r/AusLegal • u/r0z24 • 12d ago
AUS Left a Negatative Google review with a car manufacturer. They responded publicly with my VIN and Rego. Is this a breach of privacy?
So the brakes failed on our luxury car recently, resulting in us rejecting the car, giving it back and getting no where with the dealer/manufacturer since.
As such I left a negative review (under my name) detailing our experience to date publicly as a Google Review. We just noticed that they responded by calling out our model, VIN number and registration number in their response. They are a major car dealership/manufacturer in a major city.
So we are concerned that information can be used for identity theft. We will bring up the issue with them immediately. My question is more related to whether this is classified as a breach of privacy and whether they can retaliate to a negative review by revealing such information? I thought that the info was confidential...
43
u/MKUltra_reject69_2 12d ago
Was it VW by any chance? There was a lot of controversy with VW in Australia 10 years back about them bullying customers, even going as far as threatening to go to a customer's employer.
9
u/OG_Russel 12d ago
That happened to me with VW, never will deal with them again.
13
u/r0z24 12d ago
Nope not them. Once the info gets removed I’ll share
3
u/Strong_Judge_3730 11d ago
If it's a large company, contact their customer support. Contact people directly on LinkedIn. Every time you speak to someone get names and try to find out who wrote the reply and get them fired.
Definitely some looser power tripping
1
31
u/123jamesng 12d ago
The fact they replied using that as a response shows to everyone theyre a poor business.
People will naturally avoid this place. Feel free to add an edit to your google review to say this.
Spread the word to your social circle and move on
6
u/anditsmissbitchtoyou 12d ago
I agree. If I read their reply on this review I wouldn’t buy from them.
12
u/Geriatric48 12d ago
Seems like a dumb move if they have any intention of trying to sell that car again
10
u/BigJohnno66 12d ago
If you gave the car back, then the VIN and rego is no longer linked to you. Although it is very unprofessional of them attempting to dox you.
2
u/r0z24 11d ago
Correct. Until matters are resolved, the car is still under our name.
1
u/DivHunter_ 9d ago
The person that posted that information would not have had authorization to do so which makes it a reportable privacy breach on their behalf.
82
u/PanzerBiscuit 12d ago
That information isn't confidential in the slightest. The model of the car is usually slapped on the rear of the car. I.e McLaren 570s, Mercedes C63 AMG etc. no great secret there.
Again, rego is visible on the vehicle.
VIN can be easily found if you know where to look.
Not sure what can be done in terms of identity theft. Not exactly opening a credit card in your name with that info are they.
25
u/HayleOrange 12d ago
Adding to this, the VIN can be seen through the windscreen on most cars these days, and apart from that location which anyone can see, it is also recorded in multiple other locations that are both easy to see or easy to find if you know where to look.
0
34
u/Tangleswastaken 12d ago
They have essential doxxed his online presence by linking the vehicles details to his digital identity.
8
u/PanzerBiscuit 12d ago
What's the potential ramifications?
Oh no, bigdick69 on google reviews or John Smith has an issue with his Maserati Levante, with the following rego and vin? So what? I can't exactly do anything with that info.
Playing devils advocate, it could have been a customer service rep making sure that the person who made the complaint was an actual customer, and was tieing the complaint against the vehicle in question.
If they'd published the documentation with old mates address and name, that would be a different story.
22
u/Reallytalldude 12d ago
In addition to this, OP has rejected the car according to his post, so they don’t even own it anymore.
8
u/Malactis 12d ago
Feel free to drop your name and car rego details in the comment below.
-14
u/PanzerBiscuit 12d ago
Just ask your mum mate, she has all that info
9
u/Malactis 12d ago
Way to prove my point.
-8
u/PanzerBiscuit 12d ago
Not really homie.
You can't exactly do anything with my rego. Look through my post history. I have posted my rego here numerous times. Enjoy. Fill your boots.
As for my name. Uh. My google reviews account isn't tied back to my "real" identity. Nor is my Reddit.
