BMW Group has apologised after an Auckland BMW dealership took 1500 email addresses gained through the compulsory airbag recall process and added them to its marketing email database, against its own privacy policy.
Owners of certain BMW models were contacted earlier this year as part of the Takata airbag recall and asked to provide their details to a dealership in order to have the repair work carried out.
The sign-up page on the BMW New Zealand website has a hidden drop-down section where it says the data they collect "is handled in accordance with our privacy policy" and that "we only use it for our business purposes, including customer care, marketing and research".
The full privacy policy, which is not linked to from the sign-up page, promises to only use collected information "for the purposes you provided it to BMW" and to "send you email messages to market or promote BMW goods and services only if you have expressly signed up for the email updates on BMW's website".
No simple opt-out function is provided at the sign-up page - users are required to either phone BMW New Zealand or email their privacy department and ask to be excluded from advertising emails.
The policy said information would be passed on to dealers, but only if they complied with BMW New Zealand's policy.
A spokesperson for BMW New Zealand said "Auckland BMW and the BMW Group NZ prioritises the security of customer personal data and unreservedly apologises for any issue arising from this matter".
Do you have a news tip? Email luke.appleby@tvnz.co.nz
They said the automatic process used to add the addresses to their database has now been changed and "a review of relevant procedures and processes has been initiated.
"Compliance training programs will be reviewed for both dealership and corporate staff."
David Crawford says motorists need to act on the recall, as the airbag units become more risky as time goes by.
Auckland City BMW Managing Director Ian Gibson told 1 NEWS "we take these matters very seriously and it is certainly not our intention to send out spam emails.
"We have stopped all marketing communications to customers whilst we review our data base processes."
A spokesperson for the Department of Internal Affairs, which is responsible for regulating the Unsolicited Messages Act, said while the practice did not appear to directly breach the Act, they were critical.
"[Users] have been directed to the platform because of a recall issue, which BMW are obliged to facilitate," the spokesperson said.
"Directing users to a platform which is necessary for product recall that then subscribes the user to receive further commercial electronic messages is not considered best business practice.
"It does not appear that the Act has been breached in this instance, however this does question the intentions of BMW to choose such a process and whether the wording of the Act and whether consent in particular, is appropriately defined to consider this type of activity."
A spokesperson for the Office of the Privacy Commissioner said "this isn't best privacy practice and I can see a lot of areas where BMW could improve ... allowing people to opt-in is better privacy practice than making them opt out".
Of the 35,000 vehicles that still need to be repaired as part of the compulsory airbag recall, almost 17,000 of those are in the Auckland region.
In July this year , optometrist and eyewear retailer Bailey Nelson also apologised for spamming customers after a number of people were signed up to its email marketing list without consent.
The practice is illegal in New Zealand under the Unsolicited Electronic Messages Act and carries a maximum fine of $500,000 for an organisation.
SHARE ME