Vehicle Data Privacy: Industry and Federal Efforts Under Way but NHTSA Needs to Define Its Role
Released: 2017-08-28T00:00:00

Letter

Background

Connected vehicles offer services and features to consumers through wireless communication systems. Technologies, such as in-vehicle sensors and global positioning systems, generate data that are transmitted through two-way communication between a vehicle and a central computer system or a call center. As shown in figure 1, automakers use third parties to provide connectivity (e.g., enable a vehicle to transmit and receive voice and data communications) and typically contract with third parties to provide support for the services offered in connected vehicles (“connected vehicle services”). For example, automakers may contract with: telecommunication companies to connect a vehicle to the internet or a wireless network, telematics service providers to provide connected vehicle services by staffing calling centers and processing data, and content providers to provide optional applications, similar to those available on a smartphone, that consumers can access through their vehicle’s console.

Connected vehicles can offer consumers a range of safety, security, and convenience services. For example, roadside assistance and automatic crash notification services allow for voice and data communication between a vehicle and a person at a call center. In providing these services, connected vehicles generate, transmit, and receive various types of data, such as a car’s location. In this report, we categorized data that are collected or that could be collected by connected vehicles into six categories as defined and described in figure 2.

Personal information includes identifying information such as a consumer’s name, address, e-mail or other information that directly links back to an individual as well as other information that can be reasonably linked to a specific consumer, computer, or device. For example, in the connected vehicle context, data (e.g., GPS coordinates or airbag status) that can be linked to a vehicle owner is often treated as personal information. Personal information collected from vehicles varies in its sensitivity. As reported by FTC staff, some personal information, such as data on precise geolocation, is considered sensitive due to what it can reveal about someone (e.g., routines).

There is no federal comprehensive privacy law governing the collection, use, and sale of personal information by private sector companies. Rather, federal statutes and regulations addressing privacy issues in the private sector are generally tailored to specific purposes, situations, types of information, or sectors or entities. For example, the Health Insurance Portability and Accountability Act governs the use and disclosure of an individual’s health information by certain entities. Federal law also does not require all companies to have a privacy policy or to notify consumers of their privacy practices. While no single federal agency oversees data privacy issues, FTC is a law enforcement agency with a mission to promote consumer protection and prevent business practices that are anticompetitive, deceptive, or unfair to consumers. The National Highway Traffic Safety Administration (NHTSA) within DOT is responsible for vehicle safety.

Many organizations and governments have used the Fair Information Practice Principles (FIPPs) to guide their privacy practices. The Organisation for Economic Co-Operation and Development developed a version of the FIPPs—a set of internationally recognized principles for protecting the privacy and security of personal information—in 1980 that has been widely adopted and was updated in 2013. While the FIPPs are principles, not legal requirements, they provide a framework for balancing privacy protections with other interests. Like other industries, the automobile industry recently developed a set of privacy principles—the Consumer Privacy Protection Principles: Privacy Principles for Vehicle Technologies and Services (“Consumer Privacy Protection Principles”). These principles are a self-regulatory framework influenced by the FIPPs and were adopted by most automakers with vehicle sales in the United States. The Consumer Privacy Protection Principles went into effect January 2, 2016.

Selected Automakers Collect Different Types of Data from Connected Vehicles and Reported Limited Use and Sharing

Availability of Connected Vehicles Varies, but Selected Automakers Plan to Increase Offerings

Nearly all selected automakers offer connected vehicles or plan to offer them in the next 5 or more years. Specifically, 13 of the 16 automakers we interviewed sell new vehicles that met our definition of a connected vehicle—ones that come equipped with technologies and services that transmit and receive data wirelessly (see fig. 3). Four of these automakers currently provide connected services in all of their vehicles; most of the remaining automakers reported increases in their production of connected vehicles over the last 5 years.

Of the 12 automakers we interviewed that do not currently offer connectivity in all of their new vehicles, all but 1 told us they plan to do so. Three plan to offer all connected vehicles in the next 3 to 4 years, and 8 plan to offer all connected vehicles in 5 or more years. Several automakers noted that consumer demand will influence when they will offer all connected vehicles.

While most automakers offer connected vehicles and services, not all consumers with access to these services use them. Based on our interviews with automakers, the percentage of customers who use these services ranges from less than 50 percent up to 100 percent. Selected automakers differed in how they offer these services to consumers. For example, some automakers offer free trials for 3 months, 6 months, or 1 year, while other automakers offer these services at no additional cost.

The 3 automakers that do not offer connected vehicles or connected vehicles services told us they do not collect any data from their vehicles. Our discussion below focuses on the 13 automakers that offer connected vehicles and services.

Collected Data Include Location, Vehicle Health, Driver Behavior, and Infotainment Data

Based on interviews with the 13 selected automakers that offer connected vehicles, the types of data they collect from those vehicles vary. All 13 reported collecting vehicle health and location data (see fig. 4). However, fewer automakers reported collecting driver behavior and infotainment data, such as music selections and mobile applications used. These 13 automakers did not report collecting data related to vehicle occupants’ health or personal communications.

Selected Automakers Reported Using Collected Data Primarily to Provide Services to Consumers and for Research and Development

According to the 13 selected automakers that offer connected vehicles, they currently use data collected from connected vehicles to provide connected vehicle services, and some use the data for research and development and marketing.

