On May 25, the European Union enacted a new law, known as GDPR (General Data Protection Regulation) that restricts how personal data is collected and handled. Many of us have received emails from social media and others, informing us that in the wake of the law their policies have changed. (Even though the United States is highly unlikely to follow suit, US companies that work in Europe will need to adhere to the law).

The new law requires companies to be clear about their use of personal data, say why they are collecting the data, and whether it will be used to create ‘profiles’. Consumers will have the right to access the data, correct it and limit its use.
GDPR raises an interesting question. When autonomous cars each generate terabytes of information, what are the privacy implications? This is especially interesting for the United States, where, on the one hand, the Trump Administration is rapidly canceling a great many regulations, while on the other, autonomous vehicles are being widely tested and are a fiercely contested new industry with heavy capital investment.

A study by Norton Rose Fulbright [1], an international law firm, addresses some of the more thorny legal issues in the US, related to autonomous vehicle data privacy.

  • “Existing US federal privacy legislation is largely inapplicable to autonomous vehicles”. The implication is, new legislation will be needed. As is usually the case, the legislation will lag behind the industry and the market. And there will be major diversity, as each state tackles the issue on its own. For instance, laws regarding autonomous vehicles currently exist only in a handful of states, including California, Florida, Nevada, Michiganand Tennessee.
  • Perhaps the most sensitive data are “location data”. Imagine, for instance, a nasty divorce case in which Plaintiff A says that Plaintiff B was unfaithful, his BMW was at XX St., at 2:30 a.m., July 8. The U.S. Supreme Court has already recognized that “location information generates a precise comprehensive record of a person’s public movements”, information that individuals may not want to be revealed.
  • The Supreme Court has held that attaching a GPS device to a vehicle, to track its location, without a court warrant, “violates the Fourth Amendment to the Constitution”. The Fourth Amendment prohibits “unreasonable searches and seizures” and will be the foundation of data privacy debates when self-driven cars proliferate.
  •  Location data, according to Norton Rose Fulbright, can correlate external information about the passenger with travel data (speed, destination, route, date, etc.). This could be invaluable in managing traffic flows and traffic patterns – but the New York Court of Appeals held that an individual’s location and destination information reveals “indisputably private” trips, e.g. to a psychiatrist. It is vital that regulations find the ‘sweet spot’ between privacy and value-creating traffic management.
  • Self-driven car data could provide hugely valuable data, with commercial applications. E.g. as I drive by a McDonald’s, an ad pops up on the LED screen offering a 30% discount on Big Mac’s. Will this be allowed?
  • Autonomous vehicle technology will be based on sensor data, about the car’s surroundings. These data may contain information about other cars and occupants, not just your own. As Google found out in 2012, the Federal Communications Commission sanctioned Google Street for gathering images of public roads.

A great many other issues arise regarding data privacy. It is almost always the case that societies begin to think about these issues only after the technology becomes widespread. This is a shame — because the technology itself, to be optimal in its design, needs to build on what the law permits and encourages. Perhaps, in the case of self-driven cars, we can hope that the privacy debate will occur together with the technology’s advent, rather than long after.

 

Post By: Paul-Matthew Zamsky Head of Strategic Partnerships at Waycare

 

[1] “The Privacy Implications of Autonomous Vehicles”,  July 17, 2017.