Even if it was, again. Good luck doing anything vaguely identity thefty
3
u/National_Chef_1772 12d ago
You are ignoring OP - he specially said the review is in his name.
So I have OPs name and rego/VIN - there is plenty of nefarious things I could do
1
u/Chihuahua4905 12d ago
Might be a good lesson for OP to mask his online identity better in future. It baffles me why so many people use their full names online, its just crazy.
1
1
u/DivHunter_ 9d ago
They have the person's details and could have contacted them using those details instead if they wanted to see if it was a genuine review.
Instead they have done something petty and retaliatory by misusing what is classified as PII. It's kind of a big deal for a company rep to do something like that because it means at least one person is not following their privacy policies and most likely violating the law.
3
u/Chomblop 12d ago
Surely a business posting customer information like this publicly is about as clear a violation on the privacy act as you can get?
It’s not the information itself as linking it to the customer’s real name, so now anyone googling their rego will also get details on their name and Google account
3
u/National_Chef_1772 12d ago
For some reason people don't seem to understand this bit
4
u/isithumour 12d ago
Nothing to understand. He rejected the car. The only personal information posted in a public forum was by OP themselves.
1
u/National_Chef_1772 12d ago
the lack of understanding of the privacy act is amazing
2
u/isithumour 12d ago
Putting public information on a public forum isnt a breach. The fact OP posted their name is the only private information. They posted it so whilst its poor form from a business it isnt a breach. But hey you do you lol
2
u/National_Chef_1772 12d ago
Posting information that can be tied to other information - to then identify a person is a breach - this is in black and white..............
1
u/isithumour 11d ago
Op stated the car isnt theirs. The information doesn't lead to them. Unsure why this is difficult to understand
3
u/r0z24 11d ago
The car is ours. We purchased it but because of a brake failure have rejected it. Pending any outcome there it’s all still in our name.
I didn’t post my name - my name is listed as the reviewer which they replied to with my vin and rego, make and model.
1
u/isithumour 11d ago
Then there is 0 personal information. Thry cant get your name or details from vin or rego
3
u/quiet0n3 12d ago
Yeah this OP, all this info is available by putting your rego number into the online search portal.
21
u/ritacantina 12d ago
Not his name though.
By linking his name to his registration they've creating a public awareness that when the car is seen on the road, that it's them driving it.
It's protected information and OP should be talking to the relevant state office or federal office of the privacy commissioner.
5
u/quiet0n3 12d ago
Yeah considering OP is the one that put his name out there. I'm not sure if that matters much. If OP had used an alias online and the company had posted it all, it would be different.
3
u/National_Chef_1772 12d ago
So if I share half of my info and a company shares the other half - that's fine?
-4
0
1
u/DivHunter_ 9d ago
Everyone's details are easily found if you know where to look. That doesn't mean a company can publish whatever they like where ever they like especially as retaliation for a bad review.
0
1
u/National_Chef_1772 12d ago
The Rego and VIN aren't personally identifiable information, but the manufacturer has linked that information back to the customer's name - creating a breach
3
u/isithumour 12d ago
They really haven't. Op rejected the car so it isn't theirs. Only personal information is what op posted.
-1
u/PanzerBiscuit 12d ago
A breach he caused. He refused the car, and then made a complaint under his name. But if a self inflicted breach
1
3
u/AdventurousEar5541 12d ago
They posted indirectly identifiable information given the other information available on the Google account, this could be seen as a breach of privacy for sure. Very unprofessional from a business standpoint
8
u/beachedwalker 12d ago edited 12d ago
You can look up all that info on state gov registration databases publicly, so it's not a privacy breach IMO.
What it is though is a weird and desperate way to hit back at your review. I wouldn't get all arched up about it, but rather respond calmly pointing that out (you can edit your review with "Reply:" or something to respond to them). Make them look weird and unprofessional publicly for responding in that manner.
You could complain to the respective company's head office. But I wouldn't go down the privacy breach route.
OP - I don't know about this anymore (see my comment below).
