With Apple, Samsung and Uber among the 57 companies that are trialling AVs in California and elsewhere, the question of who will control access to the vast amounts of data they generate is of growing urgency
The autonomous vehicles now being piloted around the world have been described as “smartphones on wheels” because of the vast amounts of data they collect about their users and the vehicles and people they share the road with.
In fact, Apple and Samsung are among the 57 companies that by last month had permits to test autonomous vehicles (AVs) on California’s roads. In Europe, Nissan has been testing its vehicles in London, and BMW has built a centre of excellence for autonomous driving near Munich. In China, e-commerce giant Alibaba is one of the latest tech companies to start testing self-driving cars.
We may be some years away from truly autonomous vehicles, but privacy issues are already with us. Advertisers and tech companies would like to get their hands on the data generated by today’s connected cars, and BMW revealed it had turned down requests to share its data as far back as 2015.
The data already being generated by vehicles could be valuable to governments, insurers and the police, as well as companies
In 2014 a senior Ford executive, Jim Farley, made comments at an electronics convention revealing that the company knew whether owners of its cars had broken speeding laws, though he added that Ford didn’t supply that data to anyone. He later withdrew the statement, saying he was speaking hypothetically: the company didn’t track its customers without their approval or consent.
Hypothetical or not, the comments highlighted the fact that the data already being generated by vehicles could be valuable to governments, insurers and the police, as well as companies. This data isn’t just what is collected from the cars’ trademark outward-facing cameras, but all the other data that gets generated such as location, personal data through the apps that provide services, and car-to-car and car-to-infrastructure communications, some of which will be useful and some you may prefer others not to have.
John Verdi, vice-president of policy at Washington thinktank Future of Privacy Forum, points out that self-driving cars will collect data about where and when an individual travels from one place to another, making individuals potentially vulnerable to being stalked or having their home broken into.
When you get to full autonomy, he suggests, there’s also the question of how the presence of a live individual or a package in the vehicle gets verified technologically and who can look at that data.
So how will that data be used; how long will it be kept; in what form, and how securely?
At the moment, smartphone users can exercise some control over the vast amounts of data we give away. Verdi points out that consumers “can and do make choices about the data they give, the permissions, location history they enable or disable; they decide whether to take their phone; whether to connect via Bluetooth, or enable Wi-Fi”.
Consumers won’t be in the driving seat with the data that is harvested, putting the onus for responsible usage on manufacturers
However, consumers won’t be in the driving seat with the data that is harvested for self-driving cars due to real-time safety considerations, putting the onus for responsible usage on manufacturers: “If you aggregate or delink the data I think that one can glean a fair amount of safety benefit,” says Verdi. “Then the question becomes what are appropriate time limits.”
Uber, which has been hauled up in the US for “deceiving consumers” about its privacy and data security practices, said in an emailed response to questions that the data the company collects in self-driving trials is used to inform its track tests and simulation scenarios.
The company currently has a standard holding period for data, but does not provide detail around that. But it asserts that autonomous vehicles won’t drastically change the situation for Uber riders because its existing business doesn't offer anonymous trips; nor will AVs collect additional data from the rider.
Europe is leading the way on privacy legislation (see Europe’s privacy revolution ‘far from over’). Since May, data protection has been controlled by the General Data Protection Regulation (GDPR), which aims to strengthen data protection across the EU, and restricts the transfer of data outside its borders. Importantly, the GDPR requires data to be considered at the design stage, so data protection is incorporated from the beginning – so-called “privacy by design”.
The EU also has a connected-cars strategy, and recommendations are expected later this year on an automated mobility strategy that will include cybersecurity. But at its heart is the notion that data produced by connected cars is personal data, and so how it is used falls under the GDPR.
The EU strategy document says: “Users must have the assurance that personal data are not a commodity and know they can effectively control how and for what purposes their data are being used.”
If we want to use the data for other purposes than operating the service, we need to ask the user for explicit consent
Richard Benjamins, data and artificial intelligence (AI) ambassador at Spanish telecoms company Telefónica, told Ethical Corporation that this could be achieved by “managing data as an asset with proper governance, security and privacy rules. At any moment it needs to be known what data is stored and used for what purpose”.
Last year, Telefónica and carmaker SEAT teamed up to work on digitalization in the automotive sector, including testing new technologies for 5G networks in Spain that will be needed for autonomous driving. The announcement stated that the agreement “provides for the implementation of tools and joint mechanisms that facilitate data collection, management and analysis, all while respecting the principles of privacy, confidentiality and transparency of user-owners. In addition, both companies will work together to explore the benefits of Big Data and the shared use of data in designing new mobility proposals.”
Benjamins points out that “if we provide the vehicle with a SIM, then we know the location of the vehicle, which is used when a crash happens, for instance, to notify authorities. All this personal data is protected under GDPR. If we want to use the data for other purposes than operating the service, we need to ask the user for explicit consent.”
He adds: “We need also to provide the security level adequate to the risk to which the personal information may be exposed.”
The UK, which wants to be a world leader in self-driving technology, has set up a Centre for Connected and Autonomous Vehicles. One of the projects it funded is looking specifically at how users might be able to control who discovers – and hence who can access – the data generated. The UK’s Information Commissioners Office, whose job is to uphold individuals’ data privacy rights, plans to issue a call for evidence on connected and autonomous vehicles to help it understand public attitudes towards the technology and to find out what steps vehicle manufacturers and technology providers are taking to address data protection concerns.
In the US in 2014, 20 global car makers signed up to a series of privacy principles; “a good first step by automakers,” suggests Verdi. The principles include: “Obtain affirmative consent before using geolocation, biometric, or driver behavior information for marketing and before sharing such information with unaffiliated third parties for their own use.”
In the US, the view now is preference for self-regulation. Some privacy advocates and some in the Senate disagree
The alliance later followed up with a framework for best practice in automotive cyber security. “In the US, the view now is preference for self-regulation. Some privacy advocates and some in the Senate disagree,” suggests Verdi. However, he points out that the Federal Trade Commission, which doesn’t have any statutory authority on connected vehicles, does have the authority to make sure the companies that make public assurances actually keep their promises.
It’s clear there is much thinking to be done: technologies and services are still evolving; while regulations and standards are still being formulated in many jurisdictions. The current state of play is perhaps summed up by Nissan’s response: “We have robust plans in place that keep evolving as the technology evolves. Due to the nature of our security planning, there is a lot that we cannot share publicly.”
At some point the public is going to want to know.
Angeli Mehta is a former BBC current affairs producer, with a research PhD. She now writes about science, and has a particular interest in the environment and sustainability. @AngeliMehta.
This article is part of the in-depth Ethics of digitization briefing. See also:
Autonomous vehicles online privacy Big data Uber personal data Future of Privacy Forum GDPR Centre for Connected and Autonomous Vehicles