Driverless cars – an area for data privacy concern?

Shortly we could be watching the latest episode of Game of Thrones while the car safely and smoothly takes us home. The driverless car comes with a lot of obvious benefits, such as reduced congestion and making the roads safer, in that it removes the biggest cause of traffic accidents – human error. However, driverless cars will depend on integrated software and GPS information in order to function properly. A permanent Internet connection and the GPS will enable the car to be traced, which raises data privacy concerns. Hence, the technique that enables the car to be driverless may be what puts obstacles in its way.

What is the concern?

In order to function and deliver a safe ride, driverless cars need to process and collect a huge amount of data. The car knows that you stopped to fill up the tank this morning and that you are most likely to drop by the gym on your way home. This raises concerns regarding data ownership, why you will want to make sure that such data is not used without your consent. But, who owns the data? This is not certain since there are several parties involved, such as the car manufacturer, the owner of the platform on which the data is processed and the individual who owns the car. Furthermore, if driverless cars are not owned by the user but provided as a service, what happens to the ownership of data then?

It is not just data ownership that could be a concern. Driverless cars raise a number of questions relating to the protection of privacy and to data compliance. The fact that cars, more than many other devices, are likely to have several different users, raises questions such as the need for consent to the processing of data every time the car ignition is switched on. The concept of driverless cars also raises the issue of how to guarantee that proportionate and adequate protection of the individual’s privacy is maintained in this world of constant technical evolution.

Another aspect to consider is that problems and bugs in the software that the vehicle relies on may be a matter of life and death. Postponing sending software updates to the vehicle until it passes an Internet connection could lead to avoidable accidents. With regard to this, the software owner may want to have a function enabling the push of software updates to the vehicle as soon as the updates are ready. A driverless car equipped with a permanent Internet connection may also be alerted to hazardous conditions such as slippery roads and be provided with live traffic updates that allow the vehicle to automatically recalculate the route to avoid traffic jams. For this to be possible a constant tracking of movements is required. Is this even allowed?

It has been argued that we as consumers already have adopted technology that allows the tracking of our movements: the mobile phone. Our mobile operators need to know where we are at all times in order to deliver incoming calls. Thus, the same development is predicted for driverless cars. Considering the amount of data involved, entry into the automotive industry by companies like Apple and Google starts to make sense.

From product to service – a trend also in the automotive industry?

It is well-known that the digital economy and the mindset it brings with it enable many industries to go from product to service. Pharmaceutical companies are no longer limited to ‘offering pills’ to people who are ill but can also focus on ‘offering pills’ in order to maintain health (thereby expanding their consumer base). Is this a trend also in the automotive industry? Well, the automotive industry has started a slight shift, or at least an expansion of its focus, from offering the vehicle as a product to using the vehicle as a platform from which it provides services. In other industries where a supplier used to supply a product embedded in a bigger context, the shift would be to offer the service in order to prevent the product from coming to a standstill or failing.

Products serving as a platform for providing services, such as driverless cars, also open up the possibility of allowing third parties to provide services on the platform. From this perspective, additional privacy concerns arise given the increased number of entities processing people’s personal data.

Concluding remarks

Under current and future data protection regimes, users will need to be informed of how their personal data is to be used, the purposes of the use and the recipients of any resulting information. In some cases the user’s explicit consent will be required. Considering the hefty fines proposed in the European Data Protection Regulation – expected to amount to 5% of global annual turnover – driverless cars will need to be developed with privacy by design and privacy by default in mind such as has never been seen before.