WASHINGTON -- The world’s automakers have a message for customers: where you drive and how you drive is your business, not ours.
Cars are rapidly transforming into smartphones on wheels, sending enormous amounts of data to manufacturers over connected-car services such as General Motors’ OnStar or through built-in 4G data connections.
Hoping to harness this data to offer more services without eliciting an outcry over the misuse of personal information, BMW, Chrysler, Ford, GM, Honda, Hyundai-Kia, Mercedes-Benz, Nissan, Toyota, Volkswagen, Volvo, Mitsubishi and Mazda today agreed to industry-wide principles to handle consumer data and safeguard customer privacy.
The principles, crafted by the Alliance of Automobile Manufacturers and the Association of Global Automakers, two Washington, D.C., trade groups, will require the companies to receive permission for certain uses of data by model year 2017 at the latest, with a one-year extension available if engineering changes are required.
“Modern cars not only share the road but will in the not-too-distant future communicate with one another,” John Bozzella, president of the Association of Global Automakers, said in a statement. “Vigilance over the privacy of our customers and the security of vehicle systems is an imperative.”
"No one-size-fits-all"
Car companies have agreed to disclose to consumers the types of data they collect and how that data is to be used or shared. Disclosure will be made in owner’s manuals, on displays inside vehicles or on internet-based registration portals managed by the companies. Consumers will be able to review the policies before buying a car.
“There is no one-size-fits-all approach,” according to the protocols released by the companies.
The principles cover a variety of data that can be collected, including so-called geolocation information about a vehicle’s location, biometric data about a driver’s physical characteristics and details about driving behavior.
Car companies have also agreed to obtain permission from customers to use any personal information for marketing -- for example, to serve a customer an advertising message based on the driver’s past destinations and behavior. Also, automakers cannot, for example, provide insurance companies with driver behavior data that can identify a driver without that customer’s consent.
Sen. Ed Markey, D-Mass., who sent letters to 20 automakers last year asking how they protect consumers from cyber-attacks and privacy breaches, said the principles are an important step forward, but “fall short” in certain ways.
“It is unclear how auto companies will make their data collection practices transparent beyond including the information in vehicle owner manuals, and the principles do not provide consumers with a choice whether sensitive information is collected in the first place,” Markey said in a statement. “As vehicles are equipped with 21st century wireless technology, we need auto companies to make security and privacy as standard as seatbelts and stereos for drivers and their vehicles.”
He said he plans to release the findings of his privacy investigation “in the coming weeks,” and will call for hard-and-fast rules, rather than voluntary guidelines.
Terms and conditions
The sweeping moves are significant because data collection and disclosure has varied from company to company until now. By committing to a set of standard privacy practices, the industry hopes it can avoid new regulations that may stifle innovation.
Mitch Bainwol, president of the Auto Alliance, said the auto industry is committed to being transparent about customer data collection and usage by adding heightened protections for sensitive data and providing information to government authorities only under specific circumstances, such as under a court order or a warrant.
“Automakers believe that strong consumer data privacy protections are essential to maintaining the trust of our customers,” Bainwol said in a statement. “Our Privacy Principles reflect a major step in protecting personal information collected in the vehicle.”
Benefits, costs
Work on the new rules began in the spring using privacy protection standards including guidance from the Federal Trade Commission, the White House Consumer Privacy Bill of Rights and the Fair Information Practice Principles.
The car companies insist that the benefits of connected cars vastly outweigh the costs, by enabling vehicles to automatically call for emergency services, warn drivers about traffic jams and help car owners locate a lost or stolen vehicle.
But the risk of privacy breaches is clear, as Jim Farley, global vice president of sales and marketing at Ford, learned early this year.
"We know everyone who breaks the law, we know when you're doing it,” he said during a panel discussion at the CES trade show in Las Vegas. “We have GPS in your car, so we know what you're doing. By the way, we don't supply that data to anyone.”
Farley later retracted the statement, saying that he mischaracterized what Ford knows about its customers, but not before his comments sparked a wave of criticism.
Automakers could still use consumer data for other purposes, such as internal research, or to assist with the location of a stolen vehicle or for safety, diagnostics, warranty, maintenance or compliance purposes.
Scrubbing info
Automakers can also use data about drivers for various purposes so long as it is anonymized and scrubbed of information that could be used to identify an individual, as is standard practice at most companies using so-called big data.
The idea that car companies could use anonymized private data for research and product development without consent suggests that car companies could follow in the footsteps of Internet companies such as Facebook. The social media giant provoked criticism by recently disclosing that it intentionally experimented on customers to gain insights into their behavior.
Paul Schwartz, a law professor at the University of California who specializes in information privacy, praised the auto industry’s willingness to limit how long it retains information and use it for legitimate business purposes only. He said that companies outside the auto industry are grappling with a larger question: is it a breach of privacy to use an individual’s personal data, even if it’s scrubbed of any identifying characteristics that could trace it back to them?
“That’s a huge debate going on now in the age of big data,” Schwartz said. “I don’t think [this document] is necessarily where that debate gets resolved, and in a way, it’s not reasonable to expect the auto industry to figure out something that we, as a society, still have not figured out.”
