Data Misappropriation is Adversely Affecting the Collision Industry

For several years, members of the collision industry have voiced concerns over estimate information being shared without their knowledge and consent. Two years ago, at a Collision Industry Conference (CIC) in Pittsburgh, PA, the Society of Collision Repair Specialists (SCRS) Executive Director Aaron Schulenburg announced that he had been contacted by a company wanting to sell estimate data to SCRS members. The data was based on estimates written by shops that their competitors could use to contact potential customers and persuade them to repair their vehicles. 

Schulenburg said the company told him that it collects 86% of all quoted collision repairs in North America through its data aggregation partners, whether the quote is from a body shop or insurance carrier. The company also stated that data typically goes into its system within 24 hours of a customer taking their car for repair. 

The data includes personally identifiable information (PII), such as the consumer’s name, address, email, phone number, Vehicle Identification Number (VIN), insurance company and body shop. It also includes shop information, such as its labor rate, and detailed parts information.

The company said it could provide 138,000 quotes a day, share more than 62,000 VINs and over 329,000 quoted parts daily, equating to $71,947,069.31.

“This is an egregious example of how information taken from a shop can be nefariously misappropriated and resold,” said Pete Tagliapietra, managing director of DataTouch. “This is just an abysmal situation.”

To help educate the industry about the misappropriation of data, Tagliapietra shared information during a CIECA webinar in June, “What the Collision Industry Needs to Know about the Unauthorized Use of Its Information and Data.”

During his presentation, Tagliapietra discussed the magnitude of the problem and how the lack of data and information security is adversely affecting the collision industry.

Tagliapietra began his presentation by explaining the typical shop workflow and how third-party companies obtain customer and repair information. Whether a customer walks in for an estimate or the shop receives an estimate from an insurance company or the loss assignment from a third party, an estimate is created, calculated and saved. In most situations, Tagliapietra said it's automatically exported.

“The estimate is uploaded to the estimating provider and then passed on to their integrated supply chain partners, if warranted,” Tagliapietra explained. “If a shop is dealing directly with the supply chain provider, the estimate information is transferred through a data pump or a software control the provider has running.”

Tagliapietra said that as soon as that estimate is exported, it's copied and sent to the third-party provider, whether it's an order fulfillment or a service.

He generically identified some of the third parties obtaining this information and generating revenue from it through software controls and data pumps that take copies of estimates as they are prepared. They may include parts networks, repair information providers, original equipment manufacturer (OEM) certified repair networks (CRNs), information technology (IT) providers, third-party IT providers and multiple business management systems.

“If a third party is collecting shop estimate data, they have access to every piece of information on that estimate,” he noted.

To demonstrate the magnitude of the problem, Tagliapietra mentioned some information sources that collect data. They include state Department of Motor Vehicles (DMVs), local police departments, the National Highway Traffic Safety Administration (NHTSA) and National Insurance Crime Bureau (NICB), and other affiliated private sector companies, such as the Insurance Services Office. Additional information sources he mentioned include OEM repair information services, automotive parts suppliers (OEM, aftermarket and recycled), towing companies, independent and dealer group mechanical repair services, collision industry IT providers, automotive industry business management system providers and any supply provider that has a software control/data pump installed on a body shop computer system.

“Several of these services sell information, particularly to the vehicle history reporting companies, as well as other entities,” he said.

Any time an estimate is written and exported, Tagliapietra said the VIN and estimate are in the public domain.

Although the data isn’t necessarily being repurposed and sold, Tagliapietra stressed that anybody in the supply chain with a software control or data pump installed on the shop computer system is gathering estimate information.

“You can't limit your thinking and the possibility of who is copying data in a shop and where that information ends up,” he emphasized. “We must recognize that anybody who is in the automotive industry supply chain and/or has some type of business management software, there is a probability that information and data are being collected.”

Tagliapietra said the CIECA EMS Standard was successfully launched around 1996. Since that time, it has been implemented by the collision industry.

“The CIECA Standards that are available today have revolutionized e-commerce in our industry but CIECA’s charter does not include information and data security,” explained Tagliapietra.

From the extensive research he has done through DataTouch, Tagliapietra said, “We have yet to meet a data pump that doesn't grab every estimate that an independent shop or multiple shop organization generates.”

“If I'm a parts provider, whether it's OEM, alternative or recycled, why do I need the labor hours? Why do I need the labor rates?” noted Tagliapietra. “Why is it necessary to share that information?”

Tagliapietra also talked about the types of companies that may buy customer information and repair data. They include vehicle history reporting companies, parts manufacturers and suppliers, insurance reporting bureaus, and foreign and domestic OEMs. Other examples are information database resellers of body shop lists, customer and insurance policyholder lists, OEM and alternate parts procurement by zip code, vehicle market share by zip code and vehicle repairability and severity.

“It's not uncommon that an estimate can be written on a Thursday, and it shows up on a vehicle history reporting company's database the next day or Monday,” he said. “We've identified several instances of that occurring and reoccurring.”

State governments have started to take steps to address these challenges. Tagliapietra said that California, Colorado, Connecticut, Iowa, Utah and Virginia have enacted comprehensive consumer data privacy laws, with California being the most aggressive. In California, Tagliapietra said vehicle owners have the right to request that the body shop opt out of sharing information.

Seven additional states are in the process of passing legislation. Tagliapietra predicts the industry is at the very early stages of enacting legislation, and it will continue as the issue becomes more salient.

“We see the momentum growing for the state governments to understand the importance of protecting their customer information,” said Tagliapietra. “It is unquestionable that more states will follow with several acting on new legislation.”

Until recently, Tagliapietra said that resources weren’t available to help stop the copying of confidential personal information and repair data. However, software tools are slowly becoming available to assist shops and insurance companies in protecting their information.

New companies are offering services to remove personal customer and policyholder information before it is copied through a software control and data pump. They only allow the specific estimate to be shared with each member of the supply chain and IT provider. The tools can also segment the estimate repair line information so that only the needed data is sent to the supply chain provider.

Tagliapietra encouraged shops to research as these options become available to determine if they are a good fit.

“Until collision shops understand the value of the information and data they are creating and decide to take control, this long-standing issue will not go away and get much worse with artificial intelligence (AI) being implemented across our industry,” he said.