With a themed series on the brand-new permanent House Committee on Digital Affairs, Data&Privacyweb deepens the areas in which the House Committee is active in the coming months. Various experts share their views on issues related to digitalization. The first topic the committee will focus on is "Emerging and Future Digital Technologies" that affect our society. In this article, we let Issam Moustaïne talk about one of those new technologies and the additional privacy risks.
It probably hasn't escaped your notice. These days, everything is increasingly connected. Smartphones connect us to the rest of the world like never before. Our doorbells, TVs and even kettles are "smart" and can connect to the Internet. Our voice assistants turn on the lights and give us the latest news every morning as well as prepare the coffee. So it should come as no big surprise that our cars are also becoming "smart(er). Cars are becoming more and more connected. We also call these vehicles "connected cars." While you may have heard about connected vehicles, understanding the world of connected cars and figuring out if your own car is "online" can be a challenge.
Yes, even a car can connect to the Internet. In fact, chances are you already drive one. A connected car is equipped with telematics. This is a technology that allows you to connect to the Internet. Like a smartphone, a connected vehicle has a 3G, 4G or 5G mobile modem built into it. This is how the vehicles are delivered from the factory. To use it, the user must first activate the option by signing up for the car manufacturer's mobile app.
Vehicles connect to the Internet so that your phone and other apps and services can easily communicate with it. Every car manufacturer offers a mobile app that allows car users to check their car's locations, lock and unlock the car, preheat the car, and receive a notification when the car is running low; all directly from the phone. In addition, car developers and car users can benefit from similar features while using other apps and services, such as a car sharing app, an electric car charging app or a car insurance app.
A connected car is inquisitive. It collects large amounts of data. You can think of technical performance data, location data, driver data and more. Technical performance data involves data directly related to the vehicle. This data is collected through in-vehicle monitoring sources that provide valuable information on fuel consumption, mileage, oil level, engine temperature, emissions and traction. This category of data serves to optimize the operation of the vehicle. It is not personal data.
This is different when it comes to driver data for which the connected car does collect personal data. This concerns the driver's driving behavior. A connected car is often equipped with interior cameras. These cameras monitor whether the driver is getting tired and alert the driver with a warning signal. These include sensors that measure driving behavior for safety purposes, the driver's personal infotainment settings, voice-controlled functions or active notifications to improve the driver's driving behavior. Consider, for example, notifications that alert the driver to road blocks, accidents or speed cameras. The connected car also keeps good track of where you have been. For example, the car is familiar with home address, work address, school address, vacation address: in other words, the car is familiar with your location data and thus knows real-time or stored information about destinations. Through sensors and cameras, the connected car also generates its environment and collects information about the road surface, slopes, traffic signs, and speeds and distances of other cars.
So, as mentioned, a lot of data. The complexity and dimensions of collecting this category of data make it clear that it is increasingly difficult for car users to understand how companies are using their personal information. When data falls into the wrong hands, it can have a troubling impact on a person's privacy.
Dealers still do not adequately inform customers about data their car shares with the manufacturer, according to research by the Financieel Dagblad. (1) Consequently, car users often do not know that the manufacturer records their movements. In practice, however, this is often reflected in the purchase and lease contracts, which then contain a provision on 'data sharing'. This also applies to buyers of a used car whose location can be tracked by both the manufacturer and the old owner. European privacy regulators want to strongly regulate so-called "data hunger" in the automotive sector. The data in question is mainly sensitive information that reveals something about the user's religion, race or sexual orientation. Therefore, for these reasons, there are high requirements for the quality of the consent a user gives for the collection and use of their personal data. Data sharing should also be 'off' by default. Giving permission for data sharing should be very specific, and the car should function just as well without data sharing as with it.
The Financieel Dagblad also writes the following in its news article: "Tesla sells cars connected by default. Whoever makes the down payment (at Tesla this is online) is presented with the privacy statement before the moment of payment. This states that Tesla collects location data, among other things. Those who do not want that can opt out with the manufacturer. Tesla does warn of possible consequences: "serious damage, or failure of the vehicle to work. The buyer of a used Tesla must remove the old user account himself, or the location data will go to the wrong person. An FD reader who resold his Tesla through a dealership was still being sent the new owner's route data for a month."
Vehicles are getting smarter: they are driving (Internet-connected) computers. Your car navigates (real-time) your route and remembers where you have been and also stores your contact information from your phone. So your vehicle knows who you are. So it is a good idea when buying or commissioning a car to be mindful of any privacy risks attached to the vehicle. Therefore, research beforehand what, among other things, the manufacturer states in its terms and conditions about the security of your data and where it is stored.
According to the Autoriteit Persoonsgegevens , it is up to the manufacturer to manufacture the vehicle in such a way that it processes as little personal data as possible. The manufacturer must also set the vehicle by default so that it only processes personal data that are necessary. This practically means that the choice must be opt-in instead of opt-out. Among other things, this plays a role in:
- the use of bluetooth in the car, if you find it convenient for the car to take over the contact list from your phone, you must first give active and explicit permission to do so;
- navigation settings where it may be practical to remember frequently visited places or frequently driven routes, but then again, active and explicit consent will have to be given for this first;
- The consideration of whether your car should save certain vehicle settings;
- some vehicles allow you to log in to the vehicle with an account. You can use your existing e-mail address to do so. Be mindful of the possibility that this may allow your e-mail provider to learn even more about you. Of course, you can also start using a separate e-mail address for this purpose. For example, with a provider that guarantees that your data stays within the EU.
Want to learn more about privacy and new technologies? Come to the Knowledge Market of Data&Privacyweb on December 7, 2021.
