IAPP Panel: Car Features, Consumer Expectations Must Be Balanced with Privacy
SAN DIEGO -- Data collection has moved beyond websites, paper forms and apps as the automobile has advanced technologically and has begun accumulating data, said Brandon Reilly, leader and lawyer in the privacy and data security group at law firm Manatt Phelps during a panel at IAPP's conference Friday.
Sign up for a free preview to unlock the rest of this article
If your job depends on informed compliance, you need International Trade Today. Delivered every business day and available any time online, only International Trade Today helps you stay current on the increasingly complex international trade regulatory environment.
Vehicles are collecting "a lot of data," which presents some interesting questions. "How do you provide meaningful notice? How do you provide the meaningful ability to exercise your rights if you're a consumer or a driver of the vehicle?"
In the car world, telematics data, or the digital information collected from vehicle sensors and systems is huge, said Zoya Afshar, senior privacy and cybersecurity counsel at Kia America. It's used for safety purposes, analytical research and other features consumers often want, such as roadside assistance, she said.
Most of what Afshar described is vehicle-generated data, said Jim Simatacolos, managing counsel in data privacy and cybersecurity at Toyota. But personal data is collected too, such as names that's used for marketing. Since it's different data, Simatacolos said, there are separate privacy notices and policies for each.
Afshar said there is also “infotainment data,” which is content relating to what features of the vehicle consumers are using, such as in-vehicle navigation versus Apple's CarPlay. This data helps companies understand “people’s preferences” so they know how to improve products, she said.
There are also features that are “asked for by consumers or expected,” like rearview-facing driver monitoring, Reilly said, but requires the collection of “a much richer data set.”
In terms of balancing that trade-off, Rivian Automotive likes to offer certain features, such as an interior camera, with the default setting toggled off, said JP Shih, associate general counsel of privacy, security and AI. Even if consumers choose to activate the feature, there is a separate toggle used to control whether Rivian has access to the camera data.
“We wanted to be very clear with people, and give people choice,” he said.
Afshar and Simatacolos said their companies offer apps where consumers can pick and choose what data they want shared as well as features they wish to use in their vehicles.
With “basic connectivity services and telematic services, there's a terms of service [and] privacy policy that you must sign” when you purchase the vehicle, Afshar said. But with any secondary uses, like sharing data with insurance companies, there should be a separate affirmative consent for consumers to opt-in, she said. Kia and Toyota have this secondary consent, the privacy professionals said.
But in April, Toyota was sued in a Texas district court for the alleged collection and sale of drivers' data to an insurance company, despite saying in their Data Sharing Policies that it does not share this information without the drivers' consent (see 2504220068).