The Future of Privacy? Isn’t that the question, as we get closer to the promises of new mobility systems driving transportation? Lauren Smith, with the Future of Privacy Forum, who deals with the policy of all things private and not so private when it comes to data, joined us as she had just finished a panel at the most recent Transportation Research Board annual meeting in Washington. She shares a different perspective on what privacy we all should – or should not – expect in the future.
Regina: (00:06) From GRIDSMART Technologies. I’m Regina Hopper. Welcome to POLICYSMART.
Regina: (00:18) Welcome to this edition of POLICYSMART. We’re still at TRB at this one and then once, so when you’re listening to this, you’re gonna hear a lot of stuff in the background because every where on the exhibit floor here and it’s very cool. All the latest technologies as well as all the latest research that’s going on in new mobility. And Lauren Smith who is with the future of privacy forum, she works on new mobility issues from a policy perspective. I’m so excited to have you here because we hear a lot from our manufacturers and a lot from our, our government officials, but you’re really approaching this from a different perspective. So welcome.
Lauren: (00:52) Thank you. Thanks so much for having me.
Regina: (00:54) So tell us a little bit about first what does the privacy forum do? What, what, what is the purpose of, of ethics work?
Lauren: (01:03) Yeah, so we’re a DC-based sort of incubator privacy ideas. We work to help build responsible data practices for emerging technologies. So often areas that are new areas where there isn’t law and we work with industry, with academics, with policymakers help figure out, um sort of ways to enable new technologies if we try to be optimistic about data, but also making sure we prioritize consumer protection as these data and technologies roll out.
Regina: (01:31) So here we are in the new world of transportation that is not only autonomous but talking to each other, uh, cars, talking to cars, cars, talking to the infrastructure. So that’s pushing out all kinds of data. Right. So tell me from y’alls perspective, what are the issues with regard to technology-driven new mobilities?
Lauren: (01:57) Yeah. So the reality is that data in cars is not entirely new. There’s been OBD systems, there’s been EDRs in cars for decades, but over the last few years there’s been this explosion in the variety, the volume and the connectivity of that information. So when it comes to variety, there’s all sorts of new data generating or collecting sensors in a car. Um, it enables a lot of amazing new safety features such as V2V, such as automatic emergency braking. Um, but it is a big change, uh, when it comes to volume, um just the sheer quantity of data that can be generated by these sensors, particularly when you get to Avs, is having a big impact on the amount of information that can be gleaned, whether it’s Geo location, whether it’s vehicle operation, whether it’s infotainment features that people are using. And then the last one is just connectivity. So before where the information a car generated would have stayed on the vehicle and you might’ve needed a physical plug to access it, now it can be instantaneously transferred either to other vehicles to nearby infrastructure or to subscription services or manufacturers sort of directly through other, through cellular or other connections.
Regina: (03:11) So what does that mean then for the average person who’s watching all of this technology explosion? Really what does that mean for the average person who just wants to get from point a to point b?
Lauren: (03:24) So the good news is that this data is supporting very safety-enhancing technologies. So, so that’s something that is really exciting and has the potential to sort of mitigate a lot of the accidents that happen on the roads, but it means that it’s time for us to start thinking of cars more like our smartphones are computers than these sort of mechanical chassis that we’ve gotten used to. Um, you know, we’ve long a lot of cars, a sort of safeguarding our autonomy and freedom. Um, and they still, they still can to some degree, but it’s important to recognize that they are data generating devices just like your internet browser, just like your computer and your smartphone. Um, it’s important to understand, you know, what technologies are in your car. The way you might think about sharing information for safety features might differ from the extent to which you might want to share information for infotainment, um, about your listening habits. You know, you may have an option to get discounts if you share your location at nearby restaurants or gas stations. That may be something that you want to do. You’d like to have the discount. It’s nearby, but you have to recognize that you’re sort of in this new ecosystem where there’s a growing number of parties involved.
Regina: (04:37) So, you know, we, we, we walk around with our phones all the time and we don’t realize that our phone’s telling somebody where we are. Maybe a lot of somebodies where we are, where we’ve been. What kind of food would you like to eat? How often we speak on the phone, what, what we buy from Amazon prime or whatever. Right. So is this what you’re talking about then? That we’ve been a little bit, I guess numb to the fact that our phones we have with us so often we’re given a lot of data and we don’t really seem to care. Is that going to be the same way with the car or do we need to approach it differently than what we do with our phones?
