Do I need customer consent to license de-identified job records?

The short answer: four factors decide it#

Customer consent for licensing de-identified job records turns on four factors, and the answer can differ for two contractors running the same software. Counsel weighs them together; none settles the question alone.

Counsel will also ask what the buyer may do with the data. A license limited to model training and evaluation, with bans on re-identification and on contacting anyone in the records, is a different proposition from an open-ended transfer.

Why removing names is not enough for job records#

Removing names is not enough for job records because the service address identifies a household on its own, and home service systems are organized around addresses. An address combined with a visit date and an equipment model can point to one home with every name stripped out.

Free text and attachments add more identifiers. Technician notes mention gate codes, pets, family members, medical equipment in the home and callback numbers. Photos capture house numbers, parked cars, faces and the rooms a technician worked in. Call recordings carry voices and account details.

Treatment for job records therefore usually means generalizing addresses to a broad area, coarsening or shifting dates, scrubbing notes with automated tools plus human review, and excluding photos and recordings unless they can be fully cleaned. A scanner is a first pass, not a verdict. The maintainers of Presidio, an open-source PII detection tool, say in its documentation that automated detection cannot promise to catch every sensitive item and recommend layering other protections on top, such as a person reading samples of scrubbed technician notes.

What did your privacy notice tell customers?#

Your privacy notice is the first document counsel reads, because it records what customers were told when their information was collected. Many contractors adopted a template notice years ago and have edited it since, so the useful step is to collect every version with its dates, not only the current one.

Look for language about uses and disclosures: providing services, improving services, sharing with service providers, sharing with third parties, and any promise that customer information is never shared or sold. Maintenance membership agreements sometimes carry their own privacy terms, and online booking pages may link to a separate notice.

Updating the notice is often part of the plan, but changes generally apply going forward. Records collected under an older notice may be assessed against that older text, which is one reason some contractors start by licensing only records created after an update.

Which contracts can restrict licensing job records?#

Contracts can restrict licensing job records even where privacy law would not, so they belong in the same review. In home services the most common ones sit with commercial customers, third-party payers, software vendors and the franchise system.

Treat each restriction as a scoping decision rather than a stop sign. Records from a restricted source can be excluded while the rest of the archive proceeds, and the exclusion is written into the license so both sides know what was left out.

• 1Commercial service agreements with property managers, facilities teams or general contractors, which often treat site and job information as confidential.
• 2Home warranty company and insurance program agreements, which may govern records of jobs they dispatched or paid for.
• 3Franchise agreements, which may give the franchisor rights over customer data or require approval before any outside use.
• 4Field service platform and call recording vendor terms, which shape what you can export and how.
• 5Manufacturer and distributor programs that receive warranty registrations and claim details.

Record by record: where consent questions are hardest#

Consent questions are hardest for records that carry identity in ways a field mapping cannot fix. Structured fields are the easiest to treat; photos and recordings are the hardest, and many first licenses leave them out.

Illustrative: a roofing company scopes a cautious first package#

Illustrative: a fictional residential roofing and gutter company works in two neighboring states, keeps jobs, inspections and warranties in a field service platform, and stores inspection photos in a separate photo app. Some of its work comes through insurance claims and some through an agreement with a property management firm.

Counsel collects three versions of the website privacy notice. The oldest says nothing about third parties; the two newer ones describe sharing with service providers and use to improve services. Counsel also reads the property management agreement, which treats site information as confidential.

The owner approves a narrow first scope: structured inspection and repair fields, with addresses generalized to a broad region, dates coarsened to the month, technician notes scrubbed and sampled by a reviewer, and photos and claim correspondence excluded. Property management jobs stay out, records from the oldest notice period are held back pending further review, and the notice is updated for future customers. The license bans re-identification and any contact with homeowners.

Keep a record of how the question was answered#

A record of how the consent question was answered matters because the analysis has to be shown later, not just concluded once. Buyers increasingly expect provenance metadata with licensed data; the Data & Trust Alliance's Data Provenance Standards, for example, include elements for consent documentation location, privacy-enhancing technologies applied and intended data use.

For a contractor that means a short file: the notice versions reviewed, the contracts checked, the de-identification method and its test results, the approved scope and the restrictions placed on the buyer. That file is what lets you answer a customer, a franchisor or a future acquirer with confidence.

How SourceX handles the consent question#

In the SourceX five-step transaction, consent belongs to Rights, the second step, which is completed before Preparation begins and before any job record leaves your systems. Nothing is shared during the initial fit check, which asks only which systems hold job records, how many years exist and which record types are involved.

Your counsel reaches the legal conclusions; SourceX organizes the inputs and records the outcome. The privacy record and release authorization in the SourceX Evidence Packet document the notices and contracts reviewed, the de-identification applied and the scope the owner approved, and nothing is released without that approval.