Connected Vehicle Services: According to all of these 13 automakers, collected data are used to provide services, such as automatic crash notification or roadside assistance, to customers. Providing these services typically requires location, vehicle health, and for some services, driver behavior data. For example, sensors in a connected vehicle may detect that an airbag deployed. The connected vehicle transmits this information to the automaker or the provider operating the automatic crash notification service. The provider uses a vehicle’s location, status of airbag deployment, rollover status, and other pertinent information to inform and request assistance from emergency responders.

Research and Development: All but 1 of these 13 automakers told us they also use collected data for research and development, specifically to improve their vehicles’ safety and performance. For example, automakers may use vehicle health data (e.g., diagnostic trouble codes) to identify an issue with a certain model or component within their vehicles. Twelve of these 13 automakers also told us they use these data to improve connected vehicle services they offer. For example, these collected data allow them to see which services or features consumers actually use and how they use them.

Marketing: Five of these 13 automakers reported using collected data to market products and services to consumers, for example using vehicle health data to target advertisements to specific consumers for specific vehicle service or maintenance offers.

These 13 selected automakers differed on who owns data collected from their connected vehicles. Specifically, 7 told us ownership of these data is legally unclear or they do not yet have a position. Of the remaining automakers, 3 said the vehicle owner owns the data, but the automaker has a license to use them; 2 said the automaker owns the data, and 1 said the automaker owns anonymized data and the customer owns personal data (e.g., data tied to a vehicle identification number). As we reported in 2016, data ownership is a potential challenge to achieving gains in transportation safety and efficiency. In the context of connected vehicles, data ownership can determine who or what entity controls access to the data and how they can be used.

Selected Automakers Reported Sharing Data on a Limited Basis

All 13 selected automakers that offer connected vehicles said they typically do not share collected data with unaffiliated third parties. For example, none of these automakers reported sharing collected data with firms that collect and sell information (data brokers). When automakers do share collected data, they said they typically do so with explicit consumer consent, at the request of a consumer, or to comply with a valid court order. Specifically, all of these automakers said they would share collected data with law enforcement in response to a valid court order or in exigent circumstances. Seven automakers said they share collected data, specifically vehicle health data, with dealerships to aide in vehicle servicing. Two automakers reported sharing collected data with insurance companies to enable consumers to participate in insurance plans that base premiums on driving behavior. Several automakers reported sharing and using collected data that has been de-identified more widely than they do data that can be linked back to a vehicle or vehicle owner. For example, one automaker discussed sharing de- identified vehicle health data with university-based researchers to examine vehicle structural integrity after crashes. Other automakers mentioned sharing de-identified location data with traffic services to improve their accuracy. Some automakers we spoke with emphasized that their current use and sharing of data may change as the industry evolves and data collection expands.

Selected Automakers’ Reported Policies Partially Reflected Leading Privacy Practices Relevant to Connected Vehicle Data Privacy Automakers’ Reported Policies Partially Reflected Six Identified Leading Practices

As mentioned above, for the purposes of this report we identified six leading practices most relevant to connected vehicle data privacy, based on our analysis of the FIPPs and other policy frameworks (see table 1).

To assess the extent to which selected automakers’ reported privacy policies reflected each leading practice, we identified multiple elements for each practice. We then reviewed selected automakers’ written privacy notice(s) and their responses to interview questions about their privacy practices. We did not evaluate the extent to which selected automakers follow their reported privacy policies. Although the leading practices are interrelated, we focused our assessments on how fully the automakers’ practices met each leading practice.

We found that most selected automakers’ reported privacy policies at least partially reflected each of the six identified leading practices. Although we saw some variation among automakers, they tended to reflect and not reflect the same leading practice elements. For example, most automakers reported limiting the sharing of data and using safeguards to protect data security. However, none of the automakers’ written notices were in plain language, and their reported data collection, use, and sharing practices generally were more limited than suggested in their notices. Automakers reported obtaining consent before collecting data from vehicles, but they offered few options besides opting in and opting out of sharing data.

Transparency: All 13 selected automakers’ written privacy notices were readily accessible from their public websites, but based on our analysis, none of the notices was clearly written. As we have previously reported, FTC and others have recommended that privacy notices should be readily accessible, clearly written, and describe all the purposes for which personal data are collected and shared. All of the automakers’ notices discussed the types of data collected; the potential purposes for collecting the data, such as to provide the connected services; and some conditions when data might be shared with third parties. However, none of the notices was written in plain language, a lack that could make them difficult for consumers to understand. In addition, most notices did not describe all of the types and purposes of the connected vehicle data that were being collected, but instead used broad language to describe this process. For example, of the 15 notices, only 2 included a list with all of the actual purposes for which the automaker collects data, and only 1 included a list with all of the types of personal data collected. Two notices clearly stated that the purposes identified for data collection were not exhaustive. Although the use of broad language is common for privacy notices and is not specific to the auto industry, it does not promote transparency. Several automakers discussed their other efforts to increase transparency. For example, one automaker reported revising its website to offer a consumer-friendly privacy portal after signing onto the Consumer Protection Privacy Principles. Three other automakers told us that they display their privacy policies on in-vehicle displays. Two automakers told us that a recently issued consumer guide could help promote understanding about this issue. In January 2017, the National Automobile Dealers Association and Future of Privacy Forum issued a consumer guide outlining types of vehicle data, practices governing their collection and use, and potential consumer options; the guide is to be available at auto dealerships.

