The ongoing discussion about auto body shop data privacy at the quarterly Collision Industry Conference (CIC) meetings took a new turn this summer when an association leader described what a data aggregator company had recently offered to sell to his organization.
Aaron Schulenburg, executive director of the Society of Collision Repair Specialists (SCRS), said the company contacted him, after speaking with one of SCRS’s state affiliate groups, to see if SCRS might be interested in acquiring data it has on recently-written collision repair quotes.
The company, which Schulenburg did not identify by name, told him the information could be used by SCRS member shops to contact consumers who received a recent estimate to say, “Hey, I know you’ve gotten a recent quote, and our business could do the work for you.”
Schulenburg asked what type of information was available. The company told him, “through our data aggregation partners and processes, we collect 86% of all quoted collision repairs in North America, whether the quote is taken through a body shop or any insurance carrier.” Even if that quote doesn’t reach an insurer, Schulenburg said he was told, “that data goes into our system within 24 hours.”
The 40-plus data fields the company said it has include on a daily basis more than 62,000 VINs and 135,000 quotes---written by shops or insurers. It includes customer name and contact information---address, phone and email---where the collision occurred and where the repair quote was generated. It includes nearly $72 million of quoted parts per day, and the year, make, model and mileage of vehicles along with body, trim and engine descriptions.
The revelation was of interest to a CIC committee that, like SCRS and other organizations, has been looking into how shop estimate information sometimes ends up as entries on vehicle history reports. Schulenburg said the company offering to sell the data was not one he, nor anyone else he has talked to about it, has heard of.
“The point here is not that they have this data, but it’s where they are getting it from,” Schulenburg said.
The founder of the company, who Schulenburg said he spoke to after the initial call, said a non-disclosure agreement prevented him from revealing the source of the data; he told Schulenburg he couldn’t say more because “if I answer too many questions, you’ll figure it out.” He said it was a company Schulenburg would know because their primary business model “has something to do in collision,” and that licensing the data to be sold is “just a side stream of revenue.”
He confirmed it was not coming from public registries, DMVs or police reports, Schulenburg said.
“It is coming from a data aggregator, who is selling it,” Schulenburg said. “There’s a lot of good companies out there that are utilizing data to do the right thing for this industry. And there’s at least one company who is not doing the right thing. There’s at least one company that is turning it into a separate revenue stream to take the information you shared with them for one intended purpose, and selling it to someone else to sell for an entirely different purpose that you didn’t intend.”
The leaders of the CIC committee, knowing Schulenburg’s long-standing work on data privacy issues, noted the irony that a data aggregator selling such information would contact him.
“It was a complete shock to us that something like that would fall into Aaron’s lap,” said Dan Risley of CCC Intelligent Solutions, co-chair of the committee. “I’m glad that it did, though, because I think more discussions will be had.”
Risley said it may be a good reminder that vehicle history reporting companies such as CARFAX “shouldn’t be viewed as ‘public enemy No. 1.’”
During the committee’s panel discussion following Schulenburg’s presentation, Connecticut attorney Steven Bloch said while issues related to shop estimates resulting in entries on vehicle history reports is troubling, the detailed estimate information being offered for sale poses even greater risks.
“What’s of great concern is that a VIN, certainly in combination with personal identifiable information such as Aaron was ticking off---the [customer] name, address, insurance company, plate number---all combines to potentially run afoul of various state and federal [data privacy] legislation, which is only getting stricter, with more scrutiny being paid to everybody in the supply chain,” Bloch said.
Panelist Pete Tagliapietra of DataTouch, LLC, agreed.
“The information going to the vehicle history companies is the ice above the waterline,” he said. “What’s below the waterline? For you shop owners out there, what’s below the waterline is all of your DRP relationship information: who you have DRP relationships with. What your negotiated labor rate is. Who you buy parts from. What discounts you offer. Anything that can be gleaned off that estimate is being taken, compiled and aggregated, and being used for other purposes.”
Though some believe estimate data finds its way to CARFAX or vehicle history reports after the VIN and other information is sent to “live” parts locating services during the estimating process, Tagliapietra blamed thousands of “data pumps” running on shop computer systems, scraping estimate data sometimes without a shop’s knowledge or consent.
Virginia shop owner Barry Dorn asked the panel how a shop can know a company that says it is only pulling limited estimate data needed for a specific purpose---like parts locating or customer satisfaction indexing---is actually doing only just that.
“You can’t. Not yet. But you will,” said Tagliapietra, whose company is developing a service to root out data pumps on shops’ computers systems.
Panelist Tom Allen of Condition Now said he understands body shops’ frustration with their estimate data resulting in an entry on a given vehicle’s CARFAX or other history report.
“The shop becomes the face of this incident,” Allen said. “The officer directing traffic [at the accident scene] may come and go. The insurance company may be just a voice on the other end of the line, or the other side of the app. But the first human we see in this instance is the shop. I believe they get the brunt of things, right or wrong.”
Allen said his company for about a decade has offered a way for body shops “to control the negative,” a way to use a vehicle history report to “show the good, not the bad,” by playing up the use of OEM parts in the repair of the vehicle, for example.
“Our goal is to actually document that stuff in a way that is helpful to Mrs. Jones, the customer,” Allen said. “To show, not only did we fix your car properly, it was done with OEM certified repair procedures.”
John Yoswick