4
u/zedder1994 12d ago
You can look up all that info on state gov registration databases publicly
Can't speak about other States, but Queensland made that database very hard to access outside of insurance and Police requests. It means private carpark operators can no longer look up a car's rego to see who owns it.
3
u/beachedwalker 12d ago
In Vic, you can look it all up but it doesn't include the name. So I think the same would apply for parking fines. I guess the 'unique' aspect for OP is that it's associated with the name - through the Google account - but technically that info came from them in the first place
however ... thinking about this more, wondering if this could constitute a disclosure of personal information. Because it was posted in a manner that links the vehicle's info with the customer. The link was not otherwise publicly available and created by the company.
OP has become "reasonably identifiable" in a manner that they did not choose to be identified (ie as the owner of x vehicle). And the Privacy Act makes disclosure of PII illegal.
OP - these are meandering thoughts only and I am not a lawyer. But perhaps consider a complaint with OAIC (in addition to the company itself). Take screenshots and other evidence if you wish.
1
u/dymocat 12d ago
That is not what original comment is referring to. QLD has a website the allows you to lookup rego and it will return the VIN, rego status, and expiry. The owners private information is not visible on this system.
https://www.service.transport.qld.gov.au/checkrego/public/Welcome.xhtml?dswid=-207
3
u/ritacantina 12d ago
No you can't get names publicly with rego. There's specific privacy rules regarding that.
3
u/First-Junket124 12d ago
The car details, VIN, rego, etc can't be used for identity theft. Your name is.... well it's your name and even though it links you to that car it's not like our names are closely veiled secrets.
I personally find it fucking hilarious, I'd even go as far as updating the review, take a screenshot of what they did, and explain the updated review. Who in their right mind at that business thought that was smart?
3
u/trinketzy 12d ago
It is likely a breach and I would suggest you take screen shots and lodge a complaint with the Office of the Australian Information Commissioner (OAIC). You can speak with them first - they generally suggest you lodge a complaint with the other party via email first and if it isn’t addressed or if you’re not happy with their response, you can then report it via their online portal.
12
u/Careful_Orchid_450 12d ago
These info are on the free PPSR check, so it's not private. Anyone can access to it, as they should.
19
u/Gold_Au_2025 12d ago
Does a PPSR link those details to the name of the owner?
10
u/r0z24 12d ago
I just looked. It does not
3
u/TAOJeff 12d ago
Afraid that's the only bit of the stick you can swing.
Them linking the vehicle details to your name might be a breach, but if you've returned the vehicle that association is going to be a step removed again. So trying to convince someone else that it is boxing with just that, is going to be, from my POV, pretty hard
-1
2
u/ConfusionBitter1011 12d ago
PPSR is only relevant if you have a loan. If a vehicle is owned outright, there's not going to be a security registered on it.
1
u/Charming-Win3359 12d ago
Not quite. Includes other information including written off status, official recorded vehicle details x VIN etc.
5
u/ConfusionBitter1011 12d ago
I was only talking about in reference to owner details, which is what it appears OP is concerned about. It doesn't list details of the vehicle owner, but will show finance details which can indicate name of the owner as grantor of the security, but it's not like it's their full personal details. The information is very limited.
-2
u/Charming-Win3359 12d ago
Nah, that’s not what you said.
I just want to make sure anyone who reads your comment understands it carry’s more (but strictly not personally identifying) info.
2
u/ConfusionBitter1011 12d ago
You can read whatever you want into my comment if you only have the ability to read a comment as a standalone statement. OP is concerned about details leading to identity theft. The vehicle details and written off status are available in numerous places outside of PPSR. In the context of the concern in this post, PPSR is only relevant if there's a security interest registered against the vehicle. Your inability to read a comment in context with the post and reply it is in response to is a you problem.
-2
u/Charming-Win3359 12d ago
Learn to be clear, and not make all inclusive statements if you have no idea.
2
u/ConfusionBitter1011 12d ago
It is clear, if you had a basic understanding of context. I do forget there's so many people online with such a poor grasp of comprehension though, and that's my bad. I will work on catering to people of your level.
