Patent Description:
<CIT> discloses an information management device that is installed in a vehicle. The information management device inquires of a user of the vehicle as to whether the user will permit storage of privacy information regarding the user in a persistent storage. The privacy information includes, for example, the name of the user, position information related to where the user is, and the speed of the vehicle.

When the user permits storage of the privacy information in the persistent storage, the information management device stores the privacy information in the persistent storage. When the user refuses storage of the privacy information in the persistent storage, the information management device uploads the privacy information of the user to a volatile memory. In such a case, the privacy information of the user is not stored in the persistent storage.

The privacy regulation that is in effect may differ from one jurisdiction to another jurisdiction. A jurisdiction is, for example, a country, a state, or a province.

When a user of a vehicle permits collection of his/her privacy information in a country where the privacy regulations are relatively lax and then the vehicle travels to a country where the privacy regulations are relatively strict, the privacy information may be collected in the country where the privacy regulations are relatively strict in the same manner as in the country where the privacy regulations are relatively lax.

In one general aspect, an information management device is installed in a vehicle. The information management device includes processing circuitry and a storage device. The storage device stores lists, each including one or more privacy information items that cannot be collected without permission from a user. Each of the lists is prepared for one of a plurality of jurisdictions including a first jurisdiction and a second jurisdiction. When the vehicle travels from the first jurisdiction to the second jurisdiction that differs from the first jurisdiction, the processing circuitry is configured to issue an inquiry to the user as to whether the user will permit storage of the one or more privacy information items included in one of the lists corresponding to the second jurisdiction to the storage device before the vehicle starts traveling in the second jurisdiction. The processing circuitry is configured to store the one or more privacy information items included in the one of the lists corresponding to the second jurisdiction to the storage device on condition that the vehicle is located in the second jurisdiction and that the user has permitted storage of the one or more privacy information items.

In another general aspect, a method for managing information in a vehicle includes storing lists into a storage device, each of the lists including one or more privacy information items that cannot be collected without permission from a user with processing circuitry, each of the lists being prepared for one of a plurality of jurisdictions including a first jurisdiction and a second jurisdiction; when the vehicle travels from the first jurisdiction to the second jurisdiction that differs from the first jurisdiction, issuing an inquiry to the user with the processing circuitry as to whether the user will permit storage of the one or more privacy information items included in one of the lists corresponding to the second jurisdiction to the storage device before the vehicle starts traveling in the second jurisdiction; and storing the one or more privacy information items included in the one of the lists corresponding to the second jurisdiction to the storage device with the processing circuitry on condition that the vehicle is located in the second jurisdiction and that the user has permitted storage of the one or more privacy information items.

In another general aspect, an information management program is executed by an information management device installed in a vehicle. The information management device includes processing circuitry and a storage device. The processing circuitry running on the information management program is configured to store lists into the storage device, each of the lists including one or more privacy information items that cannot be collected without permission from a user. Each of the lists is prepared for one of a plurality of jurisdictions including a first jurisdiction and a second jurisdiction. When the vehicle travels from the first jurisdiction to the second jurisdiction that differs from the first jurisdiction, the processing circuitry running on the information management program is configured to issue an inquiry to the user as to whether the user will permit storage of the one or more privacy information items included in one of the lists corresponding to the second jurisdiction to the storage device before the vehicle starts traveling in the second jurisdiction. The processing circuitry running on the information management program is configured to store the one or more privacy information items included in the one of the lists corresponding to the second jurisdiction to the storage device on condition that the vehicle is located in the second jurisdiction and that the user has permitted storage of the one or more privacy information items.

An information management device in accordance with an embodiment will now be described with reference to the drawings.

