Driverless vehicles hold privacy concerns

But some lawyers question whether the consent-based model is a practical approach for stakeholders as connectivity takes hold of our daily driver.

“Connected and autonomous vehicles will have the capability of collecting a really broad array of data from a variety of sources,” says Geoff Moysa, a Toronto-based litigation partner with McMillan LLP.

“[They’ll] have the potential to provide a very complete picture of a person to the extent not quite realized yet by other connected technologies,” he says.

According to current projections, to run on its own, the autonomous vehicle will be expected to gather and use telematics-type data to transmit information over distances. The driverless vehicle also is anticipated to use GPS and trajectory for navigation and data recording, which is helpful in crash investigations.

While several aspects of the driverless car are still being developed, it is expected that vehicles would be able to communicate with each other as well as with the infrastructure along the road for safe travelling and navigation.

Moysa says personal data might also be collected for authorization and identification so that vehicle entry and operation could be accessed through a fob, biometric fingerprints or phone authorization.

And the driver can be automatically logged into personal or entertainment or mail systems that tie all of the driver’s systems from home and the car together.

Biometric systems in the car might also include sensors and monitors aimed at drivers to gauge their heart rate and alertness level.

The car could then have all that information stored in its available memory, recording where the driver has been and when, as well as the driver’s individual preferences.

“[T]hat’s a lot of data in the aggregate to collect about one person. And not only is your car collecting that data with you, it would potentially be sharing parts of that with other cars and with other parts of the navigation infrastructure,” says Moysa.

Driverless cars are currently being tested in some areas, including Ontario, and are constantly being enhanced with increased functionality and automation.

The expectation is that companies will look to monetize on all that navigation and preference information. They may adopt strategies used for home-based systems on the new mobile platform, such as providing suggestions on places to visit and goods and services to purchase.

“When organizations are requesting an individual’s consent, we think they need to do a better job of explaining what they propose to do with, in this case, drivers’ personal information,” Therrien wrote in a submission to the Standing Senate Committee on Transport and Communications.

“Historically, dense, legalistic privacy policies that often go unread by consumers have been the main instrument for communicating privacy practices. This has, unsurprisingly, proven ineffective. It is therefore important to find means to improve communications.”

Therrien suggests a summary of the personal information collected by a driverless vehicle, along with potential third-party providers that might also have access, should be made available prior to purchase or lease.

He points at the use of data to calculate car insurance premiums and associated financial risks as an example of what should be communicated during the time of sign-up and when decisions are being made.

An explanation of how to delete data collected in a rental car when the driver’s phone is paired with the car’s Bluetooth system is another example he provided.

One of the challenges about driverless cars and privacy rights that Kirsten Thompson, a partner in McCarthy Tétrault LLP’s national technology group, sees is geographic borders and having manufacturers adhere to different pieces of legislation in different jurisdictions in the absence of standardized laws. Cars are built around the world and not necessarily just for one particular market such as Canada, she says.

Then there’s the issue of the customer not knowing about all the issues.

“Cars, personal assistants, all those things are just Hoovering up all the information that you generate,” says Thompson, who is leader of her firm’s national cybersecurity, privacy and data management group.

People often don’t really consider what their personal information is beyond their phone and email address, she says. Drafting a consent statement for the manufacturer explaining what is being collected and how it may be used is no easy feat for a lawyer. And companies aren’t entirely sure how they could best be transparent about what they do with that information, she adds.

Canada’s privacy legislation was also drafted when concepts such as data analytics, machine learning and artificial intelligence were in their infancy.

Thompson says “some form of consent is necessary,” and she’s not sure if there is currently a model that works when it comes to granting consent.

“The technology has really outpaced it. The notion of consent really hasn’t kept up with how we are starting to conduct our world,” she says.

PIPEDA — federal legislation that governs how private sector organizations collect, use and disclose personal information in the course of commercial business — offers the right for consumers to access their information.

However, Thompson says, this can be difficult for corporations who keep layers of information across many IP infrastructures on different servers in various locations.

This can be duplicated and backed up elsewhere, she says.

“[T]he value of information has increased exponentially over the past five to 10 years and PIPEDA didn’t really contemplate that,” she says.

With data crossing so many sectors, Thompson sees the need for a concerted effort across multiple stakeholders to understand what privacy solution makes sense.

That may not necessarily require the need for international consensus, she says. Neither does she see a need for a regime of privacy specific to the connected vehicle, because that’s such a departure from existing law.

Consumers are often willing to give up aspects of their privacy in exchange for the many conveniences the technology allows them, she says.

“Most of next year’s models of connected vehicles will include those convenience features, like onboard dictation, various geo-location-type functions, all sorts of nifty things like that,” she says.

“Most of them have a high consumer appeal because of the convenience factor. Because of that, most consumers tend to adopt them.”

Moysa says that, in theory, the current privacy legislation should be capable of dealing with the privacy issues presented by the driverless vehicle.

He says that PIPEDA’s standard, based on what a reasonable person considers appropriate in the circumstances, is an objective standard.

Moysa says what Canadians think is reasonable now, for instance, may have once been considered an invasion of our privacy.

“We live in a different world now and I suspect that a lot of people might be more cognizant of the fact that they are, every day, trading off their privacy for convenience,” he says.

“They might consider the type of information sharing between systems about preferences, browser history and shopping history are acceptable [or] at least reasonable in the circumstances as sort of the price of living in a connected world.”