Focused Data Use: Most selected automakers reported limiting their data collection, use, retention and sharing, but their policies varied. Most written notices did not clearly identify data sharing and use practices. In interviews, all 13 selected automakers reported limiting the data collected from connected vehicles, with some (4 of 13) noting that they only collect the specific data they need to provide the consumer with services. With regard to data use, as discussed previously, all 13 automakers reported they use collected data to provide direct consumer services, such as roadside assistance, but some automakers (5 of 13) reported they use such data for marketing other services. Also, all 13 automakers told us that they use de-identified data when possible, such as when the data are being used for research and development purposes. Most automakers (12 of 13) also told us that they limit data retention, but policies varied. For example, of the 12 automakers that limit retention, 8 told us that their retention time frames depend on the type of data, while one of them specified that it retains all connected vehicle data for 6 years regardless of data type. Two automakers also told us that they are still developing their policies, so their retention time frames may change. With regard to data sharing, as mentioned previously, all 13 automakers told us that they do not typically share collected data with unaffiliated third parties. However, most automakers’ written privacy notices used vague language and did not consistently reflect their relatively limited data collection, use, retention, and sharing. For example, none of the notices stated that the automaker would not use data for reasons other than those listed in the policy, and only one notice specified the automaker’s data retention time frame. In another example, less than half of the notices (6 of 15) stated that data would not be shared with or sold to non-affiliated third parties, such as data brokers. Similarly, less than half of the notices (7 of 15) stated that location and driving behavior data would not be shared with any parties besides service providers without first obtaining the consumer’s consent. Only 2 notices included both of these statements about sharing.

Data Security: Selected automakers reported using various methods to safeguard data, including methods that we have reported could be applied to increase vehicle data security. As we reported in 2016, automakers can identify and mitigate cybersecurity vulnerabilities by using practices such as conducting risk assessments and by employing technological measures. In interviews, all 13 automakers reported using policy and technological measures to protect data, such as limiting data access to certain company staff, using firewalls and encryption, and using “penetration testing” and “code reviews.” In addition, 12 automakers told us that they participate in the Auto-Information Sharing and Analysis Center, an industry-operated forum that includes automakers and parts suppliers. The center seeks to heighten awareness and increase security by allowing industry stakeholders to share threat information and potential mitigation strategies. Most automakers (9 of 13) also reported conducting privacy risk assessments, which would involve determining, among other things, the sensitivity of the collected data and the potential risks if the data were improperly lost, accessed, or disclosed. In addition, almost all of the notices (14 of 15) explained safeguards used to protect data, and some (7 of 15) also included examples of industry standard practices used for data security.

Data Access and Accuracy: Selected automakers reported offering consumers various methods to access their personal account information, but most of their notices were unclear about methods used to ensure data accuracy. The majority (9 of 13) of automakers told us that consumers can access and correct information, such as name and address, related to the driver or subscriber. For example, 5 of these automakers noted that such subscriber information can be accessed through websites or mobile applications. One other automaker told us that consumers can access information on the website or mobile application but must e-mail or call the automaker to correct it. For other types of vehicle data—such as location, vehicle health, and driver behavior—consumers’ access varied among automakers. For example, some (4 of 13) automakers reported that consumers can access their vehicle health data—such as tire pressure information—through websites or mobile applications. On the other hand, 2 automakers told us it is not possible for consumers to access any data other than subscription-related data. With regard to data accuracy, the majority (9 of 13) of automakers told us they take steps, such as validation tests and other quality control measures, to ensure the accuracy of data collected from connected vehicles. Although most (12 of 15) notices explained how to access and correct one’s data, only a few notices (4 of 15) discussed actions the company takes to ensure data accuracy.

Individual Control: Selected automakers reported that they obtain explicit consent before collecting data and most seek consent again, but they offered few options to consumers besides opting into sharing data and receiving the connected services or opting out of the service entirely if they do not wish to share data. In interviews, all 13 automakers told us that they obtain explicit consent before initiating services that require data to be collected and transmitted, typically through the consumer signing a service agreement or activating the service. Also, the majority of automakers (8 of 13) seek consent again in certain circumstances (e.g., when updating a service subscription or if the company’s data use practices will change significantly). In addition, most of the notices (13 of 15) discussed consumer choices, including how to opt out of sharing data with the automaker. However, all 13 automakers told us while consumers can opt out of sharing data this would typically involve losing all connected vehicle functionality, in part because connected vehicle services are often bundled.

Accountability: Selected automakers reported using various methods to ensure that their staff and third parties receiving personal data handle them properly and most automakers’ notices discussed the methods used. In interviews, almost all automakers (12 of 13) reported that they work to ensure that third parties receiving data meet certain requirements, such as following the automaker’s privacy policies, and most reported including data-handling requirements in their contractual agreements. Several also reported imposing additional requirements, such as asking third parties to conduct privacy risk assessments. Nine automakers also reported that they conduct risk assessments related to third parties’ use of data collected from connected vehicles. Most automakers’ notices included descriptions of the methods used to promote accountability and designated which entity is ultimately responsible for properly handling data. For example, almost all notices (14 of 15) named the company responsible for handling personal data and provided contact information. In addition, the majority of notices (9 of 15) outlined requirements that third parties must meet before receiving data.

