I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me off the garage's phone and emailed me off their work email but I have been busy with work so missed the call and forgot to email back. I received a text from an unknown number asking if I still wanted the car, I replied asking who it was to which he replied: "it's X from Windsor's lol".

To say I'm furious he got my personal details from their system to text me off his personal phone is an understatement, I just want to know if this is a breach in GDPR or anything like that. Receiving calls and emails from the garage are fine because that is their work environment but when someone goes onto that system to get my information and use it this way is unacceptable to me.

I am looking to take this further and would just like to know my options here because who knows how many other people he has done this to, I have been in touch with his manager but got the feeling he thought X was doing an outstanding job by hounding me in his personal time.

EDIT: This question was purely to get some feedback and different points of view, I have/had no intention of suing the garage or pursuing that kind of legal action. I wanted to see which arguments I could raise when taking this up with the garage's head office, for me it is the principal of privacy and being a nuisance rather than any personal/legal damages. I feel some people may think that I am trying to make a claim, this is not the case so I just wanted to clear that up.

  • 10
    This must be the most modern-day-British thing I've read today.
    – towe
    Apr 2, 2019 at 13:32
  • 10
    So you are 100% certain that this salesman's cell phone is not provided to them and paid for by the dealership?
    – MonkeyZeus
    Apr 2, 2019 at 15:07
  • 9
    You gave them your number exactly so they could contact you. I'm confused how you think this could be a violation of GDPR.
    – Davor
    Apr 2, 2019 at 18:27
  • 3
    @RyanK That still does not prove that it was a 100% personal and non-business cell phone. I worked at a company where my employer covered 40% of my personal cell phone bill because I would be using it for both personal and business purposes. Him saying "sorry" just shows that they are sorry to have bothered you. Given the situation, you are only rightfully upset that they contacted you outside of business hours which is a legitimate complaint. You should add this detail to your question because unless you can prove that it was a 100% personal cell phone then all of this is just hot air.
    – MonkeyZeus
    Apr 2, 2019 at 19:18
  • 4
    @RyanK - you are looking at the wrong thing. It doesn't matter who owns the phone, all that matters is how data is being used. He didn't use our phone number to ask you to go have a beer, he contacted you purely for business reasons. This is completelly within reasonable use of data you consented to.
    – Davor
    Apr 2, 2019 at 21:01

1 Answer 1


This is possibly but not necessarily fine.

The data controller (the garage) is responsible for safeguarding your personal data. They must take appropriate safety measures, but this depends a lot on their own risk assessment. For example, to protect the data from being used by employees for their personal purposes, the controller might use organizational measures like a policy “you're not allowed to do that.”

Many companies allow employees to use their personal devices for work purposes (BYOD). When the data controller allows this and takes appropriate safety measures, everything is perfectly fine. The company still has to make sure that the data is only processed for legal purses and deleted afterwards.

Implementing a BYOD policy in a GDPR compliant manner is difficult but not impossible.

A data breach has occurred when the security measures were insufficient and your data was deleted or disclosed without authorization. Your scenario would only be a breach if the company did not have a BYOD policy and the salesman used their personal phone, and arguably then only if that device is also breached. However, do not discount the alternatives:

  • they do have a BYOD policy and the salesman is acting within their instructions
  • the salesman was using a company-controlled device, not their personal phone

If you have good reason to believe that your data was mishandled (and these alternatives do not apply), then the GDPR offers you the following remedies:

  • You can of course complain to the data controller, especially if they have a dedicated data protection officer.
  • You can lodge a complaint with a supervision authority, which is the ICO in the UK. They expect you to attempt to resolve your issue with the controller first. The ICO can then decide if they want to investigate the issue.
  • You can sue them for compliance and for actual damages suffered (you have none, though).

Note that all of these alternatives are more effort than they are likely worth. In particular, the garage can always correct the problem, e.g. by getting your contact info deleted from the personal device or by creating a retroactive BYOD policy.

  • Thanks for the detailed response, I think it will be a case of just taking it higher up the chain, I'm not looking for damages or anything just an acknowledgement from them that I never gave permission for him to contact me in this way.
    – RyanK
    Apr 2, 2019 at 11:33
  • 14
    Make sure you read all the small print of any data authorization you agreed to, before you say "you never gave permission"! In fact you don't know that is WAS his personal phone - it might have been a company-issued phone for work use only.
    – alephzero
    Apr 2, 2019 at 13:16
  • 4
    @RyanK Your permission/consent may not have been required for them to contact you via texts (might be allowed as their legitimate interest). This answer only discusses whether the sales person would have been allowed to communicate with you over a personal device.
    – amon
    Apr 2, 2019 at 13:49
  • 1
    @alephzero: Actually, reading the fine print might not be necessary. The GDPR requires consent to be requested separately from other matters using clear and plain language. Hiding it in the fine print doesn't count. That said, they don't need consent if they have another separate justification.
    – Brian
    Apr 25, 2019 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .