Connected vehicle owners should have ownership of generated data

Ronald W. Kosh

is vice president of public and government affairs for AAA Mid-Atlantic

With rapid advancements in wireless technology, "connected" cars have essentially become rolling smartphones. What has not kept pace is our understanding of data privacy and the ownership implications of information being generated.

Connected cars are providing a host of benefits to motorists. Depending on a vehicle's make and model, it could contain anywhere from a few dozen embedded microprocessors to more than 100 that improve safety, mobility, and convenience. Some control fuel efficiency and reduce emissions or operate safety systems like antilock brakes and vehicle stability. Others record mechanical and maintenance data that can predict component failure. The sophisticated navigation and infotainment systems consumers now expect require even more.

The advent of connected cars also means that motorist privacy is more important than ever. Features that are increasingly available are often made possible through the remote wireless collection of data from vehicles. It's essential that these innovations do not come at the expense of motorists' rights to understand and control how their data are being collected, used, and shared. For example, the locations visited, your driving style, and even musical tastes through telematics is recorded.

A recent report by the U.S. Government Accountability Office (GAO) on automobile telematics systems found that location-based data are being collected, stored, and shared. It also questioned whether consumers were aware of or in agreement with all the purposes for which their data were being used. This is similar to companies that sell their mailing lists or Internet companies that track the online activity of visitors. The GAO also noted that location data can be used to infer other sensitive information about individuals, such as their religious affiliation or political activities.

Where do these data go and who has access to the information? Is it anonymously aggregated or is it individually specific? How is it being used and how long is it stored? And what rights does the vehicle owner have to access it and to control its dissemination and to whom?

Unfortunately, today, motorists don't know the answer to those questions. AAA believes it's time they did.

Ensuring that vehicle owners can access and control the use of data their vehicles generate is a major consumer rights and privacy issue. Our view is that if you own the car, you own the data and you certainly should have control over the information. Just as a smartphone or tablet has privacy settings, a vehicle's owner should be able to solely determine what data are going to be shared and with whom.

When you register it and drive the car off the lot, you are the owner of the car (whether through outright purchase, financing, or leasing). You also own the tires, the engine, and the data your car generates and thereby the right to access and interpret that information as necessary. Today, independent auto repair shops don't always have access to data that allow them to interpret the computer codes necessary to repair important vehicle functions.

Owners can find themselves without choices on service because manufacturers can restrict access to information that consumers and technicians need to repair vehicles properly. By doing so, manufacturers can monopolize repair work that motorists might prefer to have done elsewhere.

To ensure that the benefits of connected vehicles do not come at the expense of motorists' privacy, the following principles should be implemented:

Transparency. Consumers have a right to clearly understand what information is being collected from their vehicle and how it is being used. Businesses and the government should be transparent about the collection and use of vehicle data.

Access. Consumers have a right to access the data that are collected by any vehicle they own.

Control. Consumers have a right to control what data are collected by or about their vehicle. This control should not be a "take it or leave it" proposition, and should include the ability to limit access depending on a motorist's personal preferences and services desired.

Choice. Consumers have a right to decide with whom to share their data and for what purpose. This includes ongoing monitoring of vehicle systems, repairs, and any data of the vehicle owner's choice. Customers should not be forced to relinquish control as a condition of purchasing, leasing, or servicing a connected vehicle.

Security. Consumers have a right to expect that connected-vehicle manufacturers and service providers will use reasonable measures to protect vehicle data systems and services against unauthorized access and misuse.