The schematic configuration of an information management device <NUM> installed in a vehicle will be described with reference to <FIG>. A present jurisdiction determination module <NUM>, which will be described later, repeatedly obtains position information of a vehicle from a Global Positioning System (GPS) sensor <NUM>, which will be described later, from when an ignition key is turned to the on position to when the ignition key is turned to the off position. An information storage module <NUM>, which will be described later, stores lists, each including of one or more privacy information items that can be collected only when permitted by a user. Each of the lists is prepared for a plurality of jurisdictions. The term "jurisdiction" refers to a regional range over which a certain regulation is effective. A jurisdiction is, for example, a country, a state, or a province. The privacy information includes, for example, information that does not change during a trip of the vehicle, such as the name of the user, the phone number of the user, the address of the user, and a facial image of the user. A trip refers to a period of time from when the ignition key is turned to the on position to when the ignition key is turned to the off position. The privacy information also includes, for example, information that continuously changes during a trip of the vehicle, such as the position information of the vehicle and the speed of the vehicle. A storage permitted data determination module <NUM>, which will be described later, stores a privacy setting for each jurisdiction in the information storage module <NUM>. The privacy setting is not deleted even if the ignition key is turned to the off position. The privacy setting indicates whether the user has permitted storage of the privacy information items included in the list to the information storage module <NUM>. The privacy setting is stored when the user responds to an inquiry issued to the user. The schedule for issuing an inquiry will be described later with reference to <FIG> and <FIG>. Based on an affirmative privacy setting related to the jurisdiction in which the vehicle is located, the information storage module <NUM> stores the privacy information in accordance with the list corresponding to the jurisdiction. The affirmative privacy setting indicates that the user has permitted collection of the privacy information items included in the list. Based on a negative privacy setting related to the jurisdiction in which the vehicle is located, a restriction is imposed on storage of the privacy information in the information storage module <NUM> in accordance with the list corresponding to the jurisdiction. The negative privacy setting indicates that the user has refused collection of the privacy information items indicated in the list. For example, the following situations (A) to (C) may occur when a vehicle travels from a first jurisdiction to a second jurisdiction. (A) The privacy regulations in the first jurisdiction do not require permission from the user to store the position information of the vehicle in the information storage module <NUM>. (B) The privacy regulations in the second jurisdiction require permission from the user to store the position information of the vehicle in the information storage module <NUM>. (C) The privacy setting related to the second jurisdiction is negative. In such a case, the information storage module <NUM> stores the position information of the vehicle from when the vehicle enters the first jurisdiction to when the vehicle leaves the first jurisdiction. Storage of the position information of the vehicle in the information storage module <NUM> is restricted from when the vehicle enters the second jurisdiction to when the vehicle leaves the second jurisdiction. The position information of the vehicle from when the vehicle enters the first jurisdiction to when the vehicle leaves the first jurisdiction may be deleted after the vehicle enters the second jurisdiction. Alternatively, the position information may be kept stored even after the vehicle enters the second jurisdiction.

The information management device <NUM> includes an on-board electronic control unit (ECU) <NUM>. The information management device <NUM> further includes the GPS sensor <NUM>, a user interface <NUM>, and a data communication module (DCM) <NUM>. The on-board ECU <NUM> includes the present jurisdiction determination module <NUM>, a user consent acquisition module <NUM>, the storage permitted data determination module <NUM>, and a control module <NUM>. The on-board ECU <NUM> further includes the information storage module <NUM>. The on-board ECU <NUM> is connected to an updating tool <NUM> and receives data from the updating tool <NUM>.

The present jurisdiction determination module <NUM> repeatedly obtains the position information of the vehicle from the GPS sensor <NUM>. The present jurisdiction determination module <NUM> determines the present jurisdiction in which the vehicle is located from the position information of the vehicle. The present jurisdiction determination module <NUM> provides the storage permitted data determination module <NUM> with present jurisdiction information. The present jurisdiction information indicates the present jurisdiction in which the vehicle is located. When the distance from the vehicle to a border of a jurisdiction adjacent to the present jurisdiction in which the vehicle is located becomes less than or equal to a predetermined distance, the present jurisdiction determination module <NUM> provides the user consent acquisition module <NUM> with determination information. The determination information indicates that the distance from the vehicle to the border of the jurisdiction adjacent to the present jurisdiction in which the vehicle is located is less than or equal to the predetermined distance. The predetermined distance is, for example, <NUM> kilometers.