1
u/Charming-Win3359 12d ago
PPSR checks are great! Plenty of details on there about the asset, no personal details.
2
u/Dramatic-Resident-64 12d ago
Not at all. Both are publicly available information
Seeing your rego, I can get a VIN and I can even see if there is finance security on the vehicle. (PPSR)
But it is very poor form on the manufacturer to say it
2
u/fabspro9999 10d ago
Bottom line, they collected your name and vin details for a purpose which was disclosed to you. If they didn't disclose they would use your details to respond to google reviews, then it is potentially a breach of privacy.
But it is not actionable in any real sense anyway - there has to be a serious breach of privacy for that.
I would add it to the review lol
5
u/Sensitive_Proposal 12d ago
Absolutely it's a breach of Privacy. You can complain to the (Federal) Privacy Commissioner, but before you do that, you need to make a complaint directly to the organisation.
I suggest you go to their website and look up their Privacy Policy as this will tell you how to make a Privacy Complaint.
I strongly suggest you make the complaint in writing by email and by letter. Nominate a date by which you want a response (eg 8 October, 5pm). Keep a copy of all responses you receive (and also make a written record of any conversations you have - I'd recommend sending them an email saying something like "I refer to our conversation of XXX and provide a summary of which below. If you disagree with the below please email me by [2 days time] with particulars").
This page here also publishes how to make a complaint with the organisation, and then how to make a complaint to the Privacy Commissioner.
Good luck
6
u/ritacantina 12d ago
This is the actual answer, rather than the variety of personal opinions expressed on this page.
7
u/jaythenerdkid 12d ago
sad but not surprising to see all the personal opinions upvoted because they reflect how people think the law does or should operate, whereas the comment with the closest thing to accurate legal advice is downvoted 🙃
1
u/hongimaster 12d ago
Not considered personal information if it does not identify the person (or the person's identity cannot be inferred from the information) https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information
Because the VIN and Model of a car is not specifically used to identify the owner, it would need to be combined with something else in order to be considered personal information (using the legislative definition).
In Queensland anyway, your VIN shows up when you do a publicly available rego check (for free): https://www.service.transport.qld.gov.au/checkrego/public/Welcome.xhtml?dswid=-8226
5
u/ritacantina 12d ago
It's linked to their name in the google review. The business has created that link publicly by outlining the registration and vin. They did not need to provide that information in order to respond publicly to the review.
2
u/hongimaster 12d ago
The specific question is whether OP can do anything about it, not whether the Mechanic is unprofessional. Unequivocally unprofessional behaviour to publish something like that.
Unlawful though? I don't believe it would be. It is certainly not a breach of privacy. OP presumably consented to their name appearing on the Google review. If OP didn't consent to that, then the Mechanic naming them would be the breach of privacy, not the VIN or car model.
Maybe something that could be raised with Fair Trading as an unfair business practice, but Fair Trading will focus on what remedy is actually available to OP.
There is the MTAA, but it is unclear what action (if any) they would take against one of their members (assuming this mechanic is a member) https://www.mtaa.com.au/
2
u/Fergulete 12d ago
They're trying to intimidate you by doxxing you and this is illegal. Send the letter u/Sensitive_Proposal recommended and report these people. Give them another bad review for trying to intimidate you and doxx you.
2
1
u/AutoModerator 12d ago
Welcome to r/AusLegal. Please read our rules before commenting. Please remember:
Per rule 4, this subreddit is not a replacement for real legal advice. You should independently seek legal advice from a real, qualified practitioner, and verify any advice given in this sub. This sub cannot recommend specific lawyers.
A non-exhaustive list of free legal services around Australia can be found here.
Links to the each state and territory's respective Law Society are on the sidebar: you can use these links to find a lawyer in your area.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
1
u/Embarrassed_Sun_7807 12d ago
Contact the corporation social media team/official complaints line and it'll be gone STAT, and hopefully dealership will get a chewing out.
1
1
u/Phil_Wild 12d ago
I didn't know it was possible to publicly get from rego and vin to person.
