The new year sees more states trying to clamp down on the rising trend in data theft and cybersecurity crimes. Connecticut is among several states that recently passed new measures to tighten security and data privacy protections.
A string of high-profile cyber incidents involving car dealerships has made auto dealership cybersecurity a hot topic of late.
Still fresh in everyone’s mind is the CDK Global cyberattack from last June that impacted more than 15,000 North American auto dealerships and resulted in over $1 billion in combined losses.
Related Article: The CDK Global Cyberattack And How To Protect Your Dealership
While the immediate fallout may be over, the CDK cyberattack impact on the auto dealership industry is likely to be felt for some time to come, especially when it comes to consumer trust and future purchasing decisions.
Some 84 percent of customers wouldn’t buy another vehicle from a dealership where their data had been exposed, according to a report.
So, how do you make sure you’re in compliance and protecting sensitive customer information from falling into the wrong hands?
In this article, we’ll examine the issue of data privacy and offer eight tips to help you comply with the new regulation and protect private consumer information.
After reading this article, you’ll have a better understanding of why data privacy protections are critical to your auto dealership and how you can safeguard your customers’ private information.
Connecticut's new data privacy provision, which went into effect Jan. 1, requires auto dealerships to stop using or selling consumers’ personal data for targeted advertising if they opt out of such advertising through their internet browser settings.
The mandate becomes part of an existing state privacy law known as the Connecticut Data Privacy Act (CTDPA), which took effect July 1, 2023.
Under the newly adopted legislation, Connecticut residents can automatically indicate through a single click that they don’t want their personal data sold or shared without their consent.
Auto dealerships and other affected businesses must honor the opt-out preference signals (OOPS) they receive through browser settings like the global privacy control (GPC).
The new data privacy rule applies to auto dealerships and other businesses that provide goods and services to Connecticut consumers and meet certain parameters.
It should be noted that the new data privacy requirement also applies to all Connecticut healthcare providers, regardless of size, as well as to third-party vendors that provide services to any covered business.
Personal data is considered to be any information that can reveal the identity of a specific individual.
This includes information such as:
Related Article: Personally Identifiable Information: 10 Steps To Ensure Data Privacy
Keep in mind that the CTDPA law works alongside existing state and federal data privacy laws for auto dealers. These laws are intended to protect consumers, and to mitigate the chances of their data being stolen or sold by bad actors.
Those laws include the Gramm-Leach-Bailey (GLBA) “Safeguards Rule,” which was updated last May.
Under the Safeguards Rule, auto dealers and other covered financial organizations must establish specific security controls to protect consumers’ personally identifiable information (PII). They must also report data breaches to the Federal Trade Commission (FTC) within 30 days.
In the course of doing business, your organization processes vast amounts of data—including a treasure trove of private consumer information.
The digital information found in connected cars has been a virtual gold mine for cybercriminals.
For example, upwards of 90 percent of the trade-ins and leased vehicles handled by auto dealers includes the previous owners’ personal information, according to a report by Privacy4Cars, a company that creates privacy and compliance solutions for vehicles.
Related Article: Why Cybersecurity Will Remain Critical For Car Dealerships in 2025
The company also reported some other notable consumer beliefs around data privacy, including that a third of Americans say they’d be willing to spend more money with companies that prioritize data privacy.
It also found that consumers consider businesses that don’t offer data privacy to be untrustworthy (59 percent) or unethical (44 percent).
On top of these consumer concerns, dealerships that fail to comply with state and federal data privacy requirements could face fines of up to $40,000, plus legal fees.
So, how can you protect the confidential customer information you process every day?
Related Article: Why Are Businesses Moving To Zero Trust? Your Roadmap To A ZT Strategy
Related Article: Deepfakes And AI Scams: How To Spot Them And Protect Your Business
While you can’t control whether or not customers choose to allow their personal information to be used or shared, you can develop trust among customers by establishing and communicating clear privacy policies and practices.
After reading this article, you now understand the importance of safeguarding the sensitive customer data you handle to meet regulatory requirements, reduce the chances of a data breach, and build customer loyalty.
Data privacy laws are getting stricter. Failing to comply can lead to hefty fines and lost customer trust, especially since car dealerships handle vast amounts of sensitive customer data.
At Kelser Corporation, we help auto dealerships throughout the state of Connecticut protect their sensitive customer data and stay compliant.
We know that managed IT services is not the right solution for every company, however. We provide informative articles on relevant IT topics like this so that you can make informed IT decisions for your organization.
If you’re unsure if your dealership is properly safeguarding sensitive customer data or meeting compliance requirements, click the link and give us your contact details.
We’ll respond quickly, and schedule a 15-minute call to learn more about your issues and see if we might be a good fit to work with.