If the privacy setting related to the present jurisdiction in which the vehicle is located has not been stored at a time point at which the ignition key is turned to the on position, the user consent acquisition module <NUM> issues an inquiry. The inquiry is issued from the user interface <NUM>. The inquiry refers to a process for issuing an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the present jurisdiction in which the vehicle is located. The inquiry does not have to be issued if the privacy setting related to the present jurisdiction in which the vehicle is located has already been stored. A case in which the inquiry is issued at a time point at which the ignition key is turned to the on position means that the inquiry is issued before the vehicle starts traveling in the present jurisdiction in which the vehicle is located. In this case, the user may decide whether to consent to storage of all privacy information items included in the list. Alternatively, the user may select to consent to storage of some of the privacy information items included in the list.

The user consent acquisition module <NUM> issues an inquiry when the distance from the vehicle to a border of a jurisdiction adjacent to the present jurisdiction in which the vehicle is located becomes less than or equal to the predetermined distance. This means that the inquiry is issued before the vehicle starts traveling in the jurisdiction adjacent to the present jurisdiction in which the vehicle is located. The inquiry is issued from the user interface <NUM>. The inquiry corresponds to a process for issuing an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the jurisdiction adjacent to the present jurisdiction in which the vehicle is located. The inquiry does not have to be issued if the privacy setting related to the jurisdiction adjacent to the present jurisdiction in which the vehicle is located has already been stored. In this case, the user may decide whether to consent to storage of all privacy information items included in the list. Alternatively, the user may select to consent to storage of some of the privacy information items included in the list.

The storage permitted data determination module <NUM> stores the privacy information items included in the list corresponding to the present jurisdiction in which the vehicle is located in the information storage module <NUM>. This process is executed only when an affirmative privacy setting has been provided for the present jurisdiction in which the vehicle is located.

The storage permitted data determination module <NUM> is configured to receive an update request for updating a list corresponding to one of the jurisdictions that are stored in the information storage module <NUM>. When the storage permitted data determination module <NUM> receives an update request, the storage permitted data determination module <NUM> updates the list corresponding to the one of the jurisdictions in response to the update request. The storage permitted data determination module <NUM> may receive an update request from, for example, the DCM <NUM>. In this case, an over-the-air (OTA) technology is used. Instead of or in addition to the OTA technology, the storage permitted data determination module <NUM> may receive an update request from the updating tool <NUM> connected to the on-board ECU <NUM>.

The control module <NUM> obtains various types of control data and provides the information storage module <NUM> with the obtained control data.

In the above description referring to <FIG>, the on-board ECU <NUM> repeatedly obtains the position information of the vehicle from the GPS sensor <NUM>. This describes a process executed in a normal mode. However, the on-board ECU <NUM> may not be able to obtain the position information of the vehicle from the GPS sensor <NUM>. When the on-board ECU <NUM> is able to obtain the position information of the vehicle, the on-board ECU <NUM> is switched to the normal mode. When the on-board ECU <NUM> cannot obtain the position information of the vehicle, the on-board ECU <NUM> is switched to a restriction mode. In this manner, the on-board ECU <NUM> is switchable between the two control modes.

As shown in <FIG>, the on-board ECU <NUM> repeatedly determines whether the position information of the vehicle can be obtained while the ignition key is at the on position.

In step S200, the on-board ECU <NUM> determines whether the on-board ECU <NUM> can obtain the position information of the vehicle. When an affirmative determination is given in step S200 (step S200: YES), the on-board ECU <NUM> proceeds to step S202. In step S202, the on-board ECU <NUM> is switched to the normal mode. When a negative determination is given in step S200 (step S200: NO), the on-board ECU <NUM> proceeds to step S204. In step S204, the on-board ECU <NUM> is switched to the restriction mode.