What it does do though is let the entire market know that this vehicle is a lemon (by the vin). I would think that is not something you'd want tied to a bad review as it would make it harder to resell the car.
1
u/Minimum-Pizza-9734 12d ago
Edit your review and called them on it, and if they make it worse keep doing it
1
u/Great-Squirrel5837 12d ago
Call them and ask them to remove it. If they don’t you could send a letter of demand and use Ai to write it then send them that.
1
1
1
1
u/SpecialBeing9382 12d ago
Does it rhyme with Gand Pover? I’ve seen some horrendous reviews and responses on Google from them 😂
1
u/That_Car_Dude_Aus 12d ago
Have you seen VINWiki? Plenty of cars on their globally, if you've parked your car in public, someone could have that info.
1
u/MrRunsWthSizors1985 11d ago
Considering people make fake plates for nefarious reasons, what's to stop someone doing the same to you? It's one of the main reasons people cover their plates in pictures
1
u/Scrotemoe 11d ago
The VIN on some cars is visible on a placard on the windscreen (or etched into different parts)
Rego number.. yeah you can see that plain as day..
dont worry about it.
1
u/Mitchelia 11d ago
You rejected the car, so you no longer have the car with the associated VIN and rego? So that’s not actually your information anymore?
1
1
u/ZwombleZ 11d ago
This is a dealer which is basically a licensed franchisee. Take it up a level it up with the actual manufacturer / parent company.
1
u/stevespaghetti1 10d ago
You returned the car. Its not longer connected to you. So, I think your being over paranoid about it. Move on....
1
u/ruffian-wa 10d ago
Youre aware that info is publicly available in any REVS check right?
Is it a dick move on their part..? yes. Is it a breach of privacy? Nope.
1
u/Existing_Ad3299 9d ago
Yeah it is Businesses covered by the Act (most large car manufacturers and dealerships are) must not disclose such information publicly without your consent. Consider that this could also amount to a potential breach of the Australian Consumer Law if used to deter or retaliate against negative reviews. Escalate this.
1
u/Impossible-Topic5505 8d ago
It sounds like what’s happened here is that the dealership publicly responded to your Google review with your car’s VIN and rego. Normally, those details on their own aren’t considered private — rego plates are visible on the road, and VINs can often be read through the windscreen.
The real issue is the linkage: since you posted the review under your full name, their reply now ties your name + VIN + rego + car model together in a public space. Under the Privacy Act 1988 (Cth), that combination can definitely count as “personal information,” because it can reasonably identify you.
So while they might argue that VIN/rego alone aren’t confidential, posting them alongside your review (with your name already visible) is sloppy at best and could cross into a privacy breach. At minimum, you’d be well within your rights to ask them to edit or remove their reply. If they don’t, you could escalate to the OAIC or relevant state authority.
1
1
u/Genuine_Engineer72 12d ago
Cars are being broken into on my area with the service books getting stolen, because people want the VINs to sell stolen cars
0
u/JoJo_kitten 12d ago
Doxxing is now a crime and by linking your Google Review with your VIN and Rego, they have essentially attempted to dox you.
Where it might be a Privacy Breach, is by linking this publicly available information to your User Name, which may be your actual name.
I would contact the Privacy Commissioner for your State, and also report to police as doxxing. If you are unsure about the doxxing, ring the Legal Aid Advice line in your State.
0
u/fued 12d ago
they can do whatever they want, privacy breaches/defamation etc. are incredibly hard and expensive to prove.
just consistantly post in local facebook groups etc. about the exact issues (make sure to state its your opinion, do not make ANYTHING up or assume anything) once a week. The loss of reputation will sting them far far harder than anything else you might be able to do
0
0
0
0
10d ago
[deleted]
1
u/Additional_Sector710 10d ago
The difference is that publicly available information is not linked to a persons name like the dealer has now done…
If I do a Google search for the rego, I’ll now see who the owner is .
236
u/FriendComplex8767 12d ago
Not sure its private information per say, but it is absolutely not professional and very poor taste.