Jaguar OSH - no longer secure
 

It used to require a User Name and Password to login to Jaguar Online Service History (OSH). This meant that, apart from myself, only Jaguar Dealers and others with a TOPIx account could access my vehicle history. A direct consequence of this is all OSH logins and queries were auditable.

As of Tuesday 31/07/2018, access is now exclusively by VIN entry and no longer requires a Customer Account. This means anyone can access my vehicle history and I can access every other Jaguar and Land Rover vehicle history simply by viewing the mandatory displayed VIN on the vehicle and entering it on JLR website.

https://osh.jaguar.com/?brand=jaguar

How does JLR intend to audit logins to OSH for the response to information requests on when and by whom an owner's vehicle records have been accessed?

Graham

Well, the website confirms what GGG says but when I entered the VIN for my 2007 Sovereign, it comes up as a 2008, but tells me the car is not eligible for an on-line service history. So maybe there is more checking we are not aware of, like you need to register your VIN with a dealer or something.

I recall when OSH was introduced at around 2014 MY time, it was not retrospective for earlier models. However, Jaguar website no longer makes mention of any limitations other than geographical ( e.g.not available in the US) so this may have changed.

What has not changed is the claim:

You can rest assured that we have safeguards in place to protect your data. All of your Jaguar service history (including all scheduled services and related service items) will be stored securely online and is accessible only by Jaguar Approved Service Centres and you.

https://www.jaguar.co.uk/owners/serv...g-history.html

If this is what JLR considers data protection, it differs considerably from my view.

Graham

Land Rover Customer Experience Centre
 

Good afternoon all,

Thank you for your posts.

I can confirm that your comments have been passed over to the Data team who are currently completing a review of the concerns raised.

Once I have received an update I will be able to provide this to you.

Thanks, Stacie

So I had to check it out...
I certainly wish we had this service in NA.

I don't deny it's an excellent idea BUT more than a year later and I still haven't had a response from JLR about making data available to anyone who enters the VIN. At introduction, OSH required a user account and password to access vehicle data which was an appropriate level of security and confidentiality.

Graham

Well, I've just tried it and it works. However no owner information is given, so really I'm not sure why one should get worked up about it being "open".

I can walk past any JLR vehicle, take the VIN off the mandatory plate visible through the windscreen, put the number into OSH and out comes the history. No requirement for any identification from the enquirer. No checks or restrictions. As long as I own MY Jaguar that is MY data, not JLR's. JLR are not permitted to release or make it available without permission. They are in contravention of GDPR.

DVLA understand the restrictions and require a V5C number to access MoT history. JLR should have similar checks and balances. When OSH was introduced, it required an owner to setup a username and password to access records. I can see no sensible reason to remove this requirement and every legal requirement to retain it.

Graham

Good Morning Graham,


Thank you for your comment.


Whilst Jaguar have updated the Online Service History records, we have ensured that all personal details have been removed from the portal to ensure that this is not in breach of the GDPR Legislation.


Your comments have been passed to the relevant area of the business for them to consider in the future.


I apologise for any inconvenience that may have been caused.


Thanks,


Becci – Jaguar UK

Good Afternoon Becci,

Thank you for your reply. Good to see JLR is not completely at a standstill in these extraordinary times and I hope recent reports of (limited) production starting again are true.

OSH hasn't caused me any inconvenience at all. On the contrary, my observations are that it is now TOO convenient and lacks adequate controls.

I agree that personal details have been removed but it is still making personal data freely available. The original OSH requiring a User ID and Password was excellent. Data was restricted to those who should have access AND login ensured an audit trail of all enquiries. I would be interested to learn why this was changed.

Graham