AMAG attaches huge importance to protecting all customer, employee, supplier and partner data. To do this, we take appropriate technical and organisational precautions to protect the information against unauthorised use. This comprehensive data protection, and strict compliance with the relevant laws, is embedded directly in the processes at AMAG, with clear rules and a series of checks. That is how we ensure the protection of data from within. Providing protection against attacks from outside is another top priority at AMAG – as part of our cybersecurity strategy.
We want to and have to be transparent with customers regarding what happens to their data.
AMAG has been working intensively on the issue of data protection for some time. Furthermore, the vast experience of the European data protection environment that we have gained through our Liechtenstein subsidiary AMAG Vaduz – following the introduction of the EU’s General Data Protection Regulation (GDPR) in 2018, for example – stands us in good stead. Data protection has become even more important in recent years due to the sharp rise in data volume associated with the use of cars – be it the transfer of technical information or digital offerings. This, in turn, is just as much down to the rising connectivity capacities of the vehicles as it is to the increasing popularity of digital solutions that facilitate modern mobility. Examples of this within AMAG include the offerings from Clyde, allride and Volton, as well as the AMAG app launched at the end of 2022, with the option of an integrated charging and credit card (see interview on page 36). The challenge lies in the fact that comprehensive data protection is complex in the case of such solutions because it is becoming increasingly difficult to identify the data flows and paths. That is why AMAG builds data protection concerns into such projects right from the start, taking account of the interfaces with the brands and coordinating these in each case.
The AMAG app makes vehicle processes easier for customers – when it comes to arranging a service appointment, for example. The app can also be linked to a charging and credit card or provide tips on how to drive ecologically, for example. Using the app results in an extensive exchange of personal and vehicle-related data between the users and their partners at AMAG. Susan Siemann (SSi), Group Data Privacy Officer at AMAG Group, and Michael Bertschi (MB), Project Leader for Digital Business at AMAG Retail and Project Leader for the AMAG app discuss how AMAG proactively ensures data protection and the challenges associated with this.
Why has AMAG launched its own mobility app?
MB: We want to provide AMAG customers with an app that is tailored to our products and services. The previous app from a third-party provider was no longer suitable for this. Therefore, at the start of 2022, we decided to launch our own app – an app capable of evolving in sync with our products and services. New customer-friendly aspects of the app include a recently introduced feature that allows users to arrange service appointments and a feature that enables them to submit claims reports. The app went live at the end of 2022. We will be migrating the users from the third-party provider to us in the first half of 2023, although this provider will remain responsible for the technical basis of the app.
Sustainable protection for companies
Companies in particular are often the focus of cyberattacks. In a video interview, Pascal Lamia, Head of Operational Cyber Security at Switzerland’s National Cyber Security Centre (NCSC), stresses that comprehensive cyber management is very important for a high degree of protection. He also explains the best way for companies to protect themselves against hacker attacks and why close cooperation with the federal government is crucial.
How complex is the procedure for ensuring data protection in the app?
MB: Very complex! All personal and vehicle-related data is sensitive. Each additionally activated service in the app therefore requires consent, ensuring transparency. The security of financial information and data is a top priority. The charging card, which can be linked to the app, allows the users to charge their electric cars at over 7000 charging points in Switzerland on preferential terms. Those who want to make things even easier also use the credit card feature, which brings with it additional data protection requirements.
What were the biggest challenges in the project in terms of data protection?
SSi: Identifying the data flows and the responsibilities for the data. We had to work together with the third-party provider to analyse exactly when we as AMAG are responsible for data and where the interface to our area of responsibility is. After this, precise data protection agreements and specifications were needed for the project. We want to and have to be transparent with customers regarding what happens to their data. This is also a requirement of the revised Swiss Data Protection Act, which applies from September 2023 onwards.
MB: As project leader, my concern was to integrate data protection fully right at the start rather than waiting until the end of the project. This involves more effort but is necessary for a secure solution.
SSi: Thank you for this foresight, Michael. AMAG Legal & Compliance has this image of being a spoilsport, particularly when we have to pause a project nearing its conclusion because of data protection concerns. This is avoidable if we are able to incorporate each of the data protection aspects at an early stage.
How do you convince the users of AMAG’s high data protection standards?
MB: Transparency and communicative aspects are very important. Here is one example: in many applications, the users can accept the general terms and conditions just by ticking a box – without even reading them; however, users registering for the AMAG app first see a separate consent screen, where we show exactly how the personal and vehicle data is used. Only after this can the users accept the General Terms and Conditions and give their consent for data processing.
SSi: I was thrilled about this idea with the screen. Furthermore, users can also register for the app as a person only – in other words, without the link between person and vehicle.
Is data protection also ensured when digital solutions are further developed?
SSi: Data protection is part of AMAG’s DNA – always. We are convinced that this systematic approach boosts customer loyalty and wins us new customers.
