Autonomous Vehicles and Data Privacy

Data Collection on Wheels

Autonomous vehicles (AVs) are data-hungry machines. To navigate roads, detect obstacles, and make informed decisions, they rely on a vast network of sensors, cameras, and other technologies that constantly collect and process data.

This data can include:

• Location data: GPS coordinates, routes, and destinations.
• Biometric data: Facial recognition, driver monitoring, and even health indicators like heart rate.
• Driving behavior: Speed, braking patterns, and interactions with other vehicles.
• Environmental data: Road conditions, traffic patterns, and pedestrian movements.

Surely They Will Protect Our Data?

Toyota is one of the world’s most well known automakers. If we take them as an example, we can find a number of privacy incidents over the last few years:

• October 2022 - ‘Toyota customer data exposed as dev published key on GitHub’ - Toyota confirmed that data of almost 300,000 of its customers leaked online after the company’s developer published the source code of the user site on GitHub five years ago. Source: cybernews
• May 2023 - ‘More than 2 million Toyota users face risk of vehicle data leak in Japan’ - almost the entire customer base of Japanese users of its cloud service platforms had their data publicly available as far back as 2012. Source: Reuters
• August 2024 - ‘Toyota confirmed that customer data was exposed in a third-party data breach after a threat actor leaked an archive of 240GB of stolen data on a hacking forum.’ Source: Bleeping Computer

Privacy Risks on the Horizon

The extensive data collection by AVs raises several privacy concerns:

• Surveillance and Tracking: Continuous location tracking could create detailed profiles of individuals’ movements, habits, and even personal relationships.
• Data Breaches: Unauthorized access to sensitive data could lead to identity theft, financial fraud, or even stalking.
• Misuse by Third Parties: Data sharing with insurance companies, law enforcement, or advertisers could lead to discriminatory practices or unwanted marketing.
• Erosion of Anonymity: Even anonymized data can be re-identified when combined with other datasets, potentially exposing individuals’ private lives.

Legal and Regulatory Landscape

General Data Protection Regulation (GDPR)

In the European Union, the General Data Protection Regulation (GDPR) sets a robust standard for protecting personal data, including data collected by autonomous vehicles. The GDPR emphasizes principles such as:  

• Lawfulness, fairness, and transparency: Data collection must have a legitimate purpose and be conducted in a transparent manner, with users informed about how their data will be used.  
• Purpose limitation: Data collected for one purpose cannot be used for another unrelated purpose without user consent.  
• Data minimization: Only the data absolutely necessary for the intended purpose should be collected and processed.  
• Accuracy: Data must be accurate and kept up to date.  
• Storage limitations: Data should not be stored longer than necessary for the specified purpose.
• Integrity and confidentiality: Appropriate security measures must be in place to protect data from unauthorized access or disclosure.   These principles are particularly relevant to autonomous vehicles, which collect vast amounts of potentially sensitive data. For example, the GDPR’s restrictions on processing sensitive data, such as health information, could impact the collection and use of biometric data by AVs.

California Consumer Privacy Act (CCPA)

In the United States, the California Consumer Privacy Act (CCPA) grants consumers significant rights regarding their personal information, including data collected by businesses in the context of autonomous vehicles. The CCPA provides consumers with the right to:  

• Know what personal information is collected.
• Access their personal information.
• Request deletion of their personal information.
• Opt-out of the sale of their personal information.  

ePrivacy Directive

The ePrivacy Directive in the EU also plays a significant role in regulating AV data. Article 5(3) of the directive focuses on access to information stored in terminal equipment, which includes in-vehicle systems. This provision restricts access to and use of data stored in a user’s device without their consent. While the interpretation of this article in the context of AVs is still debated, it highlights the need for manufacturers to be transparent about data collection practices and obtain user consent for accessing and processing in-vehicle data.  

Other Relevant Regulations

In addition to the GDPR, CCPA, ePrivacy Directive and simlar regional Data Privacy Laws, other regulations and guidelines may also be relevant to Data Privacy:

• Sector-Specific Laws: Some jurisdictions have enacted laws specifically addressing autonomous vehicles, such as the UK’s Automated and Electric Vehicles Act 2018. or Germany’s Act on Autonomous Driving, which includes provisions on data protection
• UNECE Regulations: The United Nations Economic Commission for Europe (UNECE) has developed regulations on vehicle cybersecurity and software updates (R155 and R156) that include data protection considerations.  

What should Vehicle Manufacturers do?

Autonomous vehicles (and actually, connected vehicles in general) raise some serious data privacy concerns. These cars are constantly gathering information about your location, driving habits, and even what’s going on inside the vehicle. To prevent this data from being misused or falling into the wrong hands, the industry needs to adopt a privacy-first mindset. This means collecting only the data that’s absolutely necessary for the car to function, being upfront with passengers about what information is being collected and why, and giving people control over their own data. It also means protecting that data with strong security measures like encryption and making sure it’s not used for purposes that passengers haven’t agreed to.