Lauren: (05:14) So I think there are some unique aspects of the car. One is we’re just sort of used to them being this different kind of device and it’s shifting. Whereas the smartphone was kind of in an entirely new device, you know, I’d had one functionality we’re used to, but most of it was new. Um, you know, I think in a, in a phone you have a little bit more control over which apps you download, whereas in a car there tends to be sort of a fixed software interface. Um, and as with anything in the Internet of things, sort of your screen is constrain your ability to find the privacy policies. You may have to look elsewhere. You may want to look online
Regina: (05:47) Does anybody really ever read those. I’ve always wanted to ask this question. It was somebody who knows, right? It’s like you get, you’re trying to get onto something and this long thing. I agree. And people just kind of hit it, right? Yeah.
Lauren: (06:00) Yeah. So it’s a challenge. So there are some, you know, there’s some creative thinking happening around privacy right now. They’re sort of privacy by design. How do we build privacy into technologies from the outset so that it’s sort of logical and clear and doesn’t just require reading along contracts that few people might read. Um, you know, are there icons of communicate when data is being transferred or they’re all different sorts of cues, are there different ways to control and access to the information and, and see it after the fact and decided to delete it. The good news in the auto space is that the, most of the manufacturers that sell in the US, uh, saw these questions coming and they agreed to a set of privacy principles back in 2014 that would bind connected vehicles and services. And so that creates a bit of protection that wouldn’t have otherwise been there because these companies committed it in writing to things like transparency to making privacy policies available to having a part of their website that talks about these issues to
Lauren: (07:02) Um requiring affirmative express consent for more sensitive information that it’s like be a geolocation biometric or behavioral information,
Regina: (07:10) almost like an opting in kind of thing.
Lauren: (07:12) Yeah. For the more sensitive information.
Regina: (07:15) So if I’m, if I have one of these new cars and it’s collecting all this information, who actually owns that information?
Lauren: (07:24) So that is one of the many unresolved questions, um, the government accountability office to study around connected vehicle data a few years ago. And uh, there are a lot of answers to that question and they were mostly different from each other.
Regina: (07:39) That’s interesting.
Lauren: (07:40) So apart from EDR data, which sort of has its own legal treatment-
Regina: (07:44) And by EDR for those of us who are parsing.
Lauren: (07:47) So for the event data recorder, that’s sort of the black box and a car that has more, there was more information about who legally owns that data, um, as opposed to the rest of it, which is not explicitly prescribed.
Lauren: (08:01) Some automakers and services will say, well, of course the, the customer owns the data, but the reality is that you are agreeing to share it. The moment that you sign up for the service and you may or may not have access to it. So when the car is a little more complex than in other sort of areas of IoT, the Internet of things where you may have a lot of the same questions. Um, but in the car, you know, you, you buy the car, it has a symbol from the manufacturer, but you buy it from a dealer which is affiliated with the manufacturer but isn’t exactly the manufacturer. Suppliers have built different aspects of it depending on what features are inside, different entities may be designing the infotainment system, maybe the ones that you’re, you know, your connectivity provider, there’s a lot of different entities in the car and so figuring out who gets access to that data, who has the customer interface, whether the consumer can have access, those are still sort of evolving very quickly and it can be a challenge because sometimes the infotainment systems are not as straightforward as our computers might be for trying to navigate, understand,
Regina: (09:11) And that’s all about what you’re watching or listening to in the car that can then be pushed out to market more things to you. Right?
Lauren: (09:18) So yeah, there’s this, there’s this opportunity, you know, some folks have predicted that the connected car ecosystem, that the data involved there could be an up to $750 billion market place by 2030.
Regina: (09:32) $750 billion just off of the data that’s coming off of. So that’s all. Everything from I’m going to sell you that there’s a fast food place down the road so that can come back to you or you liked jazz. So I’m going to push out jazz. Is that what we’re talking about or are we talking about more?
Lauren: (09:47) It can include marketing opportunities like that. It could also include the ability to have sort of predictive maintenance for a manufacturer to understand how their cars are wearing on the road to alert you in advance if there’s an issue so that you may not wind up with a crisis on the side of the road.
Regina: (10:06) I’d like that.
Lauren: (10:08) So
Regina: (10:09) I actually would like that one.
Lauren: (10:11) So there’s a number of different use cases and I think we’re, we’re still in the early stages of seeing, you know, what consumers are comfortable with and I think it will also change as we get some more automated, more highly automated cars and autonomous vehicles. You can imagine if you’re in an autonomous vehicle on a three hour drive, you may want to watch a movie. You may be excited about the idea that there could be, you know, movies with previews in your car. There’s already been some big announcements Intel and warner brothers partnered to be able to provide content and autonomous cars and there were some announced at CES last week and you know, I think we’re still navigating as with anything in privacy sort of, uh, what will consumers be excited about and what will be considered creepy and figuring out where that line is.
