The Next Data Privacy Battle May Be Waged Inside Your Car

The New York Times

By JACLYN TROP

JAN. 10, 2014

 

Cars are becoming smarter than ever, with global positioning systems, Internet connections, data recorders and high-definition cameras. Drivers can barely make a left turn, put on their seatbelts or push 80 miles an hour without their actions somehow, somewhere being tracked or recorded.

Automakers say they are only responding to consumer demand, and besides, they and regulators say, the new technologies help them better understand consumers and make the cars safer. But privacy advocates increasingly see something more unsettling for drivers: that someone is always watching.

Now two senators are trying to give car owners more say over some of that data. Early next week, Senator John Hoeven, Republican of North Dakota, and Senator Amy Klobuchar, Democrat of Minnesota, will introduce a bill stipulating that car owners control the data collected on the device called the event data recorder. The recorder, commonly known as a black box, collects information like direction, speed and seatbelt use in a continuous loop. It is in nearly every car today, and in September, it is set to become mandatory.

“We’ve got real privacy concerns on the part of the public,” Senator Hoeven said in a telephone interview. “People are very concerned about their personal privacy, especially as technology continues to advance,” he said, referring to revelations of spying by the National Security Agency. Fourteen states have already passed similar laws.

The data collected by the black box has already been the center of litigation by law enforcement agencies and insurance companies seeking to use the information against car owners. The bill would limit what the data could be used for and would require a warrant to release the data without the owner’s consent.

But even this legislation covers only part of what is a rapidly evolving technological landscape.

At the International CES in Las Vegas this week, automakers and technology companies announced a stream of new products and services aimed at making cars more connected.

Google announced it had a partnership with G.M., Audi, Honda and Hyundai to bring its Android platform to vehicle infotainment systems by the end of this year. At the same time, G.M. said it would start an app shop, where drivers can use apps like Priceline.com to book a hotel room and CitySeeker, which provides information about attractions and restaurants near the vehicle.

The days of a driver being alerted to a deal at a retailer as he drives nearby are rapidly approaching.

Many consumers, though, are unaware of just how much personal information is collected and used, privacy advocates say.

“Manufacturers do a poor job of informing consumers and explaining the privacy implications of new technology,” said Khaliah Barnes of the Electronic Privacy Information Center, a consumer group based in Washington. “Often, that information is in the owner’s manual, and when’s the last time you thumbed through your owner’s manual?”

It didn’t help the automakers’ reassurances about their handling of data when Jim Farley, Ford Motor Company’s top sales executive, who is known for making off-the-cuff comments, told a panel at the CES: “We know everyone who breaks the law. We know when you’re doing it. We have GPS in your car, so we know what you’re doing.” Although he quickly added, “By the way, we don’t supply that data to anyone,” and later issued a full retraction, the comments, even if overblown and meant to be provocative, fueled the concerns.

Vehicle owners, Ms. Barnes said, should be able to request the information manufacturers record and delete information at their discretion.

“Consumers should decide what level of surveillance they want to be under,” Ms. Barnes said. “None of that should be on default. You should have to opt in.”

Automakers say that consumers are eager for the new products. At the CES, G.M. introduced a new camera in the 2015 Corvette Stingray designed to give track enthusiasts real-time feedback on their driving. The performance data recorder, as it is called, uses a camera mounted on the windshield and a global positioning receiver to record speed, gear selection and brake force.

The Corvette’s system goes further than traditional black boxes.

A camera mounted on the windshield records the driver’s point of view and a microphone in the cabin records any noises made in the car.

Chevrolet said that the consumer owned the data, which is collected in a digital card housed in the glove compartment.

But privacy lawyers say that the information can still be used against a driver, as well as G.M. and its suppliers, in litigation or by an insurance company investigating a driver’s habits.

“The privacy and liability issues associated with the P.D.R. are as real as with any archived data that can be used by or against individuals,” said William Kohler, a lawyer at Clark Hill in Detroit.

The new brainpower in cars puts the industry in new territory with security and data privacy, said Thomas Kowalick, an expert in event data recorders and a former co-chairman of the federal committee that set the standard for black boxes.

“The major concern is not what an E.D.R. gathers now but that future in-vehicle technologies will make it possible to virtually record and track a vehicle’s movement from point A to point B,” Mr. Kowalick said.

Garmin introduced a new windshield-suctioned camera that turns on automatically when the car starts. It records wide-angle footage as well as speed, location and time in the event of a collision, and also has a microphone that can record sound from within the car.

“We hope it takes some of the ‘he said, she said’ out of an incident in your car,” said Ted Gartner, a spokesman.

He said the device’s owner also owned the data and that Garmin could not access it.

“There’s no way that we have access to that data because there’s no way to transfer the data out of the car wirelessly,” Mr. Gartner said.

Despite these and other assurances, the new products are attracting scrutiny in Washington.

On Monday, the Government Accountability Office released a report stating that some automakers were keeping private data collected from onboard navigation systems and mapping apps for varying lengths of time and that car owners could not request that it be erased.

The report, which was requested by Senator Al Franken, Democrat of Minnesota, found that the 10 automakers, navigation device manufacturers and application developers surveyed did not make owners aware of all the risks of the data collection, like allowing third parties to track their location or gather sensitive information such as their religious and political activities and preferences.

“Information about your location is extremely sensitive,” said Senator Franken, who is chairman of a Judiciary subcommittee on privacy and said he planned to introduce a bill that would legislate guidelines on when a vehicle owner’s location could be shared. “If someone has a record of your location, they can figure out where you live, where you work, the doctors you visit and where your kids go to school.”