If you’re driving a late model car or truck, chances are that the vehicle is mostly computers on wheels, collecting and wirelessly transmitting vast quantities of data to the car manufacturer not just on vehicle performance but personal information, too, such as your weight, the restaurants you visit, your music tastes and places you go.
A car can generate about 25 gigabytes of data every hour and as much as 4,000 gigabytes a day, according to some estimates. The data trove in the hands of car makers could be worth as much as $750 billion by 2030, the consulting business McKinsey has estimated. But consumer groups, aftermarket repair shops and privacy advocates say the data belong to the car’s owners and the information should be subject to data privacy laws.
Yet Congress has yet to pass comprehensive federal data privacy legislation. And although Sen. Roger Wicker of Mississippi, chairman of the Senate Committee on Commerce, Science and Transportation, has said he would like to see federal privacy legislation passed by the end of the year, it is unclear if that goal can be met.
The European Union has already ruled that data generated by cars belong to their owners and is subject to privacy rules under the EU’s General Data Protection Regulations or GDPR. Automakers, meanwhile, are still trying to shape the outcome of state data privacy laws, including the one in California that goes into effect in January, but might be subject to amendment before then.
The California law’s definition of personal information extends beyond what’s generated by an individual to include household information, and gives consumers the right to obtain data collected on them, to stop third-party sales of that information, and to ask companies to delete their information.
The Auto Alliance, a trade group representing the world’s largest car makers, has appealed to the state’s attorney general, asking that the companies be allowed to provide only summary information to consumers as opposed to “specific pieces of personal information a business has collected about them,” as the law requires.
Car companies track data by the vehicle identification number or VIN and “may have little insight into who was driving the vehicle at the time information was collected,” the Alliance said in a March 8 letter to the California Justice Department.
If car makers were forced to provide consumers all information tied to a vehicle, it may lead to “stalking or harassment risks, endangering individual or public safety, or it may otherwise adversely impact the privacy rights of nonowners,” the Alliance said. The group said a car may be used not only by the owner but the owner’s spouse, ex-spouse, children and other guests.
The alliance also said allowing car owners the right to opt out of their information being shared with third parties could hurt consumers.
Automakers often rely on third-party providers for emergency and roadside assistance services, and curbing the flow of information to those companies could be detrimental to safety, the Alliance said.
Joseph Jerome, policy counsel for privacy and data at the Center for Democracy and Technology, a pro-civil liberties group, said California needs to clarify how the state law would be implemented, but car companies should not be excluded or given broad latitude in how data privacy rules apply to them.
“Specific exclusion for cars wouldn’t make a whole lot of sense, and we wouldn’t advocate for that,” Jerome said. CDT, a nonprofit advocacy group, has proposed its version of a federal data privacy bill that broadly mirrors provisions in the European and California laws.
Even as the car companies are trying to shape the outcome in California, a trade group representing aftermarket mechanics and repair shops says their members could be cut off from maintenance work if automakers keep all the vehicle performance data to themselves.
As cars collect and share performance data with automakers, “what happens if the mechanic down the street, who has been servicing your car for years, can’t get that data from the vehicle manufacturer?” asked Bill Hanvey, CEO of Auto Care Association, a trade group that represents about 235,000 repair stores.