## 4 Case Studies
### Insurance  
The European motor insurance industry is a lucrative market worth GBP 100 billion [50]. Digital based insurance is a growing market currently worth over GBP 15 billion [50]. Third party insurance is mandatory and insurers traditionally group driver risk by location, age, occupation etc. Usage Based Insurance (UBI) is a dynamically priced digital insurance model that monitors driving behavior. GPS data that is collected from telematics devices by the insurer is used to predict driver behavior. Risky driving behavior such as speeding, harsh acceleration, de-acceleration, or cornering can result in higher premiums, while safer behavior will result in lower premiums [51; 52; 53; 54]. Insurers thus incentivize safer driving, saving money for the policyholder and provide bespoke insurance. Monitoring driving behavior requires a device capable of recording and transmitting driver behaviors and vehicle status. There are numerous benefits to UBI insurance schemes for both insurer and policyholder. Aside from a reduction in premium price, policyholders can expect economic benefits (fuel efficiency, and vehicle condition), safety benefits (feedback on driving behavior, and reduced accident risk) and security benefits (recovery of stolen vehicle) [55; 56]. For insurers, more accurate pricing and enhanced fraud prevention and detection capabilities are a significant advantage of using UBI schemes [55; 57]. Despite this business appetite, there are regulatory and technical constraints that hamper the implementation of this service. EU regulation stipulates that data protection and privacy are an integral part of any system which processes or records data [1; 2; 13; 14]. Telematic devices are capable of recording sensitive and private information about an individual. Before data processing can occur, policyholders must provide consent allowing data access by third parties [1; 48]. Installed devices belong to the insurer and require user consent for installation. Embedded devices however belong to the driver, requiring the insurer to seek consent for data access [1; 2]. To ensure full autonomy over data usage, the EU have recommended that processing of data remains in the host vehicle unless transfer is strictly necessary [1]. The purpose of local host data processing is to limit third parties from accessing raw telematic data produced from embedded telematic devices. For insurers, data can either be accessed from the vehicle after host processing has occurred or sent to a third party for processing before usage. The EU require the installation of embedded telematic devices on all new vehicles by 2024 [15]. Data scoring and aggregation by insurers requires the removal of personal information relating to the policyholder. Geolocation data has been identified by both EDPB and IWGDPT as particularly sensitive and revealing of personal habits [1; 2]. Both the EDPB and IWGDPT have recommended restrictions to geolocation data from third parties. Insurers are limited in their capacity to accurately detect fraudulent claims and driver behavior without access to geolocation data. Regulation can also introduce technical challenges for insurers and Original Equipment Manufacturers (OEMs) of embedded telematic devices. Data transmission to authorities or third parties will be required in the event of a crash, offence, or loss of vehicle (stolen) [1; 58]. Data relating to the event will need to be protected and encrypted before transmission occurs. A typical vehicle may produce 10/15 mb of data annually from a telematic device [9], transitioning to a connected vehicle/network will see data production increased up to 25 GB daily [11]. Telematic data required for investigations by insurers can be delayed through either requiring consent or pre-processing before transmission [1]. The storage capabilities of the device introduce a technical requirement/cost as data must not be deleted to assist in the investigator process.