Privacy Notices Do Not Guarantee Privacy Protections

Views differ on the importance and effectiveness of privacy notices in providing privacy protections for consumers. For example, FTC’s 2012 report recommended that companies should provide easy-to-use choice mechanisms that allow consumers to control whether their data are collected and how they are used; such mechanisms could include privacy notices. In the report, FTC also recommended that privacy notices should be made clearer, shorter, and more standardized to increase consumers’ ability to comprehend and compare various companies’ data practices. Most (14 of 16) selected experts in our review agreed with that FTC recommendation.

However, FTC, we, and others have acknowledged that improved notices alone cannot guarantee consumer protections. Specifically, FTC has argued that clearer notices and improved consumer choices would need to be combined with other privacy practices, such as focused data collection and data security, to provide substantive privacy protections for consumers. Furthermore, FTC stated that when combined, such practices would help accomplish a broader goal of shifting the burden for protection away from consumers and to the companies handling consumer data. We have also reported that notices alone do not guarantee consumer protections. For example, as we reported in 2016, some consumers do not take the time to read notices, decreasing their ability to provide fully informed consent. In another example, four experts in our review mentioned the multiple decisions and corresponding large amount of paperwork required for buying a vehicle as factors that would make it less likely for a consumer to thoroughly read the privacy notice.

Selected Experts Had Concerns about Connected Vehicle Data Privacy and Automakers’ Privacy Efforts

Selected Experts Generally Agreed Broader Privacy Concerns Applied to Connected Vehicle Data

In interviewing selected experts on privacy issues related to connected vehicle data, we presented the experts with general privacy concerns about the commercial collection and use of data that we had identified from our and other federal agencies’ reports and interviews with organizations that advocate the protection of the privacy of consumers’ data and asked the experts if these issues applied to data collected through connected vehicles. A majority of the experts generally agreed that these general data privacy issues, as described in table 2, apply to connected vehicle data.

All selected experts agreed that tracking, loss of consumer control over personal information, and potentially insecure data were relevant privacy concerns. They emphasized that using location data to track individuals is particularly relevant in the context of vehicles. For example, one expert said location data could paint a picture of an individual’s life, revealing with whom they associate, the doctors they see, and the places they frequent. Experts also raised concerns about potentially inappropriate or illegal uses of location data, such as stalking. All experts expressed concern about potential data access through a security breach; however, no one we interviewed, including automakers, selected experts, industry groups, or government officials was aware of an incident where a database storing connected vehicle data had been compromised maliciously. Regarding loss of consumer control over personal information, one expert explained that it is not possible for a consumer to know exactly what is collected, when, and how the data are used. Another expert noted that other technologies face this same challenge; however, consumers may be less aware of what their vehicle is doing than their computer or smartphone. In addition, vehicles may be used by multiple individuals, and one expert expressed concern about how multiple drivers of a car would be informed about data collection. Some experts thought data sharing and third-party use could become a greater issue as the auto industry evolves. These issues mirror concerns we reported on in 2013 and 2015 about the collection, use, and sharing of personal data by commercial entities.

The majority of experts we interviewed also agreed that the lack of sufficiently informed consent (due to low consumer awareness and lack of company transparency), disparate treatment, and little or no consumer choice were relevant privacy concerns. Several experts said that, as in other industries, informed, meaningful consent is difficult to obtain, as consumers may not read notices and automakers may not present privacy information clearly. Regarding disparate treatment, two experts raised the example that data from connected vehicles could potentially be used to treat consumers differently, and unfairly, in the provision of auto insurance. Finally, experts raised concerns about consumer choice. For example, as described above, several experts noted that consumers must provide consent to all data collection and use or not receive any services. Another expert said that consumers have limited choice because vehicles are essential to people’s lives. Similarly, another expert noted that it is difficult to compare privacy practices across automakers and connected vehicle platforms and that consumers cannot easily change their minds after buying a car, as it is a large financial investment.

Majority of Selected Experts Expressed Concern about Automakers’ Privacy Policies and Efforts

While we did not ask selected experts to comment on individual automaker policies, some were concerned about automakers’ efforts to protect consumer privacy. As previously discussed, automakers signed onto the Consumer Privacy Protection Principles to demonstrate their commitment to protect consumers’ privacy. However, the majority of experts we interviewed (13 of 16) did not think that these principles provide sufficient guidance to inform automakers’ actions or protect consumers’ privacy. Some experts noted that other industries, such as the credit card industry, have developed more specific self-regulatory guidelines that include enforcement measures and better protect consumers.

Most selected experts said the Consumer Privacy Protection Principles lacked specificity about, for example, data use and consumers’ right to protection. For example, they said the principles used “vague language” and allowed for data use without consumers’ affirmative consent for “legitimate business purposes,” which are not clearly defined. To remedy these issues, six experts said the Consumer Privacy Protection Principles should be more specific, and four said the principles should define restrictions on data use. Most experts we interviewed agreed automakers should limit data retention (13 of 16) and limit data collection (12 of 16). While the majority of experts thought that automakers should de-identify data (11 of 15) for focused data use, four experts expressed skepticism about this practice, including whether it is possible to completely de-identify data. In 2013, we reported concerns about de- identifying location data. Specifically, we found that some methods of de- identification can allow for an individual to be re-identified, and that different de-identification methods and data retention practices may lead to varying levels of consumer protection.

