Automotive Industry: Privacy Risks and Opportunities

Éloïse Gratton June 15, 2016

Borden Ladner Gervais hosted its annual Automotive Industry Seminar on June 8th, which focused on the latest in legal developments, trends and strategies. Designed to be interactive, this annual seminar allows for open participation through Q&As. The session was moderated by Bob Love with opening remarks by Andrew Harrison.

I presented, for the first time, on “Privacy Update, Risks and Opportunities” for the automotive industry. Cars are rapidly transforming into smartphones on wheels, and they send enormous amounts of information to manufacturers and their partners over connected-car services.

Some of the information collected may be sensitive. It may include geolocation information about a vehicle’s location, biometric data about a driver’s physical characteristics and details about driving behavior. Some will argue that since information collected pertains to a car and therefore, not to an “identifiable individual”, it is not subject to data protection laws such as PIPEDA and substantially similar provincial laws from B.C., Alberta and Quebec. Given the very broad interpretation of personal information (for instance in Gordon v. Canada (Health), it was decided that information is about an “identifiable individual” where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information) the information collected in connection with cars will most likely fall under the scope of data protection laws. It should be noted that privacy commissioners have taken the position that a license plate number may well qualify as personal information in the following decisions:

In my presentation, I discussed the challenges that we have with the consent-based model, and the fact that there is an ongoing consultation by the Office of the Privacy Commissioner (OPC) on this topic. In its recent consent paper, the OPC states:

A major challenge in this environment is how to convey meaningful information about privacy risks in order to inform the user’s decision whether or not to provide consent.(…). Research funded by the OPC on the connected car found privacy information provided to consumers to be so woefully inadequate as to make meaningful consent impossible.

The OPC is referring to the 122 pages research paper “The Connected Car: Who is in the Driver’s Seat?” published in 2015.

Once mobile devices and wearables are connected to car infotainment systems and cars are connected to the Internet, cars will become a rich source of data for manufacturers as well as marketers, insurance providers and the government. I discussed big data and marketing opportunities and the challenges when managing law enforcement requests. I also raised that disclosure requests from the insurance industry may increase with Usage-based insurance (UBI), a type of vehicle insurance whereby the costs are dependent upon type of vehicle used, measured against time, distance, as well as driver behavior and place.

I ended my presentation with upcoming issues that the automotive industry should keep on its radar: privacy issues pertaining to the internet of things, wearables and autonomous vehicles. Data from autonomous vehicles could convey sensitive information and in some cases, cameras may be used to monitor the driver which may raise additional privacy concerns.

My slides are available here.

This content has been updated on March 14, 2017 at 9 h 39 min.