In the restriction mode, when the on-board ECU <NUM> cannot obtain the position information of the vehicle, the on-board ECU <NUM> determines whether to store privacy information items included in a default list to the information storage module <NUM>. The default list includes privacy information items that cannot be collected without permission from the user for all jurisdictions. In the restriction mode, the on-board ECU <NUM> issues an inquiry to the user as to whether the user will permit storage of the privacy information items included in the default list to the information storage module <NUM>. If the privacy setting related to the default list has already been stored, the inquiry does not have to be issued.

The flow of processes executed by the on-board ECU <NUM> in the normal mode will now be described in detail with reference to <FIG> and <FIG>.

<FIG> illustrates the flow of a process executed by the on-board ECU <NUM> on condition that the control mode is the normal mode when the ignition switch is turned on. The process illustrated in <FIG> is also executed when the control mode is switched from the restriction mode to the normal mode.

In step S300, the on-board ECU <NUM> determines whether the privacy setting related to the present jurisdiction in which the vehicle is located has been stored. When an affirmative determination is given in step S300 (step S300: YES), the on-board ECU <NUM> ends the process shown in <FIG>.

When a negative determination is given in step S300 (step S300: NO), the on-board ECU <NUM> proceeds to step S302. In step S302, the on-board ECU <NUM> issues an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the present jurisdiction in which the vehicle is located to the information storage module <NUM>. Since the inquiry is issued at a time point at which the ignition key is turned to the on position, the inquiry is issued before the vehicle starts traveling in the present jurisdiction in which the vehicle is located. Then, the on-board ECU <NUM> proceeds to step S304.

In step S304, the on-board ECU <NUM> determines whether the user has permitted storage. When an affirmative determination is given in step S304 (step S304: YES), the on-board ECU <NUM> proceeds to step S306. In step S306, the on-board ECU <NUM> stores a privacy setting indicating that the user has permitted storage in the information storage module <NUM>.

When a negative determination is given in step S304 (step S304: NO), the on-board ECU <NUM> proceeds to step S308. In step S308, the on-board ECU <NUM> stores a privacy setting indicating that the user has refused storage in the information storage module <NUM>.

After the on-board ECU <NUM> executes step S306 or step S308, the on-board ECU <NUM> ends the process shown in <FIG>.

The process illustrated in <FIG> is an example of a case in which the vehicle is traveling from the first jurisdiction to the second jurisdiction, which is adjacent to the first jurisdiction. For example, the user turns the ignition key to the off position in the second jurisdiction without having responded to an inquiry regarding the second jurisdiction that had been issued before the vehicle entered the second jurisdiction.

As a result of steps S300 and S302, the on-board ECU <NUM> issues an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the second jurisdiction in the information storage module <NUM> before the vehicle starts traveling in the second jurisdiction. As a result of steps S202 and S306, the on-board ECU <NUM> stores the privacy information items included in the list corresponding to the second jurisdiction to the information storage module <NUM> on condition that the vehicle is located in the second jurisdiction and the user has permitted storage.

As a result of step S300, the on-board ECU <NUM> does not issue an inquiry when the privacy setting related to the second jurisdiction has been stored in the information storage module <NUM>.

<FIG> illustrates the flow of a process repeatedly executed by the on-board ECU <NUM> from when the ignition switch is turned on if the control mode is the normal mode. The process illustrated in <FIG> is also repeatedly executed once the control mode is switched from the restriction mode to the normal mode.

In step S400, the on-board ECU <NUM> determines whether the distance from the vehicle to a border of a jurisdiction adjacent to the present jurisdiction in which the vehicle is located is less than or equal to the predetermined distance. When a negative determination is given in step S400 (step S400: NO), the on-board ECU <NUM> repeats step S400.

When an affirmative determination is given in step S400 (step S400: YES), the on-board ECU <NUM> proceeds to step S402.