Other suggestions to improve the Consumer Privacy Protection Principles included making the principles enforceable, making privacy information accessible and transparent, explaining the rationale or risks and benefits of data use, and laying out the trade-offs for consumers. All selected experts agreed that automakers should be required to obtain explicit consent for the use of sensitive data or data used in a manner beyond a consumer’s expectations. In addition, the majority of experts we interviewed (13 of 16) agreed that automakers should obtain consumer consent at the time and in the context in which consumers are making a decision about their data. Several experts said that consumers should have access to personal data collected about them. However, auto industry trade association officials said that the Consumer Privacy Protection Principles provide automakers with a sufficient framework to address privacy issues and allow automakers the flexibility to tailor implementation.

FTC and NHTSA Have Efforts Related to Data Privacy Under Way, but NHTSA’s Role Is Unclear

FTC and NHTSA Have Efforts and Guidance Related to Protecting Data Privacy

While no federal law expressly confers broad privacy protections for consumers’ data and no single federal agency oversees data privacy issues, the FTC Act gives FTC the authority to bring actions against companies or individuals that engage in unfair or deceptive acts or practices in or affecting commerce. According to FTC officials, the FTC Act applies to privacy and data security issues for connected vehicles. For example, FTC officials said they could use this authority to bring an action against an automaker that uses a consumer’s data without his or her consent or in a way that violates the manufacturer’s stated privacy policy. To date, FTC has not brought such a public enforcement action against a connected vehicle manufacturer or its affiliates, but it has brought such actions against other companies offering services in the Internet of Things. For example, in 2016, FTC settled a case alleging that critical security flaws in a company’s routers put the home networks of hundreds of thousands of consumers at risk. In addition, as the primary agency with authority over consumer privacy, FTC has ongoing efforts related to protecting the privacy of consumers that use connected devices in the Internet of Things, which includes connected vehicles. FTC and FTC staff have issued guidance, including two reports—Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers and Internet of Things: Privacy and Security in a Connected World—both of which outline best practices for companies. Prior to issuing these reports, FTC held outreach forums to gather views from a variety of stakeholders on these issues. One of these forums included a panel specifically focused on consumer-facing technology in connected vehicles, which covered, among other things, an overview of these technologies, security issues, and the diversity of auto industry practices.

NHTSA, according to agency officials, has broad authority over the safety of passenger vehicles and may issue voluntary guidance or mandate standards through a rulemaking process to address safety, but it does not have the authority to regulate consumer privacy as it relates to motor vehicles or motor vehicle data. However, according to NHTSA officials, the agency is required to consider the privacy impacts of its regulatory activities. Specifically, NHTSA is required to conduct privacy impact assessments and inform the public about any consumer privacy impacts that may stem from its activities and the motor vehicle safety standards issued by the agency. Also as part of the rulemaking process, NHTSA examines privacy as a component of public acceptance (i.e., will the public accept and use the mandated technology). According to NHTSA officials, this is an aspect of “practicability” the agency is required to consider when it proposes a motor vehicle safety standard under the Motor Vehicle Safety Act. NHTSA may also address privacy in voluntary guidance it issues for technologies that it expects will have safety benefits and that it may regulate in the future.

Recent efforts by NHTSA to address emerging safety technologies align with NHTSA’s goals of ensuring safety on the roadways and keeping pace with trends impacting consumers. These efforts also illustrate how NHTSA has addressed privacy issues related to emerging technologies. For example, in December 2016, NHTSA proposed a rulemaking on vehicle-to-vehicle technology that, according to NHTSA, is expected to provide safety benefits. The proposed vehicle-to-vehicle rule involves the broadcast, collection, and storage of data that includes location and other information about passenger vehicles. As described in the Notice of Proposed Rulemaking, consumer acceptance of vehicle-to-vehicle technologies—which will depend on addressing consumer privacy concerns, among other concerns—is crucial to achieving the expected safety benefits of this technology. As a result, NHTSA expects manufacturers to take steps to minimize consumer privacy risks by providing a clear and transparent vehicle-to-vehicle privacy notice to consumers.

Similarly, in September 2016, NHTSA issued the Federal Automated Vehicles Policy, to speed the delivery of an initial regulatory framework and best practices to guide manufacturers and other entities in the safe design, development, testing, and deployment of highly automated vehicles (e.g., vehicles systems capable of monitoring the driving environment). As described in this voluntary guidance, NHTSA views automated vehicle technology as capable of bringing significant safety benefits. The guidance, among other things, outlined a set of privacy principles and recommended that automakers manufacturing automated vehicle technologies adopt these or similar principles. In addition, manufacturers and other entities are asked to voluntarily provide information on how the guidance is being followed, including how they are addressing privacy.

According to officials from FTC and NHTSA, in recent years the agencies have collaborated on vehicle data privacy and coordinated their respective efforts in this area. For example, recently, FTC and NHTSA staff has met monthly to discuss cybersecurity and privacy issues related to passenger vehicles. FTC and NHTSA also hosted a workshop in June 2017 on consumer privacy and security issues posed by automated and connected vehicles. Specifically, the workshop aimed to bring together multiple industry stakeholders, consumer advocates, academics, and government regulators to discuss various issues, including potential benefits and challenges posed by the collection of connected and automated vehicle data.

