Technological development in vehicles that are becoming increasingly connected to the digital world is outpacing the laws developed to protect the privacy of consumers, say lawyers.
Technological development in vehicles that are becoming increasingly connected to the digital world is outpacing the laws developed to protect the privacy of consumers, say lawyers.
Yet it is clear that consent and transparency are two important considerations over data generated as more and more vehicles become connected to the digital world, says Robert Love, a litigation partner at Borden Ladner Gervais LLP.
Through informed consent, he says, the consumer can weigh the balance of allowing the collection of some of the data collected through their vehicle in exchange for the convenience offered by the technology and make an informed decision. And companies can stay in the clear by being transparent about what information they’re collecting and what they’re doing with it, he says.
At issue is the data the car generates and may record in everyday operations when it is connected to the internet. Tesla, for example, uses cellular connectivity to update software used by the car for features such as navigation and internet radio in Canada.
Love says a Tesla vehicle’s over-the-wire communications could lead to a sharing of information with manufacturers, which would require the vehicle owner to provide consent.
“If you’re sharing or have the ability to obtain personal information, that is information that can identify an individual and . . . that’s where the concern becomes more acute,” he says.
There are often advantages for consumers to share their information, says Love, pointing to usage-based insurance as an example. Insurance companies use telematics to gauge how the vehicle is being driven by measuring driver habits including speed, lane changes and frequency of hard breaking and adjust insurance premiums, rewarding good and low-mileage drivers with lower fees.
As the use of autonomous vehicles becomes more commonplace, they may use and share biometric data for access and monitoring, but Love says it’s all based on the need for consent.
For some, the trade-off of the usage of information is worth the discount they might achieve in insurance premiums, says Donald Johnston, a partner at Aird & Berlis LLP in Toronto.
“Your expectation of privacy there is much less. But, currently, you’ve got choices, whether you take pay-as-you-drive insurance or pay the regular fee,” he says.
He points out that there are circumstances in which a certain amount of privacy is expected when it comes to cars, which was successfully argued in the Ontario Court of Appeal decision in R. v. Sloan, 1994 CanLII 1721 (ON CA).
Going back 25 years, the court dismissed a criminal charge of committing an indecent act in a public place, concluding that in Sloan the motor vehicle was a private place because it was parked, in darkness, in the far end of the lot and backed up to a tree-covered embankment of the escarpment in Hamilton, at least 45 metres from the nearest vehicle.
Although because a moving car interacts with others, there is some limitation on that privacy, says Johnston.
Cars are of particular interest, Johnston says, because devices such as personal computers and cellphones rely upon Internet Protocol version 4 — or IPv4 — which is a user end point where communication starts and stops and continues to be used for most internet traffic. But vehicles use its successor, IPv6, which acts as a router, enabling the various points of presence and allows traffic to flow through the internet.
“That transponder not only knows where you are but it knows where everybody else relevant to you is, too. It passes messages from cars all around you” into a network, Johnston says. “With connected vehicles, every vehicle knows where every other vehicle is.”
And while that is then used to provide driver assistance, the information that flows through it needs to be evanescent in order to ensure privacy, he says, adding that it is necessary to enforce policies to prevent abuse.
Edona Vila, a BLG associate with an interest in connected devices, says the federal privacy commissioner identified the need for consumers to be aware of what data is being transmitted as part of the operations of connected vehicles currently on the road.
“We’re talking about technology that’s now available,” she says.
“And I think these kinds of issues probably propagate with more volume of data, with more specific data that might be available with autonomous vehicles.”
Vila says there are a couple of initiatives companies can take on the corporate level, including developing guidelines about how to best handle the information, which could include removing information identifiable to a specific vehicle and driver.
Companies can also provide consumers with tools to have more control about the data that is being shared, she says.
The law, generally, lags behind innovation. However, she says the challenge with the prospect of introducing additional privacy legislation is to ensure that it doesn’t stifle further growth and development.
She suggests regulators present guidelines as a standard from which companies can develop best practices.
