Your car is watching you. Who owns the data? Thorny questions about data privacy
Your car is watching you. Who owns the data?
Computers on wheels raise thorny questions about data
privacy
Gopal Ratnam Posted Apr 9, 2019 5:04 AM
The European Union has already ruled that data generated
by cars belongs to their owners.
If you’re driving a late model car or truck, chances are
that the vehicle is mostly computers on wheels, collecting and wirelessly
transmitting vast quantities of data to the car manufacturer not just on
vehicle performance but personal information, too, such as your weight, the
restaurants you visit, your music tastes and places you go.
A car can generate about 25 gigabytes of data every hour
and as much as 4,000 gigabytes a day, according to some estimates. The data
trove in the hands of car makers could be worth as much as $750 billion by
2030, the consulting firm McKinsey has estimated. But consumer groups,
aftermarket repair shops and privacy advocates say the data belongs to the
car’s owners and the information should be subject to data privacy laws.
Yet Congress has yet to pass comprehensive federal data
privacy legislation. And although Sen. Roger Wicker of Mississippi, chairman of
the Senate Committee on Commerce, Science, and Transportation, has said he
would like to see federal privacy legislation passed by the end of the year, it
is unclear if that goal can be met.
Financial technology is changing how we do business, and
regulators are trying to catch up
The European Union has already ruled that data generated
by cars belongs to their owners and is subject to privacy rules under the EU’s
General Data Protection Regulations or GDPR. Automakers, meanwhile, are still
trying to shape the outcome of state data privacy laws, including the one in
California that goes into effect in January 2020, but might be subject to
amendment before then.
The California law’s definition of personal information
extends beyond what’s generated by an individual to include household
information, and gives consumers the right to obtain data collected on them, to
stop third-party sales of that information, and to ask companies to delete
their information.
The Auto Alliance, a trade group representing the world’s
largest car makers, has appealed to the state’s attorney general, asking that
the companies be allowed to provide only summary information to consumers as
opposed to “specific pieces of personal information a business has collected
about them,” as the law requires.
Car companies track data by the vehicle identification
number or VIN and “may have little insight into who was driving the vehicle at
the time information was collected,” the Alliance said in a March 8 letter to
the California Justice Department.
If car makers were forced to provide consumers all
information tied to a vehicle, it may lead to “stalking or harassment risks,
endangering individual or public safety, or it may otherwise adversely impact
the privacy rights of non-owners,” the Alliance said. The group said a car may
be used not only by the owner but the owner’s spouse, ex-spouse, children and other
guests.
The alliance also said allowing car owners the right to
opt out of their information being shared with third parties could hurt
consumers.
Automakers often rely on third-party providers for
emergency and roadside assistance services, and curbing the flow of information
to those companies could be detrimental to safety, the Alliance said.
Joseph Jerome, policy counsel for privacy and data at the
Center for Democracy and Technology, a pro-civil liberties group, said
California needs to clarify how the state law would be implemented, but car
companies should not be excluded or given broad latitude in how data privacy
rules apply to them.
“Specific exclusion for cars wouldn’t make a whole lot of
sense, and we wouldn’t advocate for that,” Jerome said. CDT, a nonprofit
advocacy group, has proposed its version of a federal data privacy bill that
broadly mirrors provisions in the European and California laws.
Auto repair shops cry foul
Even as the car companies are trying to shape the outcome
in California, a trade group representing aftermarket mechanics and repair
shops says their members could be cut off from maintenance work if automakers keep
all the vehicle performance data to themselves.
As cars collect and share performance data with
automakers, “what happens if the mechanic down the street, who has been
servicing your car for years, can’t get that data from the vehicle
manufacturer?” asked Bill Hanvey, CEO of Auto Care Association, a trade group
that represents about 235,000 repair stores.
As of now, third-party mechanics are still able to access
car performance data under a 2014 memorandum of understanding between repair
shops and car makers. That agreement was reached after a law passed in
Massachusetts guaranteed the right of independent repair facilities to access
the same data as is available to a car dealership.
The data being collected by a car’s computers can be
downloaded through the onboard diagnostics port typically located under the
dashboard on the driver’s side of the car. But most modern cars have wireless
systems that can transmit the telematics data to the manufacturer. Consumer
Reports magazine estimated that 32 of 44 brands offered some form of wireless
data connection in their 2018 model-year cars.
By 2030 all cars on the road could be equipped with such
data transmission systems, said Aaron Lowe, senior vice president at Auto Care.
If all data can flow wirelessly to the manufacturer, it’s
likely the car maker could get rid of the physical data port, said Dwayne Myers
of Dynamic Auto, a Frederick, Maryland-based repair chain. “Right now I still
can access the data port, but I know they want to get rid of the data port, and
that’s what’s worrying.”
In such a scenario, aftermarket mechanics may either be
charged more to access the data, a fee that would be passed on to car owners,
or be completely cut off from the information necessary to do repairs. That
would cripple the industry that handles maintenance for three out of four cars
on the road, Myers said.
“Car owners will always be free to choose their auto
repair shop,” Scott Hall, a spokesman for the Auto Alliance said. Car companies
“have and will continue to provide independent repair shops with the data they
need to diagnose and repair consumer vehicles,” as per the 2014 agreement, he
said.
Third-party use of your car’s data
Automakers say they are abiding by a voluntary set of
guidelines they adopted in 2014 that provides car owners with notice and choice
on what information is being collected and how it’s used, minimizes data
retention, and provides reasonable security measures to safeguard data.
But privacy and consumer advocates say it’s unclear how
the principles have worked in practice and whether the voluntary guidelines are
sufficient to address new concerns.
The automakers’ principles do not, for example, mention
how they handle data requests from law enforcement agencies, Jerome from CDT
said.
Consumers are right to be concerned that, unknown to
them, data collected by car companies could be shared with law enforcement
agencies, just as online ancestry registries have shared DNA information with
investigators, said Sally Greenberg, executive director of the National
Consumers League. Drivers who connect their smartphones and other devices via
Bluetooth to their cars could be sharing their entertainment and eating habits
as well as their entire contacts list with the car’s manufacturer, or with a
rental car company, Greenberg said.
One of the measures Greenberg advocates includes asking
rental car companies to wipe the cars clean of all data on board before renting
the vehicle to a new driver.
Car companies may also be working with Spotify, Netflix,
Starbucks and others on how to increase sales for the latter without owners and
drivers realizing how their information is being used, Greenberg said.
“I take them at their word that they’re helping owners be
safe in their cars, but it also serves their own profit interests,” Greenberg
said. “Self-regulation is important and gives us a baseline on what the
industry ought to do, but it’s not a replacement for a comprehensive privacy
protection.”
Comments
Post a Comment