In addition to FTC and NHTSA, other federal agencies doing work on privacy issues include the National Institute of Standards and Technology and the National Telecommunications and Information Administration within the Department of Commerce. For example, in January 2017, the National Institute of Standards and Technology issued a report recommending practices for including privacy risk assessments when designing federal systems, and that according to agency officials, could also serve as guidance for private companies, including automakers. In addition, the National Telecommunications and Information Administration has convened multistakeholder processes with industry and other stakeholders that focused on developing voluntary codes of conduct for the commercial use of emerging technologies, such as facial recognition technology. According to National Telecommunications and Information Administration officials, no additional privacy focused multistakeholder processes are planned at this time.

Selected Stakeholders Said NHTSA’s Evolving Privacy Role is Unclear

The auto industry is currently undergoing a rapid evolution as vehicles become more connected and automated. For example, most automakers and industry associations in our review agreed that auto technology is rapidly evolving, and some of these stakeholders noted that the auto industry more broadly is evolving. As several of these stakeholders told us, this evolution will result in more data—including more sensitive data— being collected, used, and shared.

NHTSA’s recent actions on emerging vehicle technologies align with the agency’s safety mission, authority, and goals. However, NHTSA has not clearly defined and communicated its roles and responsibilities related to the privacy of connected vehicle data to stakeholders. Specifically, according to some automakers and all industry associations we spoke with, NHTSA’s recent actions on emerging vehicle technologies have left stakeholders without a clear understanding of the agency’s role with respect to privacy. For example, three automakers noted that NHTSA appears to be more involved in data privacy as reflected by the Federal Automated Vehicles Policy. One automaker also questioned whether NHTSA was coordinating on data privacy issues with other relevant federal agencies. Five industry associations told us that NHTSA appears to have an interest in the area of privacy. Four of these associations also told us that NHTSA might have a role in monitoring its members’ use of connected vehicle data, but the four were not sure. In addition, in public comments filed on the Federal Automated Vehicles Policy, one auto industry trade group questioned whether considering privacy issues is consistent with NHTSA’s safety mission and suggested that certain privacy provisions in the policy exceeds NHTSA’s current statutory authority. In contrast, all 11 automakers that discussed this topic and all industry associations in our review told us that FTC’s role in this area is clear. For example, representatives of both auto industry associations told us that they had chosen to notify the FTC about their members’ implementation of the Consumer Privacy Protection Principles because FTC would be the federal agency to enforce and hold automakers accountable to these principles. NHTSA officials acknowledged that some stakeholders may be uncertain whether and, if so, to what extent it has authority to address any privacy issues with respect to motor vehicles.

The Standards for Internal Control in the Federal Government call for agencies to identify, analyze, and respond to significant changes, and in response to such changes, to periodically reevaluate and further define key agency roles and responsibilities. These standards also direct agencies to clearly communicate relevant information—such as the agencies’ roles, responsibilities, and important changes to these—to external parties. These standards are intended, among other things, to help agencies manage change associated with shifting environments and evolving demands and priorities. We have also previously found that interagency collaboration is enhanced when agencies, among other things, ensure that their roles and responsibilities are clearly defined. By agreeing on and clearly defining roles and responsibilities, agencies can clarify which agency will do what, organize their joint and individual efforts, and facilitate better decision making. As previously described, NHTSA and FTC have collaborated on the potential privacy risks posed by new vehicle technologies; clarifying NHTSA’s role could therefore further enhance collaboration with FTC and other federal counterparts. Furthermore, if NHTSA more clearly defined its roles and responsibilities for protecting the privacy of connected vehicle data, industry stakeholders would have a better understanding of how the agency intends to oversee the privacy of data generated by emerging vehicle safety technologies and which agency is responsible for privacy as the connected vehicle landscape continues to evolve.

Conclusions

In recent years, connected vehicles have become more common, offering consumers a number of benefits but also increasing the potential for privacy risks. Currently, automakers are reportedly collecting, using, and sharing connected vehicle data on a fairly limited basis and are, at least partially, using leading privacy practices to protect that data. However, experts and others have raised a number of consumer privacy concerns, including whether such data—including sensitive information such as a driver’s location and behavior—are being adequately protected. No single federal agency oversees data privacy issues. However, FTC has the primary role—one that is clearly defined and reinforced through its enforcement actions against companies that have engaged in unfair and deceptive practices, such as violating their own privacy practices or failing to implement reasonable security practices. Although NHTSA has a clear role in overseeing the safety of the estimated 265 million passenger vehicles on U.S. roads today, industry stakeholders are unclear about NHTSA’s role with respect to vehicle data privacy, due to recent agency actions on automated vehicles and vehicle-to-vehicle technology.

With the anticipated increase in the number of connected vehicles on U.S. roads in the near future—and with it, the financial incentives for automakers and others to more widely collect, use, and share vehicle and driver data—it is important for NHTSA to define and communicate its privacy roles and responsibilities. If NHTSA makes its roles and responsibilities clearer, industry stakeholders will likely have a better understanding of its oversight role for emerging vehicle technologies, and NHTSA will likely be more effective in collaborating with FTC and other federal agencies. However, if that opportunity is missed, consumers may not fully embrace emerging technologies with potential safety benefits, such as vehicle-to-vehicle technology and automated vehicles. With a forward-looking approach to identify changes in the environment and clarifying its roles and responsibilities as needed in response, NHTSA can anticipate and—in collaboration with FTC—better plan for the anticipated changes that could impact the privacy of many Americans.