In step S402, the on-board ECU <NUM> determines whether the privacy setting related to the jurisdiction adjacent to the present jurisdiction in which the vehicle is located has been stored in the information storage module <NUM>. When an affirmative determination is given in step S402 (step S402: YES), the on-board ECU <NUM> ends the process shown in <FIG>.

When a negative determination is given in step S402 (step S402: NO), the on-board ECU <NUM> proceeds to step S404. In step S404, the on-board ECU <NUM> issues an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the jurisdiction adjacent to the present jurisdiction in which the vehicle is located to the information storage module <NUM>. As a result of steps S400 to S404, the on-board ECU <NUM> issues the inquiry at a point in time at which the distance from the vehicle to the border of the jurisdiction adjacent to the present jurisdiction in which the vehicle is located becomes less than or equal to the predetermined distance. In other words, the inquiry is issued before the vehicle starts traveling in the adjacent jurisdiction. Then, the on-board ECU <NUM> proceeds to step S406.

In step S406, the on-board ECU <NUM> determines whether the user has permitted storage of the privacy information. When an affirmative determination is given in step S406 (step S406: YES), the on-board ECU <NUM> proceeds to step S408. In step S408, the in-vehicle ECU10 stores a privacy setting indicating that the user has permitted storage.

When a negative determination is given in step S406 (step S406: NO), the on-board ECU <NUM> proceeds to step S410. In step S410, the on-board ECU <NUM> stores a privacy setting indicating that the user has refused storage in the information storage module <NUM>.

After the on-board ECU <NUM> executes step S408 or S410, the on-board ECU <NUM> ends the process shown in <FIG>.

The process illustrated in <FIG> shows an example of a case in which the vehicle travels from the first jurisdiction to the second jurisdiction, which is adjacent to the first jurisdiction.

As a result of steps S400 to S404, the on-board ECU <NUM> issues an inquiry when the vehicle is located in the first jurisdiction and the distance from the vehicle to the border of the second jurisdiction becomes less than or equal to the predetermined distance.

As a result of steps S400 and S404, the on-board ECU <NUM> issues an inquiry to the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the second jurisdiction to the information storage module <NUM> before the vehicle starts traveling in the second jurisdiction. As a result of steps S202 and S408, the on-board ECU <NUM> stores the privacy information items included in the list corresponding to the second jurisdiction to the information storage module <NUM> on condition that the vehicle is located in the second jurisdiction and the user has permitted storage in the information storage module <NUM>.

As a result of step S402, the on-board ECU <NUM> does not issue an inquiry when the privacy setting related to the second jurisdiction has been stored in the information storage module <NUM>.

The privacy setting related to the second jurisdiction may already have been stored in the information storage module <NUM> before the vehicle travels from the first jurisdiction to the second jurisdiction. In such a case, the information management device <NUM> does not inquire of the user as to whether the user will permit storage of the privacy information regarding the list corresponding to the second jurisdiction to the information storage module <NUM>. Thus, the user will not have to respond to the inquiry, and the burden on the user will be reduced.

The present embodiment may be modified as follows. The present embodiment and the following modifications can be combined as long as the combined modifications remain technically consistent with each other.

In the above embodiment, when the vehicle travels from the first jurisdiction to the second jurisdiction, which is adjacent to the first jurisdiction, the information management device <NUM> inquires of the user as to whether the user will permit storage of the privacy information items included in the list corresponding to the second jurisdiction to the information storage module <NUM> before the vehicle starts traveling in the second jurisdiction. The information management device <NUM> may be configured to not issue an inquiry when the privacy setting of a list stored in the information storage module <NUM> in correspondence with a jurisdiction that is not the second jurisdiction is identical to the list corresponding to the second jurisdiction. For example, if the list corresponding to the first jurisdiction is identical to the list corresponding to the second jurisdiction when the privacy setting related to the first jurisdiction has already been stored in the information storage module <NUM>, the information management device <NUM> will not inquire of the user as to whether the user will permit storage of the privacy information regarding the list corresponding to the second jurisdiction to the information storage module <NUM>. Thus, the user will not have to respond to such an inquiry, and the burden on the user will be reduced.

