Automakers face a wave of new laws in state capitols to curb Internet-connected technologies increasingly being incorporated into vehicles amid growing concerns that the industry is not doing enough to prevent violations. privacy and harassment.
Lawmakers in at least four states — New Jersey, Tennessee, New York and California — have passed or introduced laws in the past six months to strengthen protections for in-car surveillance technologies that experts say put people at risk. drivers privacy.
All major automakers sell models that can use technologies like in-vehicle sensors and cameras along with connected apps to collect a range of data that, according to a 2023 Mozilla Foundation report, includes vehicle telematics and even expressions. facial or sexual activity of drivers. Sharing that information, as well as location and other collected data, sometimes without the consumer’s express consent, can lead to harm ranging from financial harm to cases of harassment.
“We’re past smartphones on wheels; now we’re onto Facebook on wheels,” said Andrea Amico, founder of data privacy technology company Privacy4Cars Inc.
In the absence of greater clarity, plaintiffs have turned to existing statutes to challenge allegedly deceptive practices.
Legislation in motion
State lawmakers have been busy introducing auto-related privacy bills since 2023.
New Jersey enacted a law in January requiring car dealers to remove consumers’ personal information from the systems of vehicles they sell or trade in, while lawmakers in Montana and Kentucky have introduced similar legislation.
Tennessee lawmakers introduced a proposal in January to develop a registry of drivers who do not want their data collected by car companies, which would require manufacturers to give them the opportunity to opt out. A bill that would update New York insurance laws to require auto insurers to disclose how they consider telematics data in rates was also introduced in the state Senate earlier this year.
Meanwhile, in the California State Legislature, several bills aim to address connected car issues. A law enacted in October requires automakers to disclose the presence of cameras in vehicles.
Another, introduced in February, would require automakers to provide privacy protections to survivors of domestic violence, stalking, sexual assault and human trafficking. The Federal Communications Commission released a similar proposal this month implementing the Secure Connections Act, a 2022 federal law intended to ensure that survivors of domestic violence have access to communications technology separate from their abusers.
Also at the federal level, the National Highway Traffic Safety Administration is weighing regulations on what data protections to require for vehicle safety systems that monitor driver behavior.
While some of the bills proposed by states are “very thoughtful because they are truly auto-specific,” Amico said, privacy laws do not need to mention automakers by name to implicate them.
“None of those laws also include computer, server, or cloud storage services or devices” mentioned by name, Amico noted, “so whether or not a device has a name shouldn’t really matter from the perspective of the law”.
Existing privacy laws
As those privacy measures specific to passenger vehicles move forward, the lack of explicit, auto-focused regulations in current consumer privacy laws has left automakers and drivers figuring out how existing statutes apply. .
A Florida man sued General Motors LLC, OnStar LLC and LexisNexis Risk Solutions Inc. in March alleging violations of the federal Fair Credit Reporting Act and the Unfair and Deceptive Trade Practices Act. Romeo Chicco’s proposed class action lawsuit claimed that GM provided telematics data to OnStar from his car without his knowledge or consent to the LexisNexis unit, which then provided the information to its insurance agency.
Chicco never registered with OnStar nor did its policy with GM mention that such data would be shared with LexisNexis, according to its complaint.
GM has been the subject of alleged class-action lawsuits over the same practices in California, Michigan, New York and Pennsylvania. The lawsuits cite a host of common laws and constitutional encroachments on privacy statutes, consumer protection laws and, in one case, California’s wiretap law.
GM stopped sharing OnStar Smart Driver customer data with LexisNexis and another data broker, Verisk Analytics Inc., on March 20, the company said in an email to Bloomberg Law.
“We are reviewing the complaints and have no further comment at this time,” a GM spokesperson wrote.
The various lawsuits’ shared focus on common law and trade practice claims underscores the lack of clear privacy protections regarding data collected by automakers, said Sara H. Jodka, a member of Dickinson Wright LLP.
“This tells us that right now, with respect to data, the type of data that is at stake with connected cars is not the type of data that state consumer-facing privacy laws address,” Jodka said. “They do not define vehicle history or brake data. The information in question is not protected by those laws.”
For that reason, he said, the complaints point to accusations “that the data was used without their knowledge and consent to harm consumers” rather than a cause of legal action.
While states have different laws, Amico said, federal consumer protection statutes, such as the Federal Trade Commission Act, clearly hold vehicle manufacturers responsible when it comes to collecting data.
“In general, all of those laws require transparency and very clear consent,” he said.
The self-regulation route
In the absence of clear legal or regulatory obligations, the auto industry has tried to formulate its own rules.
The Alliance for Automotive Innovation established consumer privacy principles in 2014. Members of the self-regulatory group include Ford, GM and Aptiv.
“All of these auto companies are trying to figure out how to fit into the patchwork of state privacy legislation,” said Adonne Washington, policy counsel at the Future of Privacy Forum. “Just because a bill doesn’t say ‘automobile’ or ‘automobile manufacturer’ doesn’t mean they think they won’t touch them.”
Washington also noted that the industry is poised for connected cars to collect even more data in the future.
GM’s lawsuits are a warning to automakers, according to Jodka. They need to fully understand the information they share with third parties and make sure they get consumers’ specific consent to share it, she said.
“If the privacy policies are not specific, there was never consent and they can’t rely on it,” Jodka said.
#Privacy #Questions #InternetConnected #Cars #Prompt #States #Act