Recommendation for Executive Action

The Secretary of Transportation should direct NHTSA to define, document, and externally communicate the agency’s roles and responsibilities in relation to connected vehicle data privacy.

Agency Comments

We provided a draft of this report to the Departments of Transportation (DOT), Commerce, and Justice, FTC, and the Federal Communications Commission for review and comment. We received written comments from DOT, which are reprinted in appendix IV. We also received technical comments from DOT and FTC, which we have incorporated, as appropriate.

DOT concurred with our recommendation to define, document, and externally communicate the agency’s roles and responsibilities in relation to connected vehicle data privacy. Among other things, DOT reiterated the importance of consumer privacy and how it considers the privacy implications of its regulations and voluntary guidance, such as in the proposed vehicle-to-vehicle rulemaking.

The Departments of Commerce and Justice and the Federal Communications Commission reviewed our report, but did not have any comments.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretaries of Transportation, Commerce, and Justice and the Chairs of the Federal Trade Commission and Federal Communication Commission, and other interested parties. In addition, the report will be available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report addresses the following objectives: (1) the types of data collected by connected vehicles and transmitted to automakers and how, if at all, selected automakers use and share these data, (2) the extent to which selected automakers’ privacy policies for connected vehicles align with leading practices, (3) selected experts’ views on privacy issues related to the commercial use of data collected by connected vehicles, and (4) federal roles and efforts related to the privacy of data collected by connected vehicles.

To address all of our objectives, we reviewed applicable federal statutes and regulations, our prior work, and reports by other federal agencies, academics, and research organizations on privacy and connected technologies. We interviewed representatives of three organizations that advocate protecting the privacy of consumers’ data identified and selected based on their contributions to our prior work. We also interviewed eight industry associations representing automakers, automotive suppliers, application developers, and telecommunication companies. The industry associations we interviewed were: Association of Global Automakers, Alliance of Automobile Manufacturers, Application Developers Alliance, Connected Vehicle Trade Association, Consumer Technology Association, CTIA-The Wireless Association, Motor and Equipment Manufacturers Association, and the National Automobile Dealers Association.

To determine types of data collected from connected vehicles and how, if at all, these data are used, we conducted semi-structured interviews with representatives of 16 automakers and 3 other industry stakeholders. We attempted to interview most of the automakers selling passenger vehicles in the United States and identified them using the membership lists of two automotive industry trade associations, the Alliance of Automobile Manufacturers and the Association of Global Automakers. We selected automakers to interview based on their 2015 U.S. market share, specifically, a market share that was larger than zero. Based on our discussions with the automotive trade associations, we excluded two automakers due to their very small U.S. market share, and two other automakers we contacted told us they no longer sell passenger vehicles in the U.S. We identified and selected one additional automaker, which is not a member of these automotive industry trade associations, due to its growing market share and high profile in the connected vehicle market. Of the 19 automakers we contacted, three did not respond to our interview request. For the complete list of automakers we interviewed, see table 3.

We identified and selected other industry stakeholders based on their industry roles, specifically their roles as telecommunication companies, telematics service providers, and application developers. Of the 12 other industry stakeholders we contacted, we interviewed three stakeholders representing two telecommunications companies and one telematics service provider. Given the small number of other industry stakeholders interviewed, the names of these companies are not included in this report. We used a semi-structured format in our interviews with automakers and other industry stakeholders and asked each type of stakeholder the same set of questions. For example, we asked each automaker what types of data it collects, how these data are used, and how they share these data. We asked each of the 13 automakers that offer connected vehicles a set of additional questions to clarify its use and sharing of data and its privacy practices. After interviewing selected automakers, we summarized and analyzed their responses to identify themes relevant to our research objectives, such as the types of data collected. The views and information gathered through our interviews with selected automakers and industry stakeholders cannot be generalized to the industry as a whole. However, the 16 selected automakers we interviewed produce over 25 vehicle brands and represented around 90 percent of the U.S. passenger vehicle sales market share in 2015.

To determine the extent to which selected automakers’ reported privacy practices and written privacy notices (collectively we refer to these as “privacy policies”) for connected vehicles reflect leading practices, we identified leading practices related to privacy using several widely recognized sources. The privacy frameworks and reports we used for this analysis are: (1) the Organisation for Economic Co-operation and Development’s The OECD Privacy Framework (known as the “Fair Information Practice Principles” (FIPPs); (2) the Federal Trade Commission’s (FTC) report, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers (2012); (3) FTC Staff Report, Internet of Things: Privacy and Security in a Connected World (2015); (4) the National Highway and Transportation Administration’s (NHTSA) Federal Automated Vehicles Policy (2016); and (5) the National Institute of Standards and Technology’s NISTIR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems (2017). We compared the leading practices identified in each source and grouped practices into similar categories. We did not deem any practices from the sources to be irrelevant for our review on connected vehicles, but we did determine that similar identified practices could be combined into one leading practice. The privacy leading practices we used for our analysis are transparency, focused data use, data security, data accuracy and access, individual control, and accountability. To determine the extent to which automakers’ privacy policies reflect these leading practices, we analyzed selected automakers’ written privacy notices through a document review and reported privacy practices related to connected vehicles based on automakers’ responses to semi-structured interview questions. Of the 16 automakers we interviewed, 13 offered connected vehicles at the time we spoke to them. While many of these automakers offer several brands, one automaker had different written privacy notices for its three vehicle brands sold in the U.S. As such, we analyzed a total of 15 sets of privacy policies (their written notices and reported privacy practices).

