and when to the car will be kept but of course that means only data held by the MD network is likely to be accessible from one dealer to the next, and as such Im sorry to say you guys who are keeping extensive paper records for the next keeper are largely wasting your time these days. Of course if it has value to you personally then keep as much as makes you smile, but dont think its adding value like it used to do in the past. Those days are gone sadly.

I disagree with your point re personal responsibility: the law may not demand it, but if you're that concerned, then take your own action too. It's not absolving the dealer from their responsibility, it's an additional safeguard. If you perceive a risk, mitigate it yourself.

I'm not convinced the majority of people actually give a stuff what happens, unless or until something goes wrong. The level of understanding regarding data security in general is woefully low, & the law is quite complex; this being a prime example. The law is not there to protect you from unwanted contact: it's there to protect you from fraud.

I wasn't suggesting you shouldn't bother to take precautions yourself, my point was that you are largely wasting your time anyway. The dealer is almost certainly going to throw all your nicely redacted paperwork in the shredder anyway. The only way it is of any use is via a private sale where you can willingly hand it over directly in a private sale to the next buyer and then onwards to any private sale successors in title.

That said I agree there is no harm in redacting the data if you really feel the need to hand the service history over, albeit the safest way is simply to actually shred the papers yourself if you actually want to be safe, as redaction is by no means fool-proof.

FWIW - I was a group IT Director for many years before retiring, for a large group of legal and insurance businesses that worked processing data for financial institutions, so I do know a thing or two about GDPR. It was the bane of my life for many a meeting and policy audits over the years.

[LTP]

MarkwG said:

I disagree with your point re personal responsibility: the law may not demand it, but if you're that concerned, then take your own action too. It's not absolving the dealer from their responsibility, it's an additional safeguard. If you perceive a risk, mitigate it yourself.

You're implying that I don't. I'll give you one example - I shred any piece of paper with my address on it before it's recycled. Any and all, including envelopes. I expect anyone I entrust with my data to be equally scrupulous. To be really sure I use a cross-cut shredder, not a strip shredder - I also recycle the tin foil I use to make my hats.

MarkwG said:

I'm not convinced the majority of people actually give a stuff what happens, unless or until something goes wrong. The level of understanding regarding data security in general is woefully low, & the law is quite complex; this being a prime example. The law is not there to protect you from unwanted contact: it's there to protect you from fraud.

You only have to look at what people share on social media to think you're right. Needless to say, I don't do social media. We also know that many people use the same password for all of their on-line accounts, and we all know where that can lead.

As far as the law goes, it's there to protect your data. In its introduction to GDPR the ICO says "Data protection is about ensuring people can trust you to use their data fairly and responsibly." In fact, in the whole of the ICO's "Basic Concepts", "Introduction to Data Protection" or Guide to the UK General Data Protection Regulation (UK GDPR) sections of their website the word "fraud" does not appear even once. Nor is it mentioned in the first four Articles of the actual UK regulation

The prevention of fraud (or of contact by previous owners or their agents) is a by-product of the protection of data, not the prime objective.

Edited by LTP on Wednesday 20th July 14:29