The Future of Privacy Forum (FPF) has released a new report that explains how safeguarding driver privacy and data protection will be critical to ensuring widespread acceptance of new safety technology in vehicles.

The report was released Wednesday while the National Highway Traffic Safety Administration (NHTSA) is working on establishing new requirements for safety technology that vehicle manufacturers will soon integrate into future vehicles, FPF said.

Privacy implications of vehicle safety systems explored by FPF include advanced driver assistance systems (ADAS) and driver monitoring systems (DMS) as well as impairment detection technologies.

FPF provides core recommendations for public and private entities that develop and enforce the technologies. Data from an Automotive Coalition for Traffic Safety survey on attitudes toward vehicle safety systems, while prioritizing privacy, is also included in the report. The survey results informed the recommendations.

“Vehicle safety systems can save lives and reduce injuries, but only if people use them,” said Adonne Washington, FPF data, mobility, and location policy counsel and author of the report. “Policymakers and auto manufacturers must consider the privacy and data protection implications for all drivers when incorporating new technology into vehicles to bolster driver trust and adoption.”

The survey found that many individuals value advanced vehicle safety technologies, but worry about the privacy risks, accuracy of the technology, cost, and data transfers to third parties. Respondents also said they generally trust carmakers’ data practices more than online companies and the government. However, they worry about vehicle systems that collect information about occupant behaviors, which according to a recent Mozilla study is becoming increasingly invasive.

According to Mozilla research, popular global brands — including Mercedes-Benz, Nissan, BMW, Ford, Toyota, Tesla, Kia, and Subaru — can collect deeply personal data such as sexual activity, immigration status, race, facial expressions, weight, health and genetic information, and where you drive. All of the 25 automakers researchers reviewed received failing marks for consumer privacy.

The New York Times reported earlier this month that vehicle manufacturers are sharing driving information with data brokers, such as LexisNexis, who then share the information with insurance companies. 

Respondents to the Automotive Coalition for Traffic Safety survey said they’re open to the incorporation of the technologies for safety purposes but, while doing so, companies need to have privacy and data protection practices like providing disclosure limits, encryption, on-car storage, and de-identification for users to trust the systems.

“Ensuring privacy protections in vehicles is necessary,” Washington said. “Privacy protections can’t be considered at the end of the process when developing technology and shouldn’t be considered in a vacuum, but rather privacy should be continually considered in regard not only to every stage of the development pipeline but also to any unique risks for marginalized or multi-marginalized individuals and communities.”

The 2021 Infrastructure Investment and Jobs Act requires NHTSA to establish a new Federal Motor Vehicle Safety Standard surrounding impaired driving technology.

In response, FPF’s report identifies five core recommendations that regulators and developers of those technologies should follow:

• 1. Ensure that privacy is a foundational principle for any vehicle safety system and should implement appropriate legal, policy, and technical safeguards when personal information is implicated;
  2. De-identify data collected by vehicle safety systems as appropriate, such as legal protections codified in statutes or rules, contractual limits on data use and transfers, enforceable public promises regarding data practices, or technical measures that minimize data collection, de-identify data, or delete information on a specified schedule;
  3. Ensure the accuracy of impairment-detection systems, test for potential bias, and eliminate the production of false-positive results more often for people from underrepresented, marginalized, and multi-marginalized communities. Well-defined standards for consistent deployment and alignment across the industry may be beneficial;
  4. Promote driver acceptance through transparency about vehicle safety system functions and operations as well as the handling of personal data; and
  5. Identify and mitigate, “to the extent possible,” potential future harms to drivers, especially to people from underrepresented, marginalized, and multi-marginalized communities.

Vehicle safety system driver profiles can combine multiple features and technologies to create a highly desired customized driver experience in terms of both safety and convenience, but privacy risks are exacerbated when personal data is aggregated into an identifiable format, according to the report.

“Data handling decisions can impact the risks related to the collection of that data,” the report says. “For instance, risks are often lowest when a system is designed such that personal information is only processed on the vehicle and not in a central database, such that it is never accessed or used by the manufacturer or shared with third parties. Another avenue for mitigating risk is in removing personally identifiable information. Data controllers in many industries take steps to ensure individualized profiles are de-identified. Unfortunately, this can be more difficult with vehicle-specific accounts, since Vehicle Identification Numbers (VINs) may be used to access full vehicle histories, including details on vehicle owners as well as other pertinent data.”

The report notes as well that impairment detection systems could collect data on race, gender, or other biological characteristics; physical, mental, or emotional health conditions, and some systems could link data to the GPS location of a vehicle, tying it to a specific address, such as a person’s residence or a certain place of business.

“Privacy risks may increase when data collected for one purpose (for instance, to prevent impaired driving) is used for another (like setting insurance options),” the report says. “Additional uses may be anticipated by the manufacturer itself or by partners and other third parties.

“Vehicle manufacturers have wide-ranging partnerships with companies and organizations with whom they could transfer personal information collected via in-vehicle systems, including outside companies who develop aspects of in-vehicle technology, insurance companies, law enforcement, or marketing and advertising platforms. Recent stories have demonstrated some of the harms that can occur when the risks related to sharing data with third parties manifest, including a lack of access to vehicle insurance.”

The survey found that 86% of respondents knew self-driving vehicles are on the roads, and 68% had familiarity with automated lanekeeping and adaptive cruise control. However, respondents were less familiar with other emerging car safety technologies — 55% of drivers said they thought the technology was helpful, and 32% said it was exciting.

Fewer drivers said some in-vehicle technologies are “invasive” (25%) and “creepy” (20%).

Inaccuracy and privacy risks topped the list of concerns respondents had about vehicle safety systems. The top concern was inaccuracy, with about 60% of drivers expressing trepidation about the technologies’ accuracy.  Privacy came in second, with just under half of drivers expressing concerns about how personal data might be collected, used, or disclosed.

Images

Featured image credit: bfk92/iStock