Regina: (10:57) So how much of this now as you start identifying what the issues are in the new mobility spaces, what’s the next step in then for you guys? Is the next step public policy development where you go through your traditional legislative or regulatory venues? Or is it working directly with manufacturers to try to like avoid the whole government part of it or what, what are the steps and in the protection mechanism?
Lauren: (11:23) So it’s a mix. So in the US right now we don’t have a federal privacy law, there’s a number of sectors, specific laws, but there isn’t something that would sort of explicitly bind the auto space. Um, there is the Federal Trade Commission, which tends to be our main consumer protection agency. They can enforce after the fact against unfair and deceptive practices so they can come in and say a company did something they shouldn’t have or that they said they wouldn’t, uh, and impose privacy regime or requirements on them. But in order to sort of understand how to abide by FTC, you can follow the decisions that are being made. Um, and you can just, you can try to have good practices with your consumers. But in the absence of any sort of explicit regulation, there’s a lot of self regulatory efforts in this space. And they can be helpful because they set a floor for an industry.
Lauren: (12:13) Um, there’s, you know, there’s a range. It can be, you know, a set of best practices that folks in the industry and academia and policy makers work together to sort of say this is a really tough problem. Here are some ideas or how to have best practices or it can range to something like what the automakers did, which is a set of principles that they signed on to. Um, and so those are actually enforceable by the FTC because it’s a promise that these companies made that they would abide by by these things. You know, I think with emerging technologies that can be hard to know exactly how something needs to be regulated this early in a, in a technology, you know, I think even for AVs overall, um, we’re saying they should meet a issue. There’s sort of voluntary safety standards that are being navigated because we don’t know yet which sensors will be necessary. Um, and which might work better than others. So same for privacy. You know, there’s some baseline efforts. Some of the legislation last year proposed, you know, that cars should have privacy policies, that there’d be a database that explains the technologies. There was some calls for studies of some of these heart issues, including who owns the data, including basic concepts like how do we delete basic personal information off of a car easily, uh, many of us may have gotten into a rental car and seeing the prior drivers contacts. Or, wrapping history on there.
Regina: (13:38) And I didn’t even thought about that. That’s true. No, that’s true.
Lauren: (13:42) Yeah. It’s sort of one of the lower tech types of data.
Lauren: (13:45) Uh, and it’s not really something that’s of interest to a car company say, but it could create a real privacy risks if you leave your car and someone you know, has your home address that you just drove to and has their list of contacts. So we need to work with industry thing and areas like that to come up with is there a set of best practices? Is there a technical mechanism that can make it easy to wipe this when it’s going through a rental car agency and going out to the next person very quickly or when a dealer is selling an old car.
Regina: (14:14) Oh that’s really fascinating. So if I’m. So if I’m the. I never thought about that by the way, because I have gotten in cars, rental cars where it’s like, oh, Hello Tony, you know, and you’re like, what? And it never even crossed my mind to look at it, but I guess if you were in litigation or you were just nosy or something else, you really probably could find data that the person in front of you or just behind you, um, didn’t realize they were leaving behind when they did this.
Lauren: (14:42) And it could create a security rescue. Can Imagine, you know.
Regina: (14:44) Sure.
Lauren: (14:45) If, if someone has access to your home address and the garage door code is programmed into the garage, that could give them access to your home.
Regina: (14:53) That’s really interesting. So, okay. So if I’m the consumer and we have now a lot of unanswered questions because of we’re not exactly sure with autonomy or connectivity where the next thing is going to go, what do I do to protect myself? What do I do in this new era?
Lauren: (15:11) So if you’re buying a car, go to the manufacturer’s website and advance and understand the types of services that will be involved and how they’ll use your data, be aware that you make it a 30 day free offers when you sign up a what, when you purchase a car to sign up for some of these connected services and if you’re agreeing to share to, to have those, you’re probably agreed to share data with those. And so just make sure you’re incorporating that into the calculation. Um, and I think it, I think it’s a shift in mindset and recognizing that the information being generated in your car may be accessible to the folks that have built in or enter keeping it up, um, including when you take it into a shop. And you know, I, I think it’s incumbent on the industry as well to try to work harder to explain these things to consumers.