To analyze the written privacy notices, we developed questions to determine whether an automaker’s written privacy notice specifically addressed the various elements of a privacy leading practice. We conducted a test case with one automaker’s written privacy notice and made needed revisions to the questions. Then, one analyst coded each of the 15 written privacy notices using NVivo software. A second analyst reviewed the coding and confirmed the accuracy of the results.

To analyze the reported privacy practices, we conducted a content analysis of automakers’ interview responses to questions related to their privacy practices. All automakers were asked the same set of questions, and we conducted follow-up with each automaker offering connected vehicles to ensure consistency in responses and ensure that we asked questions related to each of the leading privacy practices identified as relevant for connected vehicles for the purposes of this report. As part of our follow up work, we asked selected automakers questions directly related to the leading privacy practices. One analyst coded the interview responses and a second analyst reviewed and confirmed the accuracy of the coding.

To assess whether an automaker’s policies reflected each of these leading privacy practices, we used the following scale:

Substantially reflected: a company met most (70 percent or more) of the elements of this leading practice.

Partially reflected: a company met about half of the elements of this leading practice.

Minimally reflected: a company met less than half of the elements of this leading practice.

For each of the six leading practices, there were between 5 to 10 questions of equal weight that we used to determine the extent to which a practice was reflected.

As noted above, our analysis of automakers’ privacy policies is based on written notices and reported practices obtained through interviews. We did not conduct a compliance review, as the leading practices used in this report are not legally binding. We also did not evaluate the extent to which selected automakers follow their reported privacy policies.

To determine selected experts’ views on privacy issues related to the commercial use of data collected by connected vehicles, we interviewed 16 subject matter experts in connected vehicles or privacy. We identified a prospective pool of subject matter experts through reviewing our prior reports, related National Academy of Sciences panels, relevant literature, and recommendations from other interviewees. We selected subject matter experts using eight criteria: relevant background, selected academic publications and technical reports, selected presentations at conferences, selected popular source articles, selected testimonies, selected instances of interviews on prior engagements, selected professional service and appointments, and recommendations from other interviewees. Those organizations and individuals that had relevant experience in at least four of our eight criteria were deemed experts for the purposes of our review (see table 4 for the full list of experts we interviewed).

As part of these semi-structured interviews, we presented each selected expert with general privacy concerns about the commercial use of data we identified from our prior reports, FTC reports, and preliminary interviews with organizations that advocate protecting consumers’ data privacy. We asked each selected expert to what extent these privacy concerns were relevant to data collected through connected vehicles. After interviewing selected experts, we summarized and analyzed their responses to identify themes relevant to our research objective. The views and information gathered through our interviews with subject matter experts cannot be generalized to all such experts, but they do provide insight into relevant privacy concerns and solutions.

To examine federal roles and efforts related to the privacy of data collected from connected vehicles, we reviewed relevant documents and interviewed officials from four federal agencies—FTC, Department of Transportation, Department of Commerce, and Federal Communications Commission—that we identified as having privacy and consumer protection responsibilities potentially related to connected vehicles. We also discussed with selected experts, automakers, other industry stakeholders, and industry associations the federal laws that may apply in this context and related federal efforts and roles. Because of DOT’s role in overseeing motor vehicles, we compared DOT’s efforts to reevaluate and define key agency roles and responsibilities as new vehicle technologies emerge with pertinent Standards for Internal Control in the Federal Government and practices identified in our prior work on agency collaboration.

We conducted this performance audit from April 2016 to July 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Summary of Relevant Privacy Frameworks and Self-Regulatory Principles

Appendix III: Analysis of Automakers’ Reported Privacy Policies and Results

We assessed the extent to which selected automakers’ reported policies reflected each of the leading privacy practices we identified. We included in this analysis those 13 automakers offering connected vehicle services. However, one of these 13 automakers has different written privacy notices and reported privacy practices for its three affiliated brands. As a result, our analysis of automakers’ privacy policies included 15 sets of privacy policies. We reviewed the automakers’ written privacy notices and responses to specific interview questions focused on their use of these practices. We also asked automakers to confirm their answers to the interview questions directly related to the leading privacy practices. We used the following scale to categorize the extent to which each automaker’s policies reflected each leading practice:

Substantially reflected: automaker met most (70 percent or more) of the elements of this leading practice.

Partially reflected: automaker met about half (50 to 69 percent) of the elements of this leading practice.

Minimally reflected: automaker met less than half or none of the elements of this leading practice.

For this assessment, we used a total of 43 questions, each of which was given equal weight, across the six identified leading practices: 2) focused data use, 3) data security, 4) data access and accuracy, 5) individual control, and 6) accountability.

Some assessment questions relate to automakers’ written privacy notices and others relate to interview questions we asked about the automaker’s use of the leading practices. The 6 tables below include, for each leading practice: the assessment questions, the results for each automaker, and an overall summary of how fully all the selected automakers’ policies reflected the practice.

Appendix IV: Comments from the Department of Transportation

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, the following individuals made important contributions to this report: Nancy Lueke (Assistant Director); Sarah Arnett (Analyst-in-Charge); Jessica Bryant-Bertail; Camilo Flores; Pamela Davidson; Delwen Jones; Josh Ormond; Eleni Orphanides; and John Villecco.