In the above embodiment, a jurisdiction is, for example, a country, a state, or a province. However, there is no limitation to a jurisdiction. For example, if the same privacy regulations are effective in neighboring countries, these countries may be considered as one jurisdiction.

In the above embodiment, the on-board ECU <NUM> issues an inquiry when the distance from the vehicle to the border of the jurisdiction adjacent to the present jurisdiction in which the vehicle is located becomes less than or equal to the predetermined distance. However, this is merely an example. For example, the adjacent jurisdiction may be surrounded by a geofence. In such a case, the on-board ECU <NUM> issues an inquiry when the vehicle passes the geofence.

In the above embodiment, the on-board ECU <NUM> issues an inquiry when the distance from the vehicle to the border of the jurisdiction adjacent to the present jurisdiction in which the vehicle is located becomes less than or equal to the predetermined distance. However, this is merely an example. The on-board ECU <NUM> may issue an inquiry when the distance from the vehicle to the border of jurisdictions differing from the present jurisdiction in which the vehicle is located becomes less than or equal to the predetermined distance. In other words, there may be a different jurisdiction between the present jurisdiction in which the vehicle is located and the jurisdiction related to the inquiry.

In the above embodiment, the privacy setting is not deleted even when the ignition key is turned to the off position. Alternatively, the privacy setting may be deleted when the ignition key is turned to the off position.

In the above embodiment, the information management device <NUM> includes the on-board ECU <NUM> containing multiple modules <NUM> to <NUM> and the information storage module <NUM>. The on-board ECU <NUM> executes software processing. However, this is merely an example. For example, some of the modules <NUM> to <NUM> may be part of a single module. Further, for example, the on-board ECU <NUM> may include a dedicated hardware circuit (e.g., application specific integrated circuit (ASIC)) that executes at least part of the software processing performed in the above embodiment. Specifically, the on-board ECU <NUM> may be modified as long as it has any one of the following configurations (a) to (c). (a) The on-board ECU <NUM> includes a processor that executes all processes according to a program and a program storage device such as a ROM that stores the program. In other words, the on-board ECU <NUM> includes a software execution device. (b) The on-board ECU <NUM> includes a processor that executes part of processes according to a program and a program storage. The on-board ECU <NUM> further includes a dedicated hardware circuit that executes the remaining processes. (c) The on-board ECU <NUM> includes a dedicated hardware circuit that executes all processes. There may be more than one software execution device and/or more than one dedicated hardware circuit. Specifically, the above-described processes may be executed by processing circuitry including at least one of a software execution device and a dedicated hardware circuit. The processing circuitry may include more than one software execution device and more than one dedicated hardware circuit. The program storage device, or computer readable medium, includes any type of storage device that is a medium accessible by a versatile computer or a dedicated computer.

Claim 1:
An information management device (<NUM>) installed in a vehicle, the information management device (<NUM>) comprising:
processing circuitry (<NUM>); and
a storage device (<NUM>), wherein:
the storage device (<NUM>) stores lists, each including one or more privacy information items that cannot be collected without permission from a user, each of the lists being prepared for one of a plurality of jurisdictions including a first jurisdiction and a second jurisdiction;
when the vehicle travels from the first jurisdiction to the second jurisdiction that differs from the first jurisdiction, the processing circuitry (<NUM>) is configured to issue an inquiry to the user as to whether the user will permit storage of the one or more privacy information items included in one of the lists corresponding to the second jurisdiction to the storage device (<NUM>) before the vehicle starts traveling in the second jurisdiction; and
the processing circuitry (<NUM>) is configured to store the one or more privacy information items included in the one of the lists corresponding to the second jurisdiction to the storage device (<NUM>) on condition that the vehicle is located in the second jurisdiction and that the user has permitted storage of the one or more privacy information items.