Lauren: (16:04) So future privacy forum partnered with the dealers alliance to create a pamphlet that says, you know, it’s a consumer guide to the connected car. So something they could hand out that says this is the type of data cars collect, this is what it’s used for, these are the protections on it. These are the steps you might want to take to wipe your information before I’m returning or selling a car you’ve used. I think we should work harder as an industry to share that information because in the privacy world, a lot of what winds up a sort of creating issues is not necessarily what’s illegal to do with data, but what people find unexpected and creepy.
Regina: (16:41) Yeah, it is. So I wanted. I want to take that from you if we can. If there’s a link or something and maybe we’ll, we’ll. We will. We will put it in the show notes for the podcast because I think for people who are out there looking at cars, maybe this isn’t something that they’ve even considered.
Lauren: (16:59) Something I might flag. Also when you’re looking ahead towards autonomy and considering ride sharing, there are also some new questions around privacy that will be raised in those contexts.
Regina: (17:09) And is that anywhere that, that folks can find them, like this pamphlet or if those are things that are still being worked on?
Lauren: (17:15) Those are things that are still being worked on and thought about. Um, you know, we’ve talked about it here. At TRB we had a session earlier today and you know, many of us may have gotten into Ubers or Lyfts and seeing, you know, the driver had a camera facing the road and be facing internally probably for liability purposes in case something happened. Um, but that might be recording you as you’re sitting there.
Regina: (17:37) That’s interesting. I hadn’t even thought about that.
Lauren: (17:39) If they recognize that what you’re doing there may not be entirely private that’s interested in autonomous car. There will certainly be incentives for companies to what’s happening in their car. They’re deploying this very expensive unmanned vehicle. Um, they probably would want to know if it’s dirty, they probably will want to know if there’s an incident they probably might for security reasons and to be able to detect is there a bomb in the car? Is there some sort of threat? So, um, that’s something to think about. Also autonomous vehicles will be constantly mapping the outside, uh, they’re sort of regularly mapping the same area to ensure that their vehicle can operate there and thinking about what that video might pick up and how that’s treated. Um,
Regina: (18:24) There’s a lot here. There’s a lab, you have the keys. Yeah, I mean I seriously, you’re going to have a job for a really long but. Okay. So as we go into 2019, just to kind of wrap up, what do you think that the issue of 2019 is going to be and maybe it’s not one, maybe it’s several, but
Lauren: (18:42) In privacy and transportation. So one big one that’s again coming up a lot at this show here is the question of data sharing and the fact that cities and municipalities can benefit from data around transportation technologies, but there’s also some tensions there with the industry not necessarily always wanting to share all of that data but wanting to be permitted to operate. Um, and there are questions around how can a government protect that data if they are getting these large quantities of data. I think that’s something that was talked about a lot at CES is being talked about a lot here and then just get a to figure out what else. This year, I do think that the basic data deletion question is something that hopefully is tackled this year. Um, I, you know, I hope there are no incidents, but I worry that at some point there could be an incident and a, in the latest draft of the AV legislation in the Senate, there was a call for a GAO to study this issue and see if there’s a technical mechanism. You know, there’s also just very rapidly advancing driver assistance technologies in cars. There’s things like biometric starting to be used to do facial recognition to see who was in a car.
Regina: (19:58) Let’s not even go there. No, I mean it’s just the whole camera thing. I mean, you think about the car collecting data, but the whole thing about having an entire camera, you know, I constantly recording what might be going on.
Lauren: (20:11) Yeah. And there’s upsides there at the LA auto show. There was a booth where I had a demo where they were apparently reading your brain waves to see if you’re paying attention at the wheel and they would alert you if you weren’t. So, you know, it’s important. I think we, we keep in mind the benefits of some of these technologies, but also just make sure we’re being proactive because this is a big shift for consumers and making it as easy as possible to understand what data is being collected and generated, how to control it, you know, does it go to my insurance company? How do I explicitly opt in to something like that. Um, I think for consumers it’s important to recognize the change in our industry. It’s important to be as proactive as possible.
Regina: (20:55) Well, for everybody listening, it’s the future of privacy forum. Lauren Smith who is doing amazing work in bringing all of this together. Thank you. We’d love to have you back. Especially as we get into the year and people, you know, this is probably one of the most important issues, the privacy issue around data. Who owns it? How do I protect it now? Am I protecting myself? So thank you for giving us some time today.
Lauren: (21:21) Thanks for having me.
Regina: (21:23) So thanks so much for listening and participating in the POLICYSMART podcast. You can download the POLICYSMART App on the Apple App Store and Google Play and you can listen to the podcast on Apple Podcast, Google Play, and now on Spotify. And also please leave a review to help people like you those interested in the next generation of mobility and intelligent transportation find us.