Your car is watching you, but who owns the data?
WASHINGTON — If you’re driving a late model car or truck, chances are that the vehicle is mostly computers on wheels, collecting and wirelessly transmitting vast quantities of data to the car manufacturer not just on vehicle performance but personal information, too, such as your weight, the restaurants you visit, your music tastes and places you go.
A car can generate about 25 gigabytes of data every hour and as much as 4,000 gigabytes a day, according to some estimates. The data trove in the hands of car makers could be worth as much as $750 billion by 2030, the consulting business McKinsey has estimated. But consumer groups, aftermarket repair shops and privacy advocates say the data belong to the car’s owners and the information should be subject to data privacy laws.
Yet Congress has yet to pass comprehensive federal data privacy legislation. And although Sen. Roger Wicker of Mississippi, chairman of the Senate Committee on Commerce, Science, and Transportation, has said he would like to see federal privacy legislation passed by the end of the year, it is unclear if that goal can be met.
The European Union has already ruled that data generated by cars belong to their owners and is subject to privacy rules under the EU’s General Data Protection Regulations or GDPR. Automakers, meanwhile, are still trying to shape the outcome of state data privacy laws, including the one in California that goes into effect in January, but might be subject to amendment before then.
The California law’s definition of personal information extends beyond what’s generated by an individual to include household information, and gives consumers the right to obtain data collected on them, to stop thirdparty sales of that information, and to ask companies to delete their information.
The Auto Alliance, a trade group representing the world’s largest car makers, has appealed to the state’s attorney general, asking that the companies be allowed to provide only summary information to consumers as opposed to “specific pieces of personal information a business has collected about them,” as the law requires.
Car companies track data by the vehicle identification number or VIN and “may have little insight into who was driving the vehicle at the time information was collected,” the Alliance said in a March 8 letter to the California Justice Department.
If car makers were forced to provide consumers all information tied to a vehicle, it may lead to “stalking or harassment risks, endangering individual or public safety, or it may otherwise adversely impact the privacy rights of non-owners,” the Alliance said. The group said a car may be used not only by the owner but the owner’s spouse, ex-spouse, children and other guests.
The alliance also said allowing car owners the right to opt out of their information being shared with third parties could hurt consumers.
Automakers often rely on third-party providers for emergency and roadside assistance services, and curbing the flow of information to those companies could be detrimental to safety, the Alliance said.
Joseph Jerome, policy counsel for privacy and data at the Center for Democracy and Technology, a pro-civil liberties group, said California needs to clarify how the state law would be implemented, but car companies should not be excluded or given broad latitude in how data privacy rules apply to them.
“Specific exclusion for cars wouldn’t make a whole lot of sense, and we wouldn’t advocate for that,” Jerome said. CDT, a nonprofit advocacy group, has proposed its version of a federal data privacy bill that broadly mirrors provisions in the European and California laws.
Even as the car companies are trying to shape the outcome in California, a trade group representing aftermarket mechanics and repair shops says their members could be cut off from maintenance work if automakers keep all the vehicle performance data to themselves.
As cars collect and share performance data with automakers, “what happens if the mechanic down the street, who has been servicing your car for years, can’t get that data from the vehicle manufacturer?” asked Bill Hanvey, CEO of Auto Care Association, a trade group that represents about 235,000 repair stores.
As of now, third-party mechanics are still able to access car performance data under a 2014 memorandum of understanding between repair shops and car makers. That agreement was reached after a law passed in Massachusetts guaranteed the right of independent repair facilities to access the same data as is available to a car dealership.
The data being collected by a car’s computers can be downloaded through the onboard diagnostics port typically located under the dashboard on the driver’s side of the car. But most modern cars have wireless systems that can transmit the telematics data to the manufacturer. Consumer Reports magazine estimated that 32 of 44 brands offered some form of wireless data connection in their 2018 model-year cars.
By 2030 all cars on the road could be equipped with such data transmission systems, said Aaron Lowe, senior vice president at Auto Care.
If all data can flow wirelessly to the manufacturer, it’s likely the car maker could get rid of the physical data port, said Dwayne Myers of Dynamic Auto, a Frederick, Md.-based repair chain. “Right now I still can access the data port, but I know they want to get rid of the data port, and that’s what’s worrying.”
In such a scenario, aftermarket mechanics may either be charged more to access the data, a fee that would be passed on to car owners, or be completely cut off from the information necessary to do repairs. That would cripple the industry that handles maintenance for three out of four cars on the road, Myers said.
“Car owners will always be free to choose their auto repair shop,” Scott Hall, a spokesman for the Auto Alliance said. Car companies “have and will continue to provide independent repair shops with the data they need to diagnose and repair consumer vehicles,” as per the 2014 agreement, he said.
Automakers say they are abiding by a voluntary set of guidelines they adopted in 2014 that provides car owners with notice and choice on what information is being collected and how it’s used, minimizes data retention, and provides reasonable security measures to safeguard data.
But privacy and consumer advocates say it’s unclear how the principles have worked in practice and whether the voluntary guidelines are sufficient.
The automakers’ principles do not, for example, mention how they handle data requests from law enforcement agencies.