Jaguar OSH - no longer secure
#1
![Default](/forum/images/icons/icon1.gif)
It used to require a User Name and Password to login to Jaguar Online Service History (OSH). This meant that, apart from myself, only Jaguar Dealers and others with a TOPIx account could access my vehicle history. A direct consequence of this is all OSH logins and queries were auditable.
As of Tuesday 31/07/2018, access is now exclusively by VIN entry and no longer requires a Customer Account. This means anyone can access my vehicle history and I can access every other Jaguar and Land Rover vehicle history simply by viewing the mandatory displayed VIN on the vehicle and entering it on JLR website.
https://osh.jaguar.com/?brand=jaguar
How does JLR intend to audit logins to OSH for the response to information requests on when and by whom an owner's vehicle records have been accessed?
Graham
As of Tuesday 31/07/2018, access is now exclusively by VIN entry and no longer requires a Customer Account. This means anyone can access my vehicle history and I can access every other Jaguar and Land Rover vehicle history simply by viewing the mandatory displayed VIN on the vehicle and entering it on JLR website.
https://osh.jaguar.com/?brand=jaguar
How does JLR intend to audit logins to OSH for the response to information requests on when and by whom an owner's vehicle records have been accessed?
Graham
#2
![Default](/forum/images/icons/icon1.gif)
Well, the website confirms what GGG says but when I entered the VIN for my 2007 Sovereign, it comes up as a 2008, but tells me the car is not eligible for an on-line service history. So maybe there is more checking we are not aware of, like you need to register your VIN with a dealer or something.
#3
![Default](/forum/images/icons/icon1.gif)
I recall when OSH was introduced at around 2014 MY time, it was not retrospective for earlier models. However, Jaguar website no longer makes mention of any limitations other than geographical ( e.g.not available in the US) so this may have changed.
What has not changed is the claim:
You can rest assured that we have safeguards in place to protect your data. All of your Jaguar service history (including all scheduled services and related service items) will be stored securely online and is accessible only by Jaguar Approved Service Centres and you.
https://www.jaguar.co.uk/owners/serv...g-history.html
If this is what JLR considers data protection, it differs considerably from my view.
Graham
What has not changed is the claim:
You can rest assured that we have safeguards in place to protect your data. All of your Jaguar service history (including all scheduled services and related service items) will be stored securely online and is accessible only by Jaguar Approved Service Centres and you.
https://www.jaguar.co.uk/owners/serv...g-history.html
If this is what JLR considers data protection, it differs considerably from my view.
Graham
#4
![Default](/forum/images/icons/icon1.gif)
As someone who purchased a used Jag, I would love this. Be great to know what services were performed by the previous owner. All Jag needs to do is edit out any previous owner personal information. I don’t see the harm in that? Granted, this doesn’t apply over here in the Colonies unfortunately.
#5
![Default](/forum/images/icons/icon1.gif)
Good afternoon all,
Thank you for your posts.
I can confirm that your comments have been passed over to the Data team who are currently completing a review of the concerns raised.
Once I have received an update I will be able to provide this to you.
Thanks, Stacie
Thank you for your posts.
I can confirm that your comments have been passed over to the Data team who are currently completing a review of the concerns raised.
Once I have received an update I will be able to provide this to you.
Thanks, Stacie
#7
![Default](/forum/images/icons/icon1.gif)
I don't deny it's an excellent idea BUT more than a year later and I still haven't had a response from JLR about making data available to anyone who enters the VIN. At introduction, OSH required a user account and password to access vehicle data which was an appropriate level of security and confidentiality.
Graham
Graham
Trending Topics
#8
#9
![Default](/forum/images/icons/icon1.gif)
DVLA understand the restrictions and require a V5C number to access MoT history. JLR should have similar checks and balances. When OSH was introduced, it required an owner to setup a username and password to access records. I can see no sensible reason to remove this requirement and every legal requirement to retain it.
Graham
#10
![Default](/forum/images/icons/icon1.gif)
I can walk past any JLR vehicle, take the VIN off the mandatory plate visible through the windscreen, put the number into OSH and out comes the history. No requirement for any identification from the enquirer. No checks or restrictions. As long as I own MY Jaguar that is MY data, not JLR's. JLR are not permitted to release or make it available without permission. They are in contravention of GDPR.
DVLA understand the restrictions and require a V5C number to access MoT history. JLR should have similar checks and balances. When OSH was introduced, it required an owner to setup a username and password to access records. I can see no sensible reason to remove this requirement and every legal requirement to retain it.
Graham
DVLA understand the restrictions and require a V5C number to access MoT history. JLR should have similar checks and balances. When OSH was introduced, it required an owner to setup a username and password to access records. I can see no sensible reason to remove this requirement and every legal requirement to retain it.
Graham
Thank you for your comment.
Whilst Jaguar have updated the Online Service History records, we have ensured that all personal details have been removed from the portal to ensure that this is not in breach of the GDPR Legislation.
Your comments have been passed to the relevant area of the business for them to consider in the future.
I apologise for any inconvenience that may have been caused.
Thanks,
Becci – Jaguar UK
#11
![Default](/forum/images/icons/icon1.gif)
Good Afternoon Becci,
Thank you for your reply. Good to see JLR is not completely at a standstill in these extraordinary times and I hope recent reports of (limited) production starting again are true.
OSH hasn't caused me any inconvenience at all. On the contrary, my observations are that it is now TOO convenient and lacks adequate controls.
I agree that personal details have been removed but it is still making personal data freely available. The original OSH requiring a User ID and Password was excellent. Data was restricted to those who should have access AND login ensured an audit trail of all enquiries. I would be interested to learn why this was changed.
Graham
Thank you for your reply. Good to see JLR is not completely at a standstill in these extraordinary times and I hope recent reports of (limited) production starting again are true.
OSH hasn't caused me any inconvenience at all. On the contrary, my observations are that it is now TOO convenient and lacks adequate controls.
I agree that personal details have been removed but it is still making personal data freely available. The original OSH requiring a User ID and Password was excellent. Data was restricted to those who should have access AND login ensured an audit trail of all enquiries. I would be interested to learn why this was changed.
Graham
Thread
Thread Starter
Forum
Replies
Last Post
JoeMaine
Audio/Visual Electronics
0
10-10-2013 04:26 PM
christer200
XJ XJ8 / XJR ( X308 )
1
05-10-2009 08:54 PM
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)